able/windows-nt
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
windows-nt/Source/XPSP1/NT/base/ntos/mm/acceschk.c

662 lines
19 KiB
C
Raw Normal View History

Add source files
2020-09-26 03:20:57 -05:00
/*++
Copyright (c) 1989 Microsoft Corporation
Module Name:
acceschk.c
Abstract:
This module contains the access check routines for memory management.
Author:
Lou Perazzoli (loup) 10-Apr-1989
Landy Wang (landyw) 02-June-1997
Revision History:
--*/
#include "mi.h"
#if defined(_WIN64)
#include "wow64t.h"
#pragma alloc_text(PAGE, MiCheckForUserStackOverflow)
#if PAGE_SIZE != PAGE_SIZE_X86NT
#define EMULATE_USERMODE_STACK_4K 1
#endif
#endif
//
// MmReadWrite yields 0 if no-access, 10 if read-only, 11 if read-write.
// It is indexed by a page protection. The value of this array is added
// to the !WriteOperation value. If the value is 10 or less an access
// violation is issued (read-only - write_operation) = 9,
// (read_only - read_operation) = 10, etc.
//
CCHAR MmReadWrite[32] = {1, 10, 10, 10, 11, 11, 11, 11,
1, 10, 10, 10, 11, 11, 11, 11,
1, 10, 10, 10, 11, 11, 11, 11,
1, 10, 10, 10, 11, 11, 11, 11 };
NTSTATUS
MiAccessCheck (
IN PMMPTE PointerPte,
IN ULONG_PTR WriteOperation,
IN KPROCESSOR_MODE PreviousMode,
IN ULONG Protection,
IN BOOLEAN CallerHoldsPfnLock
)
/*++
Routine Description:
Arguments:
PointerPte - Supplies the pointer to the PTE which caused the
page fault.
WriteOperation - Supplies nonzero if the operation is a write, 0 if
the operation is a read.
PreviousMode - Supplies the previous mode, one of UserMode or KernelMode.
Protection - Supplies the protection mask to check.
CallerHoldsPfnLock - Supplies TRUE if the PFN lock is held, FALSE otherwise.
Return Value:
Returns TRUE if access to the page is allowed, FALSE otherwise.
Environment:
Kernel mode, APCs disabled.
--*/
{
MMPTE PteContents;
KIRQL OldIrql;
PMMPFN Pfn1;
//
// Check to see if the owner bit allows access to the previous mode.
// Access is not allowed if the owner is kernel and the previous
// mode is user. Access is also disallowed if the write operation
// is true and the write field in the PTE is false.
//
//
// If both an access violation and a guard page violation could
// occur for the page, the access violation must be returned.
//
if (PreviousMode == UserMode) {
if (PointerPte > MiHighestUserPte) {
return STATUS_ACCESS_VIOLATION;
}
}
PteContents = *PointerPte;
if (PteContents.u.Hard.Valid == 1) {
//
// Valid pages cannot be guard page violations.
//
if (WriteOperation != 0) {
if ((PteContents.u.Hard.Write == 1) ||
(PteContents.u.Hard.CopyOnWrite == 1)) {
return STATUS_SUCCESS;
}
return STATUS_ACCESS_VIOLATION;
}
return STATUS_SUCCESS;
}
if (WriteOperation != 0) {
WriteOperation = 1;
}
if ((MmReadWrite[Protection] - (CCHAR)WriteOperation) < 10) {
return STATUS_ACCESS_VIOLATION;
}
//
// Check for a guard page fault.
//
if (Protection & MM_GUARD_PAGE) {
//
// If this thread is attached to a different process,
// return an access violation rather than a guard
// page exception. The prevents problems with unwanted
// stack expansion and unexpected guard page behavior
// from debuggers.
//
if (KeIsAttachedProcess()) {
return STATUS_ACCESS_VIOLATION;
}
//
// Check to see if this is a transition PTE. If so, the
// PFN database original contents field needs to be updated.
//
if ((PteContents.u.Soft.Transition == 1) &&
(PteContents.u.Soft.Prototype == 0)) {
//
// Acquire the PFN lock and check to see if the
// PTE is still in the transition state. If so,
// update the original PTE in the PFN database.
//
//
// Initializing OldIrql is not needed for correctness but
// without it the compiler cannot compile this code
// W4 to check for use of uninitialized variables.
//
OldIrql = PASSIVE_LEVEL;
if (CallerHoldsPfnLock == FALSE) {
LOCK_PFN (OldIrql);
}
PteContents = *(volatile MMPTE *)PointerPte;
if ((PteContents.u.Soft.Transition == 1) &&
(PteContents.u.Soft.Prototype == 0)) {
//
// Still in transition, update the PFN database.
//
Pfn1 = MI_PFN_ELEMENT (PteContents.u.Trans.PageFrameNumber);
//
// Note that forked processes using guard pages only take the
// guard page fault when the first thread in either process
// access the address. This seems to be the best behavior we
// can provide users of this API as we must allow the first
// thread to make forward progress and the guard attribute is
// stored in the shared fork prototype PTE.
//
if (PteContents.u.Soft.Protection == MM_NOACCESS) {
ASSERT ((Pfn1->u3.e1.PrototypePte == 1) &&
(MiLocateCloneAddress (PsGetCurrentProcess (), Pfn1->PteAddress) != NULL));
if (CallerHoldsPfnLock == FALSE) {
UNLOCK_PFN (OldIrql);
}
return STATUS_ACCESS_VIOLATION;
}
ASSERT ((Pfn1->u3.e1.PrototypePte == 0) ||
(MiLocateCloneAddress (PsGetCurrentProcess (), Pfn1->PteAddress) != NULL));
Pfn1->OriginalPte.u.Soft.Protection =
Protection & ~MM_GUARD_PAGE;
}
if (CallerHoldsPfnLock == FALSE) {
UNLOCK_PFN (OldIrql);
}
}
PointerPte->u.Soft.Protection = Protection & ~MM_GUARD_PAGE;
return STATUS_GUARD_PAGE_VIOLATION;
}
return STATUS_SUCCESS;
}
NTSTATUS
FASTCALL
MiCheckForUserStackOverflow (
IN PVOID FaultingAddress
)
/*++
Routine Description:
This routine checks to see if the faulting address is within
the stack limits and if so tries to create another guard
page on the stack. A stack overflow is returned if the
creation of a new guard page fails or if the stack is in
the following form:
stack +----------------+
growth | | StackBase
| +----------------+
v | |
| allocated |
| |
| ... |
| |
+----------------+
| old guard page | <- faulting address is in this page.
+----------------+
| |
+----------------+
| | last page of stack (always no access)
+----------------+
In this case, the page before the last page is committed, but
not as a guard page and a STACK_OVERFLOW condition is returned.
Arguments:
FaultingAddress - Supplies the virtual address of the page which
was a guard page.
Return Value:
NTSTATUS.
Environment:
Kernel mode. No mutexes held.
--*/
{
PTEB Teb;
PPEB Peb;
ULONG_PTR NextPage;
SIZE_T RegionSize;
NTSTATUS status;
PVOID DeallocationStack;
PVOID *StackLimit;
PETHREAD Thread;
ULONG_PTR PageSize;
PEPROCESS Process;
ULONG OldProtection;
ULONG ExecuteFlags;
ULONG ProtectionFlags;
LOGICAL RevertExecuteFlag;
ULONG StackProtection;
#if defined(_WIN64)
PTEB32 Teb32;
Teb32 = NULL;
#endif
//
// Make sure we are not recursing with the address space mutex held.
//
Thread = PsGetCurrentThread ();
if (Thread->AddressSpaceOwner == 1) {
ASSERT (KeGetCurrentIrql () == APC_LEVEL);
return STATUS_GUARD_PAGE_VIOLATION;
}
Process = NULL;
Teb = Thread->Tcb.Teb;
//
// Create an exception handler as the TEB is within the user's
// address space.
//
try {
//
// Initialize default protections early so that they can be used on
// all code paths.
//
ProtectionFlags = PAGE_READWRITE | PAGE_GUARD;
RevertExecuteFlag = FALSE;
StackProtection = PAGE_READWRITE;
#if defined(_IA64_)
if ((Teb->NtTib.StackBase <= FaultingAddress) &&
(Teb->DeallocationBStore > FaultingAddress)) {
//
// Check to see if the faulting address is within
// the bstore limits and if so try to create another guard
// page in the bstore.
//
//
// +----------------+
// | | last page of stack (always no access)
// +----------------+
// | |
// | |
// | |
// +----------------+
// | old guard page | <- faulting address is in this page. |
// +----------------+
// bstore | |
// growth | ...... |
// | |
// ^ | allocated |
// | | | StackBase
// +----------------+
//
//
NextPage = (ULONG_PTR)PAGE_ALIGN(FaultingAddress) + PAGE_SIZE;
RegionSize = PAGE_SIZE;
if ((NextPage + PAGE_SIZE) >= (ULONG_PTR)PAGE_ALIGN(Teb->DeallocationBStore)) {
//
// There is no more room for expansion, attempt to
// commit the page before the last page of the
// stack.
//
NextPage = (ULONG_PTR)PAGE_ALIGN(Teb->DeallocationBStore) - PAGE_SIZE;
status = ZwAllocateVirtualMemory (NtCurrentProcess(),
(PVOID *)&NextPage,
0,
&RegionSize,
MEM_COMMIT,
PAGE_READWRITE);
if ( NT_SUCCESS(status) ) {
Teb->BStoreLimit = (PVOID)( (PUCHAR)NextPage);
}
return STATUS_STACK_OVERFLOW;
}
Teb->BStoreLimit = (PVOID)((PUCHAR)(NextPage));
}
else {
#endif
DeallocationStack = Teb->DeallocationStack;
StackLimit = &Teb->NtTib.StackLimit;
//
// The stack base and the stack limit are both within the stack.
//
if ((Teb->NtTib.StackBase <= FaultingAddress) ||
(DeallocationStack > FaultingAddress)) {
#if defined(_WIN64)
//
// Also check for the 32-bit native stack on NT64.
//
Teb32 = (PTEB32) Teb->NtTib.ExceptionList;
if (Teb32 != NULL) {
ProbeForReadSmallStructure(Teb32, sizeof(TEB32), sizeof(ULONG));
if ((ULONG_PTR)Teb32->NtTib.StackBase > (ULONG_PTR)FaultingAddress &&
(ULONG_PTR)Teb32->DeallocationStack <= (ULONG_PTR)FaultingAddress) {
DeallocationStack = (PVOID)ULongToPtr(Teb32->DeallocationStack);
StackLimit = (PVOID *)&Teb32->NtTib.StackLimit;
}
else {
//
// Not within the stack.
//
return STATUS_GUARD_PAGE_VIOLATION;
}
}
else
#endif
{
//
// Not within the stack.
//
return STATUS_GUARD_PAGE_VIOLATION;
}
}
//
// If the image was marked for no stack extensions we will return
// stack overflow immediately.
//
Process = PsGetCurrentProcessByThread (Thread);
Peb = Process->Peb;
if (Peb->NtGlobalFlag & FLG_DISABLE_STACK_EXTENSION) {
return STATUS_STACK_OVERFLOW;
}
//
// Add execute permission if necessary. We do not need to change anything
// for the old guard page because either it is the first guard page of the
// current thread and it will get correct protection during user mode thread
// initialization (see LdrpInitialize in base\ntdll\ldrinit.c) or it is a
// guard page created by this function during stack growth and in this case
// it gets correct protection. We do not do anything for a wow64 process.
//
#if defined(_WIN64)
if (Teb32 == NULL) {
#endif
ExecuteFlags = Peb->ExecuteOptions;
if (ExecuteFlags & (MEM_EXECUTE_OPTION_STACK | MEM_EXECUTE_OPTION_DATA)) {
if (ExecuteFlags & MEM_EXECUTE_OPTION_STACK) {
StackProtection = PAGE_EXECUTE_READWRITE;
ProtectionFlags = PAGE_EXECUTE_READWRITE | PAGE_GUARD;
}
else {
//
// The stack must be made non-executable. The
// ZwAllocateVirtualMemory call below will make it executable
// because this process is marked as wanting executable data
// and ZwAllocate cannot tell this is really a stack
// allocation.
//
ASSERT (ExecuteFlags & MEM_EXECUTE_OPTION_DATA);
RevertExecuteFlag = TRUE;
}
}
#if defined(_WIN64)
}
#endif
//
// This address is within the current stack, check to see
// if there is ample room for another guard page and
// if so attempt to commit a new guard page.
//
#if EMULATE_USERMODE_STACK_4K
if (Teb32 != NULL)
{
NextPage = ((ULONG_PTR)PAGE_4K_ALIGN(FaultingAddress) - PAGE_4K);
DeallocationStack = PAGE_4K_ALIGN(DeallocationStack);
PageSize = RegionSize = PAGE_4K;
//
// Don't set the 'G' bit on the native PTE. Let's just set
// 'G' bit on the AltPte.
//
ProtectionFlags &= ~PAGE_GUARD;
}
else
#endif
{
NextPage = ((ULONG_PTR)PAGE_ALIGN(FaultingAddress) - PAGE_SIZE);
DeallocationStack = PAGE_ALIGN(DeallocationStack);
PageSize = RegionSize = PAGE_SIZE;
}
if ((NextPage - PageSize) <= (ULONG_PTR)DeallocationStack) {
//
// There is no more room for expansion, attempt to
// commit the page before the last page of the
// stack.
//
NextPage = (ULONG_PTR)DeallocationStack + PageSize;
status = ZwAllocateVirtualMemory (NtCurrentProcess(),
(PVOID *)&NextPage,
0,
&RegionSize,
MEM_COMMIT,
StackProtection);
if (NT_SUCCESS(status)) {
#if defined(_WIN64)
if (Teb32) {
// update the 32-bit stacklimit
*(ULONG *)StackLimit = PtrToUlong((PUCHAR)NextPage);
}
else {
*StackLimit = (PVOID)( (PUCHAR)NextPage);
}
#else
*StackLimit = (PVOID)( (PUCHAR)NextPage);
#endif
//
// Revert the EXECUTE bit with an extra protect() call
// if we get it by default but it is not desired.
//
if (RevertExecuteFlag) {
status = ZwProtectVirtualMemory (NtCurrentProcess(),
(PVOID *)&NextPage,
&RegionSize,
StackProtection,
&OldProtection);
ASSERT (StackProtection & PAGE_READWRITE);
}
}
return STATUS_STACK_OVERFLOW;
}
#if defined(_WIN64)
if (Teb32 != NULL) {
//
// Update the 32-bit stack limit.
//
*(ULONG *)StackLimit = PtrToUlong((PUCHAR)(NextPage + PageSize));
}
else {
*StackLimit = (PVOID)((PUCHAR)(NextPage + PAGE_SIZE));
}
#else
*StackLimit = (PVOID)((PUCHAR)(NextPage + PAGE_SIZE));
#endif
#if defined(_IA64_)
}
#endif // _IA64_
//
// Set the guard page. For wow64 processes the protection
// will not contain the PAGE_GUARD bit. This is ok since in these
// cases we will set the bit for the top emulated 4K page.
//
status = ZwAllocateVirtualMemory (NtCurrentProcess(),
(PVOID *)&NextPage,
0,
&RegionSize,
MEM_COMMIT,
ProtectionFlags);
if (NT_SUCCESS(status) || (status == STATUS_ALREADY_COMMITTED)) {
//
// Revert the EXECUTE bit with an extra protect() call
// if we get it by default but it is not desired.
//
if (RevertExecuteFlag) {
if (ProtectionFlags & PAGE_GUARD) {
ProtectionFlags = PAGE_READWRITE | PAGE_GUARD;
}
else {
ProtectionFlags = PAGE_READWRITE;
}
status = ZwProtectVirtualMemory (NtCurrentProcess(),
(PVOID *)&NextPage,
&RegionSize,
ProtectionFlags,
&OldProtection);
}
#if EMULATE_USERMODE_STACK_4K
if (Teb32 != NULL) {
LOCK_ADDRESS_SPACE (Process);
MiProtectFor4kPage ((PVOID)NextPage,
RegionSize,
(MM_READWRITE | MM_GUARD_PAGE),
ALT_CHANGE,
Process);
UNLOCK_ADDRESS_SPACE (Process);
}
#endif
//
// The guard page is now committed or stack space is
// already present, return success.
//
return STATUS_PAGE_FAULT_GUARD_PAGE;
}
return STATUS_STACK_OVERFLOW;
} except (EXCEPTION_EXECUTE_HANDLER) {
//
// An exception has occurred during the referencing of the
// TEB or TIB, just return a guard page violation and
// don't deal with the stack overflow.
//
return STATUS_GUARD_PAGE_VIOLATION;
}
}
Reference in a new issue Copy permalink