https://git.reactos.org/?p=reactos.git;a=commitdiff;h=a8b57f0a6ba6061ce810290b7d8e64ac5b73e7f3
commit a8b57f0a6ba6061ce810290b7d8e64ac5b73e7f3
Author: Timo Kreuzer <timo.kreu...@reactos.org>
AuthorDate: Mon Oct 9 22:01:56 2023 +0300
Commit: Timo Kreuzer <timo.kreu...@reactos.org>
CommitDate: Tue Oct 24 21:45:27 2023 +0300
[NTOS:MM] Fix address space locking in MiProtectVirtualMemory
---
ntoskrnl/mm/ARM3/virtual.c | 24 ++++++++++++++----------
1 file changed, 14 insertions(+), 10 deletions(-)
diff --git a/ntoskrnl/mm/ARM3/virtual.c b/ntoskrnl/mm/ARM3/virtual.c
index e0804520435..ec081c8110d 100644
--- a/ntoskrnl/mm/ARM3/virtual.c
+++ b/ntoskrnl/mm/ARM3/virtual.c
@@ -2213,6 +2213,9 @@ MiProtectVirtualMemory(IN PEPROCESS Process,
PETHREAD Thread = PsGetCurrentThread();
TABLE_SEARCH_RESULT Result;
+ /* We must be attached */
+ ASSERT(Process == PsGetCurrentProcess());
+
/* Calculate base address for the VAD */
StartingAddress = (ULONG_PTR)PAGE_ALIGN((*BaseAddress));
EndingAddress = (((ULONG_PTR)*BaseAddress + *NumberOfBytesToProtect - 1) |
(PAGE_SIZE - 1));
@@ -2225,11 +2228,22 @@ MiProtectVirtualMemory(IN PEPROCESS Process,
return STATUS_INVALID_PAGE_PROTECTION;
}
+ /* Lock the address space and make sure the process isn't already dead */
+ AddressSpace = MmGetCurrentAddressSpace();
+ MmLockAddressSpace(AddressSpace);
+ if (Process->VmDeleted)
+ {
+ DPRINT1("Process is dying\n");
+ Status = STATUS_PROCESS_IS_TERMINATING;
+ goto FailPath;
+ }
+
/* Check for ROS specific memory area */
MemoryArea = MmLocateMemoryAreaByAddress(&Process->Vm, *BaseAddress);
if ((MemoryArea) && (MemoryArea->Type != MEMORY_AREA_OWNED_BY_ARM3))
{
/* Evil hack */
+ MmUnlockAddressSpace(AddressSpace);
return MiRosProtectVirtualMemory(Process,
BaseAddress,
NumberOfBytesToProtect,
@@ -2237,16 +2251,6 @@ MiProtectVirtualMemory(IN PEPROCESS Process,
OldAccessProtection);
}
- /* Lock the address space and make sure the process isn't already dead */
- AddressSpace = MmGetCurrentAddressSpace();
- MmLockAddressSpace(AddressSpace);
- if (Process->VmDeleted)
- {
- DPRINT1("Process is dying\n");
- Status = STATUS_PROCESS_IS_TERMINATING;
- goto FailPath;
- }
-
/* Get the VAD for this address range, and make sure it exists */
Result = MiCheckForConflictingNode(StartingAddress >> PAGE_SHIFT,
EndingAddress >> PAGE_SHIFT,
