From 073dea747446ae94c1d2eea452283a6d0f2c6d72 Mon Sep 17 00:00:00 2001 From: Alex Ionescu Date: Sun, 2 Sep 2012 18:54:05 +0000 Subject: [PATCH] [NTOSKRNL]: Implement MiCheckSecuredVad and stop whining about not supporting SEC_NO_CHANGE, cleaning up the log. [NTOSKRNL]: Kill a bunch of now-useless DPRINT1s in Mm, significantly cleaning up the log. [HIVES/MSI]: .NET needs InstallRoot, not InstallDir. Kills millions of DPRINT1s, thus cleaning up the log. svn path=/trunk/; revision=57221 --- reactos/boot/bootdata/hivesft_amd64.inf | 2 +- reactos/boot/bootdata/hivesft_arm.inf | 2 +- reactos/boot/bootdata/hivesft_i386.inf | Bin 291896 -> 291898 bytes reactos/ntoskrnl/mm/ARM3/miarm.h | 16 +++++ reactos/ntoskrnl/mm/ARM3/pagfault.c | 2 +- reactos/ntoskrnl/mm/ARM3/pfnlist.c | 4 +- reactos/ntoskrnl/mm/ARM3/section.c | 13 +++- reactos/ntoskrnl/mm/ARM3/vadnode.c | 86 ++++++++++++++++++++++++ reactos/ntoskrnl/mm/ARM3/virtual.c | 16 ++++- 9 files changed, 133 insertions(+), 8 deletions(-) diff --git a/reactos/boot/bootdata/hivesft_amd64.inf b/reactos/boot/bootdata/hivesft_amd64.inf index 55afed80e6a..7f856e66fe4 100644 --- a/reactos/boot/bootdata/hivesft_amd64.inf +++ b/reactos/boot/bootdata/hivesft_amd64.inf @@ -30,7 +30,7 @@ HKLM,"SOFTWARE\Microsoft\Rpc\SecurityService","68",2,"netlogon.dll" HKLM,"SOFTWARE\Microsoft\Rpc\SecurityService","9",2,"secur32.dll" ; .NET -HKLM,"SOFTWARE\Microsoft\.NETFramework\","InstallDir",0x00020000,"%SystemRoot%\Microsoft .NET\Framework\" +HKLM,"SOFTWARE\Microsoft\.NETFramework\","InstallRoot",0x00020000,"%SystemRoot%\Microsoft .NET\Framework\" HKLM,"SOFTWARE\Microsoft\Secure",,0x00000012 diff --git a/reactos/boot/bootdata/hivesft_arm.inf b/reactos/boot/bootdata/hivesft_arm.inf index 3a6f4457310..f3df23af99b 100644 --- a/reactos/boot/bootdata/hivesft_arm.inf +++ b/reactos/boot/bootdata/hivesft_arm.inf @@ -19,7 +19,7 @@ HKLM,Software\Microsoft\Rpc\SecurityService,68,2,"netlogon.dll" HKLM,Software\Microsoft\Rpc\SecurityService,9,2,"secur32.dll" ; .NET -HKLM,"SOFTWARE\Microsoft\.NETFramework\","InstallDir",0x00020000,"%SystemRoot%\Microsoft .NET\Framework\" +HKLM,"SOFTWARE\Microsoft\.NETFramework\","InstallRoot",0x00020000,"%SystemRoot%\Microsoft .NET\Framework\" ; HTML Help HKLM,SOFTWARE\Microsoft\Active Setup\Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9},,2,"HTML Help" diff --git a/reactos/boot/bootdata/hivesft_i386.inf b/reactos/boot/bootdata/hivesft_i386.inf index 0d82fdd5ec5c914c0542e1f6a563ac825e9f7e1c..dd07232e483b164c5f66e764dacb0aa6d683aad8 100644 GIT binary patch delta 42 vcmdn-LU7j$!3`&5Cp(yNOfJ$loBYCDs98*|T}+MW^@gX delta 44 xcmdn>LU6|m!3`&5SzQ=18Hy$=DwdLXJf#3;<}T4Nm|7 diff --git a/reactos/ntoskrnl/mm/ARM3/miarm.h b/reactos/ntoskrnl/mm/ARM3/miarm.h index bef223cb624..a5cf5cbc246 100644 --- a/reactos/ntoskrnl/mm/ARM3/miarm.h +++ b/reactos/ntoskrnl/mm/ARM3/miarm.h @@ -307,6 +307,13 @@ extern const ULONG MmProtectToValue[32]; #define MI_SESSION_DATA_PAGES_MAXIMUM (MM_ALLOCATION_GRANULARITY / PAGE_SIZE) #define MI_SESSION_TAG_PAGES_MAXIMUM (MM_ALLOCATION_GRANULARITY / PAGE_SIZE) +// +// Used by MiCheckSecuredVad +// +#define MM_READ_WRITE_ALLOWED 11 +#define MM_READ_ONLY_ALLOWED 10 +#define MM_NO_ACCESS_ALLOWED 01 +#define MM_DELETE_CHECK 85 // // System views are binned into 64K chunks @@ -1867,6 +1874,15 @@ MiFindEmptyAddressRangeInTree( OUT PULONG_PTR Base ); +NTSTATUS +NTAPI +MiCheckSecuredVad( + IN PMMVAD Vad, + IN PVOID Base, + IN SIZE_T Size, + IN ULONG ProtectionMask +); + VOID NTAPI MiInsertVad( diff --git a/reactos/ntoskrnl/mm/ARM3/pagfault.c b/reactos/ntoskrnl/mm/ARM3/pagfault.c index 66f4557cf62..e13c0852500 100644 --- a/reactos/ntoskrnl/mm/ARM3/pagfault.c +++ b/reactos/ntoskrnl/mm/ARM3/pagfault.c @@ -982,7 +982,7 @@ MiDispatchFault(IN BOOLEAN StoreInstruction, { /* This is a standby page, bring it back from the cache */ PageFrameIndex = TempPte.u.Trans.PageFrameNumber; - DPRINT1("oooh, shiny, a soft fault! 0x%lx\n", PageFrameIndex); + DPRINT("oooh, shiny, a soft fault! 0x%lx\n", PageFrameIndex); Pfn1 = MI_PFN_ELEMENT(PageFrameIndex); ASSERT(Pfn1->u3.e1.PageLocation != ActiveAndValid); diff --git a/reactos/ntoskrnl/mm/ARM3/pfnlist.c b/reactos/ntoskrnl/mm/ARM3/pfnlist.c index 317f883f445..8c6b203e459 100644 --- a/reactos/ntoskrnl/mm/ARM3/pfnlist.c +++ b/reactos/ntoskrnl/mm/ARM3/pfnlist.c @@ -850,7 +850,7 @@ MiInsertPageInList(IN PMMPFNLIST ListHead, if (ListHead == &MmModifiedPageListHead) { /* For now, only single-prototype pages should end up in this path */ - DPRINT1("Modified page being added: %lx\n", PageFrameIndex); + DPRINT("Modified page being added: %lx\n", PageFrameIndex); ASSERT(Pfn1->OriginalPte.u.Soft.Prototype == 0); /* Modified pages are colored when they are selected for page file */ @@ -1259,7 +1259,7 @@ MiDecrementShareCount(IN PMMPFN Pfn1, TempPte.u.Soft.Prototype = 0; TempPte.u.Soft.Protection = Pfn1->OriginalPte.u.Soft.Protection; MI_WRITE_INVALID_PTE(PointerPte, TempPte); - DPRINT1("Marking PTE: %p as transition (%p - %lx)\n", PointerPte, Pfn1, MiGetPfnEntryIndex(Pfn1)); + DPRINT("Marking PTE: %p as transition (%p - %lx)\n", PointerPte, Pfn1, MiGetPfnEntryIndex(Pfn1)); } /* Put the page in transition */ diff --git a/reactos/ntoskrnl/mm/ARM3/section.c b/reactos/ntoskrnl/mm/ARM3/section.c index c3e98547f13..aba6ad9dec9 100644 --- a/reactos/ntoskrnl/mm/ARM3/section.c +++ b/reactos/ntoskrnl/mm/ARM3/section.c @@ -771,7 +771,18 @@ MiUnmapViewOfSection(IN PEPROCESS Process, /* For SEC_NO_CHANGE sections, we need some extra checks */ if (Vad->u.VadFlags.NoChange == 1) { - DPRINT1("Unmapping SEC_NO_CHANGE. Should validate if allowed!\n"); + /* Are we allowed to mess with this VAD? */ + Status = MiCheckSecuredVad(Vad, + (PVOID)(Vad->StartingVpn >> PAGE_SHIFT), + RegionSize, + MM_DELETE_CHECK); + if (!NT_SUCCESS(Status)) + { + /* We failed */ + DPRINT1("Trying to unmap protected VAD!\n"); + if (!Flags) MmUnlockAddressSpace(&Process->Vm); + goto Quickie; + } } /* Not currently supported */ diff --git a/reactos/ntoskrnl/mm/ARM3/vadnode.c b/reactos/ntoskrnl/mm/ARM3/vadnode.c index 7f21b34a68e..6b8cdda86a6 100644 --- a/reactos/ntoskrnl/mm/ARM3/vadnode.c +++ b/reactos/ntoskrnl/mm/ARM3/vadnode.c @@ -20,6 +20,27 @@ #include "../ARM3/miavl.h" #include "../../../lib/rtl/avlsupp.c" +/* GLOBALS ********************************************************************/ + +CHAR MmReadWrite[32] = +{ + MM_NO_ACCESS_ALLOWED, MM_READ_ONLY_ALLOWED, MM_READ_ONLY_ALLOWED, + MM_READ_ONLY_ALLOWED, MM_READ_WRITE_ALLOWED, MM_READ_WRITE_ALLOWED, + MM_READ_WRITE_ALLOWED, MM_READ_WRITE_ALLOWED, + + MM_NO_ACCESS_ALLOWED, MM_READ_ONLY_ALLOWED, MM_READ_ONLY_ALLOWED, + MM_READ_ONLY_ALLOWED, MM_READ_WRITE_ALLOWED, MM_READ_WRITE_ALLOWED, + MM_READ_WRITE_ALLOWED, MM_READ_WRITE_ALLOWED, + + MM_NO_ACCESS_ALLOWED, MM_READ_ONLY_ALLOWED, MM_READ_ONLY_ALLOWED, + MM_READ_ONLY_ALLOWED, MM_READ_WRITE_ALLOWED, MM_READ_WRITE_ALLOWED, + MM_READ_WRITE_ALLOWED, MM_READ_WRITE_ALLOWED, + + MM_NO_ACCESS_ALLOWED, MM_READ_ONLY_ALLOWED, MM_READ_ONLY_ALLOWED, + MM_READ_ONLY_ALLOWED, MM_READ_WRITE_ALLOWED, MM_READ_WRITE_ALLOWED, + MM_READ_WRITE_ALLOWED, MM_READ_WRITE_ALLOWED, +}; + /* FUNCTIONS ******************************************************************/ PMMVAD @@ -583,4 +604,69 @@ MiFindEmptyAddressRangeDownBasedTree(IN SIZE_T Length, return STATUS_NO_MEMORY; } +NTSTATUS +NTAPI +MiCheckSecuredVad(IN PMMVAD Vad, + IN PVOID Base, + IN SIZE_T Size, + IN ULONG ProtectionMask) +{ + ULONG_PTR StartAddress, EndAddress; + + /* Compute start and end address */ + StartAddress = (ULONG_PTR)Base; + EndAddress = StartAddress + Size - 1; + + /* Are we deleting/unmapping, or changing? */ + if (ProtectionMask < MM_DELETE_CHECK) + { + /* Changing... are we allowed to do so? */ + if ((Vad->u.VadFlags.NoChange == 1) && + (Vad->u2.VadFlags2.SecNoChange == 1) && + (Vad->u.VadFlags.Protection != ProtectionMask)) + { + /* Nope, bail out */ + DPRINT1("Trying to mess with a no-change VAD!\n"); + return STATUS_INVALID_PAGE_PROTECTION; + } + } + else + { + /* This is allowed */ + ProtectionMask = 0; + } + + /* ARM3 doesn't support this yet */ + ASSERT(Vad->u2.VadFlags2.MultipleSecured == 0); + + /* Is this a one-secured VAD, like a TEB or PEB? */ + if (Vad->u2.VadFlags2.OneSecured) + { + /* Is this allocation being described by the VAD? */ + if ((StartAddress <= ((PMMVAD_LONG)Vad)->u3.Secured.EndVpn) && + (EndAddress >= ((PMMVAD_LONG)Vad)->u3.Secured.StartVpn)) + { + /* Guard page? */ + if (ProtectionMask && MM_DECOMMIT) + { + DPRINT1("Not allowed to change protection on guard page!\n"); + return STATUS_INVALID_PAGE_PROTECTION; + } + + /* ARM3 doesn't have read-only VADs yet */ + ASSERT(Vad->u2.VadFlags2.ReadOnly == 0); + + /* Check if read-write protections are allowed */ + if (MmReadWrite[ProtectionMask] < MM_READ_WRITE_ALLOWED) + { + DPRINT1("Invalid protection mask for RW access!\n"); + return STATUS_INVALID_PAGE_PROTECTION; + } + } + } + + /* All good, allow the change */ + return STATUS_SUCCESS; +} + /* EOF */ diff --git a/reactos/ntoskrnl/mm/ARM3/virtual.c b/reactos/ntoskrnl/mm/ARM3/virtual.c index 33bd590ee07..cd18acbb1a0 100644 --- a/reactos/ntoskrnl/mm/ARM3/virtual.c +++ b/reactos/ntoskrnl/mm/ARM3/virtual.c @@ -4132,11 +4132,23 @@ NtAllocateVirtualMemory(IN HANDLE ProcessHandle, } // - // We should make sure that the section's permissions aren't being messed with + // We should make sure that the section's permissions aren't being + // messed with // if (FoundVad->u.VadFlags.NoChange) { - DPRINT1("SEC_NO_CHANGE section being touched. Assuming this is ok\n"); + // + // Make sure it's okay to touch it + // + Status = MiCheckSecuredVad(FoundVad, + PBaseAddress, + PRegionSize, + ProtectionMask); + if (!NT_SUCCESS(Status)) + { + DPRINT1("Secured VAD being messed around with\n"); + goto FailPath; + } } //