From 8403189f6cac8bb0239ec19ef5b38de8d7f525e2 Mon Sep 17 00:00:00 2001 From: Thomas Faber Date: Tue, 2 May 2017 11:11:39 +0000 Subject: [PATCH] [NTOS:MM] - When mapping a view of the physical memory section, don't check for BaseAddress/SectionOffset alignment. Instead, prevent user mode mappings of views beyond the highest physical page. Fixes flakiness in kmtest:MmSection CORE-13113 #resolve svn path=/trunk/; revision=74447 --- reactos/ntoskrnl/mm/ARM3/section.c | 30 +++++++++++++++++++++--------- 1 file changed, 21 insertions(+), 9 deletions(-) diff --git a/reactos/ntoskrnl/mm/ARM3/section.c b/reactos/ntoskrnl/mm/ARM3/section.c index 30abd7e9301..a71dcd72960 100644 --- a/reactos/ntoskrnl/mm/ARM3/section.c +++ b/reactos/ntoskrnl/mm/ARM3/section.c @@ -3689,24 +3689,36 @@ NtMapViewOfSection(IN HANDLE SectionHandle, return Status; } - if (!(AllocationType & MEM_DOS_LIM)) + if (MiIsRosSectionObject(Section) && + (Section->AllocationAttributes & SEC_PHYSICALMEMORY)) + { + if (PreviousMode == UserMode && + SafeSectionOffset.QuadPart + SafeViewSize > MmHighestPhysicalPage << PAGE_SHIFT) + { + DPRINT1("Denying map past highest physical page.\n"); + ObDereferenceObject(Section); + ObDereferenceObject(Process); + return STATUS_INVALID_PARAMETER_6; + } + } + else if (!(AllocationType & MEM_DOS_LIM)) { /* Check for non-allocation-granularity-aligned BaseAddress */ if (SafeBaseAddress != ALIGN_DOWN_POINTER_BY(SafeBaseAddress, MM_VIRTMEM_GRANULARITY)) { - DPRINT("BaseAddress is not at 64-kilobyte address boundary."); - ObDereferenceObject(Section); - ObDereferenceObject(Process); - return STATUS_MAPPED_ALIGNMENT; + DPRINT("BaseAddress is not at 64-kilobyte address boundary.\n"); + ObDereferenceObject(Section); + ObDereferenceObject(Process); + return STATUS_MAPPED_ALIGNMENT; } /* Do the same for the section offset */ if (SafeSectionOffset.LowPart != ALIGN_DOWN_BY(SafeSectionOffset.LowPart, MM_VIRTMEM_GRANULARITY)) { - DPRINT("SectionOffset is not at 64-kilobyte address boundary."); - ObDereferenceObject(Section); - ObDereferenceObject(Process); - return STATUS_MAPPED_ALIGNMENT; + DPRINT("SectionOffset is not at 64-kilobyte address boundary.\n"); + ObDereferenceObject(Section); + ObDereferenceObject(Process); + return STATUS_MAPPED_ALIGNMENT; } }