From df25e4e79109a785b4be4971081af11573e44259 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Gardou?= Date: Fri, 2 Nov 2018 18:23:16 +0100 Subject: [PATCH] [NTOS/MM] Properly handle page faults in regions marked with PAGE_NOACCESS or PAGE_GUARD ROSTESTS-110 --- ntoskrnl/mm/section.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/ntoskrnl/mm/section.c b/ntoskrnl/mm/section.c index 4a03514f004..298fc5f0f96 100644 --- a/ntoskrnl/mm/section.c +++ b/ntoskrnl/mm/section.c @@ -1410,6 +1410,29 @@ MmNotPresentFaultSectionView(PMMSUPPORT AddressSpace, &MemoryArea->Data.SectionData.RegionListHead, Address, NULL); ASSERT(Region != NULL); + + /* Check for a NOACCESS mapping */ + if (Region->Protect & PAGE_NOACCESS) + { + return STATUS_ACCESS_VIOLATION; + } + + if (Region->Protect & PAGE_GUARD) + { + /* Remove it */ + Status = MmAlterRegion(AddressSpace, (PVOID)MA_GetStartingAddress(MemoryArea), + &MemoryArea->Data.SectionData.RegionListHead, + Address, PAGE_SIZE, Region->Type, Region->Protect & ~PAGE_GUARD, + MmAlterViewAttributes); + + if (!NT_SUCCESS(Status)) + { + DPRINT1("Removing PAGE_GUARD protection failed : 0x%08x.\n", Status); + } + + return STATUS_GUARD_PAGE_VIOLATION; + } + /* * Lock the segment */