added more irql checks

svn path=/trunk/; revision=13714
This commit is contained in:
Thomas Bluemel
2005-02-22 19:25:17 +00:00
parent fee36b29eb
commit f871df2c56
12 changed files with 115 additions and 16 deletions
+1 -1
View File
@@ -116,7 +116,7 @@ ExReleaseRundownProtectionEx (
if (Current & EX_RUNDOWN_ACTIVE)
{
/* Get Pointer */
PRUNDOWN_DESCRIPTOR RundownDescriptor = (PRUNDOWN_DESCRIPTOR)((ULONG_PTR)RunRef->Ptr & ~EX_RUNDOWN_ACTIVE);
PRUNDOWN_DESCRIPTOR RundownDescriptor = (PRUNDOWN_DESCRIPTOR)(Current & ~EX_RUNDOWN_ACTIVE);
if (RundownDescriptor == NULL)
{
+8
View File
@@ -184,6 +184,8 @@ NtImpersonateThread(IN HANDLE ThreadHandle,
KPROCESSOR_MODE PreviousMode;
NTSTATUS Status = STATUS_SUCCESS;
PAGED_CODE();
PreviousMode = ExGetPreviousMode();
if(PreviousMode != KernelMode)
@@ -499,6 +501,8 @@ PsCreateTeb(HANDLE ProcessHandle,
ULONG TebSize;
PVOID TebBase;
TEB Teb;
PAGED_CODE();
TebSize = PAGE_SIZE;
@@ -672,6 +676,8 @@ NtCreateThread(OUT PHANDLE ThreadHandle,
KPROCESSOR_MODE PreviousMode;
NTSTATUS Status = STATUS_SUCCESS;
PAGED_CODE();
if(ThreadContext == NULL)
{
return STATUS_INVALID_PARAMETER;
@@ -852,6 +858,8 @@ PsCreateSystemThread(PHANDLE ThreadHandle,
NTSTATUS Status;
KIRQL oldIrql;
PAGED_CODE();
DPRINT("PsCreateSystemThread(ThreadHandle %x, ProcessHandle %x)\n",
ThreadHandle,ProcessHandle);
+4
View File
@@ -192,6 +192,8 @@ NtGetContextThread(IN HANDLE ThreadHandle,
KPROCESSOR_MODE PreviousMode;
NTSTATUS Status = STATUS_SUCCESS;
PAGED_CODE();
PreviousMode = ExGetPreviousMode();
if(PreviousMode != KernelMode)
@@ -316,6 +318,8 @@ NtSetContextThread(IN HANDLE ThreadHandle,
KPROCESSOR_MODE PreviousMode;
NTSTATUS Status = STATUS_SUCCESS;
PAGED_CODE();
PreviousMode = ExGetPreviousMode();
if(PreviousMode != KernelMode)
+10
View File
@@ -113,6 +113,8 @@ NtAssignProcessToJobObject(HANDLE JobHandle,
KPROCESSOR_MODE PreviousMode;
NTSTATUS Status;
PAGED_CODE();
PreviousMode = ExGetPreviousMode();
/* make sure we're having a handle with enough rights, especially the to
@@ -200,6 +202,8 @@ NtCreateJobObject(PHANDLE JobHandle,
KPROCESSOR_MODE PreviousMode;
PEPROCESS CurrentProcess;
NTSTATUS Status = STATUS_SUCCESS;
PAGED_CODE();
PreviousMode = ExGetPreviousMode();
CurrentProcess = PsGetCurrentProcess();
@@ -305,6 +309,8 @@ NtIsProcessInJob(IN HANDLE ProcessHandle,
PreviousMode = ExGetPreviousMode();
PAGED_CODE();
Status = ObReferenceObjectByHandle(ProcessHandle,
PROCESS_QUERY_INFORMATION,
PsProcessType,
@@ -367,6 +373,8 @@ NtOpenJobObject(PHANDLE JobHandle,
KPROCESSOR_MODE PreviousMode;
HANDLE hJob;
NTSTATUS Status = STATUS_SUCCESS;
PAGED_CODE();
PreviousMode = ExGetPreviousMode();
@@ -462,6 +470,8 @@ NtTerminateJobObject(HANDLE JobHandle,
PEJOB Job;
NTSTATUS Status;
PAGED_CODE();
PreviousMode = ExGetPreviousMode();
Status = ObReferenceObjectByHandle(JobHandle,
+8
View File
@@ -337,6 +337,8 @@ NtTerminateProcess(IN HANDLE ProcessHandle OPTIONAL,
NTSTATUS Status;
PEPROCESS Process;
PAGED_CODE();
DPRINT("NtTerminateProcess(ProcessHandle %x, ExitStatus %x)\n",
ProcessHandle, ExitStatus);
@@ -373,6 +375,8 @@ NtTerminateThread(IN HANDLE ThreadHandle,
PETHREAD Thread;
NTSTATUS Status;
PAGED_CODE();
Status = ObReferenceObjectByHandle(ThreadHandle,
THREAD_TERMINATE,
PsThreadType,
@@ -425,6 +429,8 @@ NtCallTerminatePorts(PETHREAD Thread)
PLIST_ENTRY current_entry;
PEPORT_TERMINATION_REQUEST current;
PAGED_CODE();
KeAcquireSpinLock(&Thread->ActiveTimerListLock, &oldIrql);
while ((current_entry = RemoveHeadList(&Thread->TerminationPortList)) !=
&Thread->TerminationPortList);
@@ -451,6 +457,8 @@ NtRegisterThreadTerminatePort(HANDLE PortHandle)
KIRQL oldIrql;
PETHREAD Thread;
PAGED_CODE();
Status = ObReferenceObjectByHandle(PortHandle,
PORT_ALL_ACCESS,
LpcPortObjectType,
+10
View File
@@ -207,6 +207,8 @@ NTSTATUS STDCALL
NtQueryDefaultLocale(IN BOOLEAN UserProfile,
OUT PLCID DefaultLocaleId)
{
PAGED_CODE();
if (DefaultLocaleId == NULL)
return STATUS_UNSUCCESSFUL;
@@ -252,6 +254,8 @@ NtSetDefaultLocale(IN BOOLEAN UserProfile,
WCHAR ValueBuffer[20];
HANDLE UserKey = NULL;
NTSTATUS Status;
PAGED_CODE();
if (UserProfile)
{
@@ -358,6 +362,8 @@ NtQueryDefaultUILanguage(OUT PLANGID LanguageId)
HANDLE UserKey;
HANDLE KeyHandle;
NTSTATUS Status;
PAGED_CODE();
Status = RtlOpenCurrentUser(KEY_READ,
&UserKey);
@@ -431,6 +437,8 @@ NtQueryDefaultUILanguage(OUT PLANGID LanguageId)
NTSTATUS STDCALL
NtQueryInstallUILanguage(OUT PLANGID LanguageId)
{
PAGED_CODE();
*LanguageId = PsInstallUILanguageId;
return STATUS_SUCCESS;
@@ -451,6 +459,8 @@ NtSetDefaultUILanguage(IN LANGID LanguageId)
HANDLE UserHandle;
HANDLE KeyHandle;
NTSTATUS Status;
PAGED_CODE();
Status = RtlOpenCurrentUser(KEY_WRITE,
&UserHandle);
+16 -1
View File
@@ -192,6 +192,8 @@ NtOpenProcessTokenEx(
KPROCESSOR_MODE PreviousMode;
NTSTATUS Status = STATUS_SUCCESS;
PAGED_CODE();
PreviousMode = ExGetPreviousMode();
if(PreviousMode == UserMode)
@@ -505,6 +507,8 @@ PsCreatePeb(HANDLE ProcessHandle,
ULONG ViewSize;
PVOID TableBase;
NTSTATUS Status;
PAGED_CODE();
/* Allocate the Process Environment Block (PEB) */
Process->TebBlock = (PVOID) MM_ROUND_DOWN(PEB_BASE, MM_VIRTMEM_GRANULARITY);
@@ -1163,6 +1167,8 @@ NtCreateProcess(OUT PHANDLE ProcessHandle,
{
KPROCESSOR_MODE PreviousMode;
NTSTATUS Status = STATUS_SUCCESS;
PAGED_CODE();
PreviousMode = ExGetPreviousMode();
@@ -1219,7 +1225,8 @@ NtOpenProcess(OUT PHANDLE ProcessHandle,
"ObjectAttributes %x, ClientId %x { UniP %d, UniT %d })\n",
ProcessHandle, DesiredAccess, ObjectAttributes, ClientId,
ClientId->UniqueProcess, ClientId->UniqueThread);
PAGED_CODE();
/*
* Not sure of the exact semantics
@@ -1315,6 +1322,8 @@ NtQueryInformationProcess(IN HANDLE ProcessHandle,
KPROCESSOR_MODE PreviousMode;
NTSTATUS Status = STATUS_SUCCESS;
PAGED_CODE();
PreviousMode = ExGetPreviousMode();
DefaultQueryInfoBufferCheck(ProcessInformationClass,
@@ -1787,6 +1796,8 @@ NtSetInformationProcess(IN HANDLE ProcessHandle,
ACCESS_MASK Access;
NTSTATUS Status = STATUS_SUCCESS;
PAGED_CODE();
PreviousMode = ExGetPreviousMode();
DefaultSetInfoBufferCheck(ProcessInformationClass,
@@ -2889,6 +2900,8 @@ PsLockProcess(PEPROCESS Process, BOOL Timeout)
PLARGE_INTEGER Delay = (Timeout ? &PsLockTimeout : NULL);
PKTHREAD CallingThread = KeGetCurrentThread();
PAGED_CODE();
KeEnterCriticalRegion();
for(;;)
@@ -2946,6 +2959,8 @@ PsLockProcess(PEPROCESS Process, BOOL Timeout)
VOID
PsUnlockProcess(PEPROCESS Process)
{
PAGED_CODE();
ASSERT(Process->LockOwner == KeGetCurrentThread());
if(InterlockedDecrementUL(&Process->LockCount) == 0)
+4
View File
@@ -131,6 +131,8 @@ NtResumeThread(IN HANDLE ThreadHandle,
PETHREAD Thread;
NTSTATUS Status;
ULONG Count;
PAGED_CODE();
DPRINT("NtResumeThead(ThreadHandle %lx SuspendCount %p)\n",
ThreadHandle, SuspendCount);
@@ -184,6 +186,8 @@ NtSuspendThread(IN HANDLE ThreadHandle,
PETHREAD Thread;
NTSTATUS Status;
ULONG Count;
PAGED_CODE();
Status = ObReferenceObjectByHandle(ThreadHandle,
THREAD_SUSPEND_RESUME,
+2
View File
@@ -992,6 +992,8 @@ NtOpenThread(OUT PHANDLE ThreadHandle,
IN PCLIENT_ID ClientId)
{
NTSTATUS Status = STATUS_INVALID_PARAMETER;
PAGED_CODE();
if((NULL != ThreadHandle)&&(NULL != ObjectAttributes))
{
+18 -14
View File
@@ -98,6 +98,8 @@ NtSetInformationThread (IN HANDLE ThreadHandle,
HANDLE Handle;
PVOID Address;
}u;
PAGED_CODE();
if (ThreadInformationClass <= MaxThreadInfoClass &&
!SetInformationData[ThreadInformationClass].Implemented)
@@ -206,21 +208,23 @@ NtQueryInformationThread (IN HANDLE ThreadHandle,
LARGE_INTEGER Count;
BOOLEAN Last;
}u;
PAGED_CODE();
if (ThreadInformationClass <= MaxThreadInfoClass &&
!QueryInformationData[ThreadInformationClass].Implemented)
{
return STATUS_NOT_IMPLEMENTED;
}
if (ThreadInformationClass > MaxThreadInfoClass ||
QueryInformationData[ThreadInformationClass].Size == 0)
{
return STATUS_INVALID_INFO_CLASS;
}
if (ThreadInformationLength != QueryInformationData[ThreadInformationClass].Size)
{
return STATUS_INFO_LENGTH_MISMATCH;
}
if (ThreadInformationClass <= MaxThreadInfoClass &&
!QueryInformationData[ThreadInformationClass].Implemented)
{
return STATUS_NOT_IMPLEMENTED;
}
if (ThreadInformationClass > MaxThreadInfoClass ||
QueryInformationData[ThreadInformationClass].Size == 0)
{
return STATUS_INVALID_INFO_CLASS;
}
if (ThreadInformationLength != QueryInformationData[ThreadInformationClass].Size)
{
return STATUS_INFO_LENGTH_MISMATCH;
}
Status = ObReferenceObjectByHandle(ThreadHandle,
THREAD_QUERY_INFORMATION,
+4
View File
@@ -82,6 +82,8 @@ NtCallbackReturn (PVOID Result,
PKTRAP_FRAME SavedTrapFrame;
PVOID SavedCallbackStack;
PVOID SavedExceptionStack;
PAGED_CODE();
Thread = PsGetCurrentThread();
if (Thread->Tcb.CallbackStack == NULL)
@@ -259,6 +261,8 @@ NtW32Call (IN ULONG RoutineIndex,
NTSTATUS CallbackStatus;
NTW32CALL_SAVED_STATE SavedState;
PNTW32CALL_CALLBACK_STACK AssignedStack;
PAGED_CODE();
DPRINT("NtW32Call(RoutineIndex %d, Argument %X, ArgumentLength %d)\n",
RoutineIndex, Argument, ArgumentLength);
+30
View File
@@ -44,6 +44,8 @@ NTSTATUS SeExchangePrimaryToken(PEPROCESS Process,
PTOKEN OldToken;
PTOKEN NewToken = (PTOKEN)NewTokenP;
PAGED_CODE();
if (NewToken->TokenType != TokenPrimary)
{
return(STATUS_UNSUCCESSFUL);
@@ -70,6 +72,8 @@ RtlLengthSidAndAttributes(ULONG Count,
{
ULONG i;
ULONG uLength;
PAGED_CODE();
uLength = Count * sizeof(SID_AND_ATTRIBUTES);
for (i = 0; i < Count; i++)
@@ -306,6 +310,8 @@ SeCopyClientToken(PACCESS_TOKEN Token,
{
NTSTATUS Status;
OBJECT_ATTRIBUTES ObjectAttributes;
PAGED_CODE();
InitializeObjectAttributes(&ObjectAttributes,
NULL,
@@ -340,6 +346,8 @@ SeCreateClientSecurity(IN struct _ETHREAD *Thread,
ULONG g;
PACCESS_TOKEN NewToken;
PAGED_CODE();
Token = PsReferenceEffectiveToken(Thread,
&TokenType,
&b,
@@ -485,6 +493,8 @@ SeImpersonateClient(IN PSECURITY_CLIENT_CONTEXT ClientContext,
{
UCHAR b;
PAGED_CODE();
if (ClientContext->DirectlyAccessClientToken == FALSE)
{
b = ClientContext->SecurityQos.EffectiveOnly;
@@ -569,6 +579,8 @@ NtQueryInformationToken(IN HANDLE TokenHandle,
PTOKEN_GROUPS PtrTokenGroups;
PTOKEN_DEFAULT_DACL PtrDefaultDacl;
PTOKEN_STATISTICS PtrTokenStatistics;
PAGED_CODE();
Status = ObReferenceObjectByHandle(TokenHandle,
(TokenInformationClass == TokenSource) ? TOKEN_QUERY_SOURCE : TOKEN_QUERY,
@@ -906,6 +918,8 @@ NtSetInformationToken(IN HANDLE TokenHandle,
TOKEN_OWNER TokenOwnerSet = { 0 };
TOKEN_PRIMARY_GROUP TokenPrimaryGroupSet = { 0 };
DWORD NeededAccess = 0;
PAGED_CODE();
switch (TokenInformationClass)
{
@@ -1042,6 +1056,8 @@ NtDuplicateToken(IN HANDLE ExistingTokenHandle,
PTOKEN Token;
PTOKEN NewToken;
NTSTATUS Status = STATUS_SUCCESS;
PAGED_CODE();
PreviousMode = KeGetPreviousMode();
@@ -1151,6 +1167,8 @@ NtAdjustGroupsToken(IN HANDLE TokenHandle,
ULONG b;
ULONG c;
PAGED_CODE();
Status = ObReferenceObjectByHandle(TokenHandle,
?,
SepTokenObjectType,
@@ -1256,6 +1274,8 @@ NtAdjustPrivilegesToken (IN HANDLE TokenHandle,
ULONG c;
#endif
NTSTATUS Status;
PAGED_CODE();
DPRINT ("NtAdjustPrivilegesToken() called\n");
@@ -1612,6 +1632,8 @@ NtCreateToken(OUT PHANDLE TokenHandle,
KPROCESSOR_MODE PreviousMode;
NTSTATUS Status = STATUS_SUCCESS;
PAGED_CODE();
PreviousMode = ExGetPreviousMode();
if(PreviousMode != KernelMode)
@@ -1814,6 +1836,8 @@ NTSTATUS STDCALL
SeQueryAuthenticationIdToken(IN PACCESS_TOKEN Token,
OUT PLUID LogonId)
{
PAGED_CODE();
*LogonId = ((PTOKEN)Token)->AuthenticationId;
return STATUS_SUCCESS;
@@ -1827,6 +1851,8 @@ SECURITY_IMPERSONATION_LEVEL
STDCALL
SeTokenImpersonationLevel(IN PACCESS_TOKEN Token)
{
PAGED_CODE();
return ((PTOKEN)Token)->ImpersonationLevel;
}
@@ -1837,6 +1863,8 @@ SeTokenImpersonationLevel(IN PACCESS_TOKEN Token)
TOKEN_TYPE STDCALL
SeTokenType(IN PACCESS_TOKEN Token)
{
PAGED_CODE();
return ((PTOKEN)Token)->TokenType;
}
@@ -1904,6 +1932,8 @@ NtOpenThreadTokenEx(IN HANDLE ThreadHandle,
KPROCESSOR_MODE PreviousMode;
NTSTATUS Status = STATUS_SUCCESS;
PAGED_CODE();
PreviousMode = ExGetPreviousMode();
if(PreviousMode != KernelMode)