|
|
/*++
Copyright (c) 1989 Microsoft Corporation
Module Name:
acceschk.c
Abstract:
This module contains the access check routines for memory management.
Author:
Lou Perazzoli (loup) 10-Apr-1989 Landy Wang (landyw) 02-June-1997
Revision History:
--*/
#include "mi.h"
#if defined(_WIN64)
#include "wow64t.h"
#pragma alloc_text(PAGE, MiCheckForUserStackOverflow)
#if PAGE_SIZE != PAGE_SIZE_X86NT
#define EMULATE_USERMODE_STACK_4K 1
#endif
#endif
//
// MmReadWrite yields 0 if no-access, 10 if read-only, 11 if read-write.
// It is indexed by a page protection. The value of this array is added
// to the !WriteOperation value. If the value is 10 or less an access
// violation is issued (read-only - write_operation) = 9,
// (read_only - read_operation) = 10, etc.
//
CCHAR MmReadWrite[32] = {1, 10, 10, 10, 11, 11, 11, 11, 1, 10, 10, 10, 11, 11, 11, 11, 1, 10, 10, 10, 11, 11, 11, 11, 1, 10, 10, 10, 11, 11, 11, 11 };
NTSTATUSMiAccessCheck ( IN PMMPTE PointerPte, IN ULONG_PTR WriteOperation, IN KPROCESSOR_MODE PreviousMode, IN ULONG Protection, IN BOOLEAN CallerHoldsPfnLock )
/*++
Routine Description:
Arguments:
PointerPte - Supplies the pointer to the PTE which caused the page fault.
WriteOperation - Supplies nonzero if the operation is a write, 0 if the operation is a read.
PreviousMode - Supplies the previous mode, one of UserMode or KernelMode.
Protection - Supplies the protection mask to check.
CallerHoldsPfnLock - Supplies TRUE if the PFN lock is held, FALSE otherwise.
Return Value:
Returns TRUE if access to the page is allowed, FALSE otherwise.
Environment:
Kernel mode, APCs disabled.
--*/
{ MMPTE PteContents; KIRQL OldIrql; PMMPFN Pfn1;
//
// Check to see if the owner bit allows access to the previous mode.
// Access is not allowed if the owner is kernel and the previous
// mode is user. Access is also disallowed if the write operation
// is true and the write field in the PTE is false.
//
//
// If both an access violation and a guard page violation could
// occur for the page, the access violation must be returned.
//
if (PreviousMode == UserMode) { if (PointerPte > MiHighestUserPte) { return STATUS_ACCESS_VIOLATION; } }
PteContents = *PointerPte;
if (PteContents.u.Hard.Valid == 1) {
//
// Valid pages cannot be guard page violations.
//
if (WriteOperation != 0) { if ((PteContents.u.Hard.Write == 1) || (PteContents.u.Hard.CopyOnWrite == 1)) { return STATUS_SUCCESS; } return STATUS_ACCESS_VIOLATION; }
return STATUS_SUCCESS; }
if (WriteOperation != 0) { WriteOperation = 1; }
if ((MmReadWrite[Protection] - (CCHAR)WriteOperation) < 10) { return STATUS_ACCESS_VIOLATION; }
//
// Check for a guard page fault.
//
if (Protection & MM_GUARD_PAGE) {
//
// If this thread is attached to a different process,
// return an access violation rather than a guard
// page exception. This prevents problems with unwanted
// stack expansion and unexpected guard page behavior
// from debuggers.
//
if (KeIsAttachedProcess()) { return STATUS_ACCESS_VIOLATION; }
//
// Check to see if this is a transition PTE. If so, the
// PFN database original contents field needs to be updated.
//
if ((PteContents.u.Soft.Transition == 1) && (PteContents.u.Soft.Prototype == 0)) {
//
// Acquire the PFN lock and check to see if the
// PTE is still in the transition state. If so,
// update the original PTE in the PFN database.
//
SATISFY_OVERZEALOUS_COMPILER (OldIrql = PASSIVE_LEVEL);
if (CallerHoldsPfnLock == FALSE) { LOCK_PFN (OldIrql); }
PteContents = *PointerPte; if ((PteContents.u.Soft.Transition == 1) && (PteContents.u.Soft.Prototype == 0)) {
//
// Still in transition, update the PFN database.
//
Pfn1 = MI_PFN_ELEMENT (PteContents.u.Trans.PageFrameNumber);
//
// Note that forked processes using guard pages only take the
// guard page fault when the first thread in either process
// access the address. This seems to be the best behavior we
// can provide users of this API as we must allow the first
// thread to make forward progress and the guard attribute is
// stored in the shared fork prototype PTE.
//
if (PteContents.u.Soft.Protection == MM_NOACCESS) { ASSERT ((Pfn1->u3.e1.PrototypePte == 1) && (MiLocateCloneAddress (PsGetCurrentProcess (), Pfn1->PteAddress) != NULL)); if (CallerHoldsPfnLock == FALSE) { UNLOCK_PFN (OldIrql); } return STATUS_ACCESS_VIOLATION; }
ASSERT ((Pfn1->u3.e1.PrototypePte == 0) || (MiLocateCloneAddress (PsGetCurrentProcess (), Pfn1->PteAddress) != NULL)); Pfn1->OriginalPte.u.Soft.Protection = Protection & ~MM_GUARD_PAGE; } if (CallerHoldsPfnLock == FALSE) { UNLOCK_PFN (OldIrql); } }
PointerPte->u.Soft.Protection = Protection & ~MM_GUARD_PAGE;
return STATUS_GUARD_PAGE_VIOLATION; }
return STATUS_SUCCESS;} NTSTATUSFASTCALLMiCheckForUserStackOverflow ( IN PVOID FaultingAddress )
/*++
Routine Description:
This routine checks to see if the faulting address is within the stack limits and if so tries to create another guard page on the stack. A stack overflow is returned if the creation of a new guard page fails or if the stack is in the following form:
stack +----------------+ growth | | StackBase | +----------------+ v | | | allocated | | | | ... | | | +----------------+ | old guard page | <- faulting address is in this page. +----------------+ | | +----------------+ | | last page of stack (always no access) +----------------+
In this case, the page before the last page is committed, but not as a guard page and a STACK_OVERFLOW condition is returned.
Arguments:
FaultingAddress - Supplies the virtual address of the page which was a guard page.
Return Value:
NTSTATUS.
Environment:
Kernel mode. No mutexes held.
--*/
{ PTEB Teb; PPEB Peb; ULONG_PTR NextPage; SIZE_T RegionSize; NTSTATUS status; PVOID DeallocationStack; PVOID *StackLimit; PVOID StackBase; PETHREAD Thread; ULONG_PTR PageSize; PEPROCESS Process; ULONG OldProtection; ULONG ExecuteFlags; ULONG ProtectionFlags; LOGICAL RevertExecuteFlag; ULONG StackProtection;#if defined (_IA64_)
PVOID DeallocationBStore;#endif
#if defined(_WIN64)
PTEB32 Teb32;
Teb32 = NULL;#endif
//
// Make sure we are not recursing with the address space mutex held.
//
Thread = PsGetCurrentThread ();
if (Thread->AddressSpaceOwner == 1) { ASSERT (KeAreAllApcsDisabled () == TRUE); return STATUS_GUARD_PAGE_VIOLATION; }
//
// If this thread is attached to a different process,
// return an access violation rather than a guard
// page exception. This prevents problems with unwanted
// stack expansion and unexpected guard page behavior
// from debuggers.
//
// Note we must bail when attached because we reference fields in our
// TEB below which have no relationship to the virtual address space
// of the process we are attached to. Rather than introduce random
// behavior into applications, it's better to consistently return an AV
// for this scenario (one thread trying to grow another's stack).
//
if (KeIsAttachedProcess()) { return STATUS_GUARD_PAGE_VIOLATION; }
Process = NULL;
//
// Initialize default protections early so that they can be used on
// all code paths.
//
ProtectionFlags = PAGE_READWRITE | PAGE_GUARD; RevertExecuteFlag = FALSE; StackProtection = PAGE_READWRITE;
Teb = Thread->Tcb.Teb;
//
// Create an exception handler as the TEB is within the user's
// address space.
//
try {
StackBase = Teb->NtTib.StackBase;
#if defined (_IA64_)
DeallocationBStore = Teb->DeallocationBStore;
if ((FaultingAddress >= StackBase) && (FaultingAddress < DeallocationBStore)) {
//
// Check to see if the faulting address is within
// the bstore limits and if so try to create another guard
// page in the bstore.
//
//
// +----------------+
// | | last page of stack (always no access)
// +----------------+
// | |
// | |
// | |
// +----------------+
// | old guard page | <- faulting address is in this page.
// +----------------+
// bstore | |
// growth | ...... |
// | |
// ^ | allocated |
// | | | StackBase
// +----------------+
//
//
NextPage = (ULONG_PTR)PAGE_ALIGN(FaultingAddress) + PAGE_SIZE;
RegionSize = PAGE_SIZE;
if ((NextPage + PAGE_SIZE) >= (ULONG_PTR)PAGE_ALIGN(DeallocationBStore)) {
//
// There is no more room for expansion, attempt to
// commit the page before the last page of the stack.
//
NextPage = (ULONG_PTR)PAGE_ALIGN(DeallocationBStore) - PAGE_SIZE;
status = ZwAllocateVirtualMemory (NtCurrentProcess(), (PVOID *)&NextPage, 0, &RegionSize, MEM_COMMIT, PAGE_READWRITE); if (NT_SUCCESS(status)) { Teb->BStoreLimit = (PVOID) NextPage; }
return STATUS_STACK_OVERFLOW; }
Teb->BStoreLimit = (PVOID) NextPage;
goto AllocateTheGuard; }
#endif
DeallocationStack = Teb->DeallocationStack; StackLimit = &Teb->NtTib.StackLimit;
//
// The faulting address must be below the stack base and
// above the stack limit.
//
if ((FaultingAddress >= StackBase) || (FaultingAddress < DeallocationStack)) {
//
// Not within the native stack.
//
#if defined (_WIN64)
//
// Also check for the 32-bit stack if this is a Wow64 process.
//
Process = PsGetCurrentProcessByThread (Thread);
if (Process->Wow64Process != NULL) {
Teb32 = (PTEB32) Teb->NtTib.ExceptionList;
if (Teb32 != NULL) {
ProbeForReadSmallStructure (Teb32, sizeof(TEB32), sizeof(ULONG));
StackBase = (PVOID) (ULONG_PTR) Teb32->NtTib.StackBase; DeallocationStack = (PVOID) (ULONG_PTR) Teb32->DeallocationStack;
if ((FaultingAddress >= StackBase) || (FaultingAddress < DeallocationStack)) {
//
// Not within the stack.
//
return STATUS_GUARD_PAGE_VIOLATION; }
StackLimit = (PVOID *)&Teb32->NtTib.StackLimit; goto ExtendTheStack; } }
#endif
//
// Not within the stack.
//
return STATUS_GUARD_PAGE_VIOLATION; }
#if defined (_WIN64)
ExtendTheStack:#endif
//
// If the image was marked for no stack extensions,
// return stack overflow immediately.
//
Process = PsGetCurrentProcessByThread (Thread);
Peb = Process->Peb;
if (Peb->NtGlobalFlag & FLG_DISABLE_STACK_EXTENSION) { return STATUS_STACK_OVERFLOW; }
//
// Add execute permission if necessary. We do not need to change
// anything for the old guard page because either it is the first
// guard page of the current thread and it will get correct
// protection during user mode thread initialization (see
// LdrpInitialize in base\ntdll\ldrinit.c) or it is a
// guard page created by this function during stack growth
// and in this case it gets correct protection.
//
#if defined(_WIN64)
if (Teb32 != NULL) { ASSERT (Process->Wow64Process != NULL); ExecuteFlags = ((PPEB32)(Process->Wow64Process->Wow64))->ExecuteOptions; } else {#endif
ExecuteFlags = Peb->ExecuteOptions;#if defined(_WIN64)
}#endif
if (ExecuteFlags & (MEM_EXECUTE_OPTION_STACK | MEM_EXECUTE_OPTION_DATA)) {
if (ExecuteFlags & MEM_EXECUTE_OPTION_STACK) {
StackProtection = PAGE_EXECUTE_READWRITE; ProtectionFlags = PAGE_EXECUTE_READWRITE | PAGE_GUARD; } else {
//
// The stack must be made non-executable. The
// ZwAllocateVirtualMemory call below will make it
// executable because this process is marked as wanting
// executable data and ZwAllocate cannot tell this is
// really a stack allocation.
//
ASSERT (ExecuteFlags & MEM_EXECUTE_OPTION_DATA); RevertExecuteFlag = TRUE; } }
//
// This address is within the current stack, if there is ample
// room for another guard page then attempt to commit it.
//
#if EMULATE_USERMODE_STACK_4K
if (Teb32 != NULL) {
NextPage = (ULONG_PTR) PAGE_4K_ALIGN (FaultingAddress) - PAGE_4K; DeallocationStack = PAGE_4K_ALIGN (DeallocationStack); PageSize = PAGE_4K; RegionSize = PAGE_4K; //
// Don't set the guard bit in the native PTE - just set
// it in the AltPte.
//
ProtectionFlags &= ~PAGE_GUARD; } else#endif
{ NextPage = (ULONG_PTR)PAGE_ALIGN (FaultingAddress) - PAGE_SIZE; DeallocationStack = PAGE_ALIGN (DeallocationStack); PageSize = PAGE_SIZE; RegionSize = PAGE_SIZE; }
if ((NextPage - PageSize) <= (ULONG_PTR)DeallocationStack) {
//
// There is no more room for expansion, attempt to
// commit the page before the last page of the stack.
//
NextPage = (ULONG_PTR)DeallocationStack + PageSize;
status = ZwAllocateVirtualMemory (NtCurrentProcess(), (PVOID *)&NextPage, 0, &RegionSize, MEM_COMMIT, StackProtection);
if (NT_SUCCESS(status)) {
#if defined(_WIN64)
if (Teb32 != NULL) { *(PULONG) StackLimit = (ULONG) NextPage; } else#endif
*StackLimit = (PVOID) NextPage;
//
// Revert the EXECUTE bit if we get it by default
// but it is not desired.
//
if (RevertExecuteFlag) {
status = ZwProtectVirtualMemory (NtCurrentProcess(), (PVOID *)&NextPage, &RegionSize, StackProtection, &OldProtection);
ASSERT (StackProtection & PAGE_READWRITE); } }
return STATUS_STACK_OVERFLOW; }
#if defined(_WIN64)
if (Teb32 != NULL) {
//
// Update the 32-bit stack limit.
//
*(PULONG) StackLimit = (ULONG) (NextPage + PageSize); } else#endif
*StackLimit = (PVOID)(NextPage + PAGE_SIZE);
} except (EXCEPTION_EXECUTE_HANDLER) {
//
// An exception has occurred during the referencing of the
// TEB or TIB, just return a guard page violation and
// don't deal with the stack overflow.
//
return STATUS_GUARD_PAGE_VIOLATION; }
#if defined (_IA64_)
AllocateTheGuard:#endif
//
// Set the guard page. For Wow64 processes the protection
// will not contain the PAGE_GUARD bit. This is ok since in these
// cases we will set the bit for the top emulated 4K page.
//
status = ZwAllocateVirtualMemory (NtCurrentProcess(), (PVOID *)&NextPage, 0, &RegionSize, MEM_COMMIT, ProtectionFlags);
if (NT_SUCCESS(status) || (status == STATUS_ALREADY_COMMITTED)) {
//
// Revert the EXECUTE bit with an extra protect() call
// if we get it by default but it is not desired.
//
if (RevertExecuteFlag) {
if (ProtectionFlags & PAGE_GUARD) { ProtectionFlags = PAGE_READWRITE | PAGE_GUARD; } else { ProtectionFlags = PAGE_READWRITE; }
status = ZwProtectVirtualMemory (NtCurrentProcess(), (PVOID *)&NextPage, &RegionSize, ProtectionFlags, &OldProtection); }
#if EMULATE_USERMODE_STACK_4K
if (Teb32 != NULL) { LOCK_ADDRESS_SPACE (Process);
MiProtectFor4kPage ((PVOID)NextPage, RegionSize, (MM_READWRITE | MM_GUARD_PAGE), ALT_CHANGE, Process);
UNLOCK_ADDRESS_SPACE (Process); }
#endif
//
// The guard page is now committed or stack space is
// already present, return success.
//
return STATUS_PAGE_FAULT_GUARD_PAGE; }
return STATUS_STACK_OVERFLOW;}
|
