windows-xp/Source/XPSP1/NT/base/ntos/mm/acceschk.c

/*++

Copyright (c) 1989  Microsoft Corporation

Module Name:

   acceschk.c

Abstract:

    This module contains the access check routines for memory management.

Author:

    Lou Perazzoli (loup) 10-Apr-1989
    Landy Wang (landyw) 02-June-1997

Revision History:

--*/

#include "mi.h"

#if defined(_WIN64)
#include "wow64t.h"

#pragma alloc_text(PAGE, MiCheckForUserStackOverflow)

#if PAGE_SIZE != PAGE_SIZE_X86NT
#define EMULATE_USERMODE_STACK_4K       1
#endif
#endif

//
// MmReadWrite yields 0 if no-access, 10 if read-only, 11 if read-write.
// It is indexed by a page protection.  The value of this array is added
// to the !WriteOperation value.  If the value is 10 or less an access
// violation is issued (read-only - write_operation) = 9,
// (read_only - read_operation) = 10, etc.
//

CCHAR MmReadWrite[32] = {1, 10, 10, 10, 11, 11, 11, 11,
                         1, 10, 10, 10, 11, 11, 11, 11,
                         1, 10, 10, 10, 11, 11, 11, 11,
                         1, 10, 10, 10, 11, 11, 11, 11 };


NTSTATUS
MiAccessCheck (
    IN PMMPTE PointerPte,
    IN ULONG_PTR WriteOperation,
    IN KPROCESSOR_MODE PreviousMode,
    IN ULONG Protection,
    IN BOOLEAN CallerHoldsPfnLock
    )

/*++

Routine Description:



Arguments:

    PointerPte - Supplies the pointer to the PTE which caused the
                 page fault.

    WriteOperation - Supplies nonzero if the operation is a write, 0 if
                     the operation is a read.

    PreviousMode - Supplies the previous mode, one of UserMode or KernelMode.

    Protection - Supplies the protection mask to check.

    CallerHoldsPfnLock - Supplies TRUE if the PFN lock is held, FALSE otherwise.

Return Value:

    Returns TRUE if access to the page is allowed, FALSE otherwise.

Environment:

    Kernel mode, APCs disabled.

--*/

{
    MMPTE PteContents;
    KIRQL OldIrql;
    PMMPFN Pfn1;

    //
    // Check to see if the owner bit allows access to the previous mode.
    // Access is not allowed if the owner is kernel and the previous
    // mode is user.  Access is also disallowed if the write operation
    // is true and the write field in the PTE is false.
    //

    //
    // If both an access violation and a guard page violation could
    // occur for the page, the access violation must be returned.
    //

    if (PreviousMode == UserMode) {
        if (PointerPte > MiHighestUserPte) {
            return STATUS_ACCESS_VIOLATION;
        }
    }

    PteContents = *PointerPte;

    if (PteContents.u.Hard.Valid == 1) {

        //
        // Valid pages cannot be guard page violations.
        //

        if (WriteOperation != 0) {
            if ((PteContents.u.Hard.Write == 1) ||
                (PteContents.u.Hard.CopyOnWrite == 1)) {
                return STATUS_SUCCESS;
            }
            return STATUS_ACCESS_VIOLATION;
        }

        return STATUS_SUCCESS;
    }

    if (WriteOperation != 0) {
        WriteOperation = 1;
    }

    if ((MmReadWrite[Protection] - (CCHAR)WriteOperation) < 10) {
        return STATUS_ACCESS_VIOLATION;
    }

    //
    // Check for a guard page fault.
    //

    if (Protection & MM_GUARD_PAGE) {

        //
        // If this thread is attached to a different process,
        // return an access violation rather than a guard
        // page exception.  The prevents problems with unwanted
        // stack expansion and unexpected guard page behavior
        // from debuggers.
        //

        if (KeIsAttachedProcess()) {
            return STATUS_ACCESS_VIOLATION;
        }

        //
        // Check to see if this is a transition PTE. If so, the
        // PFN database original contents field needs to be updated.
        //

        if ((PteContents.u.Soft.Transition == 1) &&
            (PteContents.u.Soft.Prototype == 0)) {

            //
            // Acquire the PFN lock and check to see if the
            // PTE is still in the transition state. If so,
            // update the original PTE in the PFN database.
            //

            //
            // Initializing OldIrql is not needed for correctness but
            // without it the compiler cannot compile this code
            // W4 to check for use of uninitialized variables.
            //

            OldIrql = PASSIVE_LEVEL;

            if (CallerHoldsPfnLock == FALSE) {
                LOCK_PFN (OldIrql);
            }

            PteContents = *(volatile MMPTE *)PointerPte;
            if ((PteContents.u.Soft.Transition == 1) &&
                (PteContents.u.Soft.Prototype == 0)) {

                //
                // Still in transition, update the PFN database.
                //

                Pfn1 = MI_PFN_ELEMENT (PteContents.u.Trans.PageFrameNumber);

                //
                // Note that forked processes using guard pages only take the
                // guard page fault when the first thread in either process
                // access the address.  This seems to be the best behavior we
                // can provide users of this API as we must allow the first
                // thread to make forward progress and the guard attribute is
                // stored in the shared fork prototype PTE.
                //

                if (PteContents.u.Soft.Protection == MM_NOACCESS) {
                    ASSERT ((Pfn1->u3.e1.PrototypePte == 1) &&
                            (MiLocateCloneAddress (PsGetCurrentProcess (), Pfn1->PteAddress) != NULL));
                    if (CallerHoldsPfnLock == FALSE) {
                        UNLOCK_PFN (OldIrql);
                    }
                    return STATUS_ACCESS_VIOLATION;
                }

                ASSERT ((Pfn1->u3.e1.PrototypePte == 0) ||
                        (MiLocateCloneAddress (PsGetCurrentProcess (), Pfn1->PteAddress) != NULL));
                Pfn1->OriginalPte.u.Soft.Protection =
                                      Protection & ~MM_GUARD_PAGE;
            }
            if (CallerHoldsPfnLock == FALSE) {
                UNLOCK_PFN (OldIrql);
            }
        }

        PointerPte->u.Soft.Protection = Protection & ~MM_GUARD_PAGE;

        return STATUS_GUARD_PAGE_VIOLATION;
    }

    return STATUS_SUCCESS;
}

NTSTATUS
FASTCALL
MiCheckForUserStackOverflow (
    IN PVOID FaultingAddress
    )

/*++

Routine Description:

    This routine checks to see if the faulting address is within
    the stack limits and if so tries to create another guard
    page on the stack.  A stack overflow is returned if the
    creation of a new guard page fails or if the stack is in
    the following form:


    stack   +----------------+
    growth  |                |  StackBase
      |     +----------------+
      v     |                |
            |   allocated    |
            |                |
            |    ...         |
            |                |
            +----------------+
            | old guard page | <- faulting address is in this page.
            +----------------+
            |                |
            +----------------+
            |                | last page of stack (always no access)
            +----------------+

    In this case, the page before the last page is committed, but
    not as a guard page and a STACK_OVERFLOW condition is returned.

Arguments:

    FaultingAddress - Supplies the virtual address of the page which
                      was a guard page.

Return Value:

    NTSTATUS.

Environment:

    Kernel mode. No mutexes held.

--*/

{
    PTEB Teb;
    PPEB Peb;
    ULONG_PTR NextPage;
    SIZE_T RegionSize;
    NTSTATUS status;
    PVOID DeallocationStack;
    PVOID *StackLimit;
    PETHREAD Thread;
    ULONG_PTR PageSize;
    PEPROCESS Process;
    ULONG OldProtection;
    ULONG ExecuteFlags;
    ULONG ProtectionFlags;
    LOGICAL RevertExecuteFlag;
    ULONG StackProtection;
#if defined(_WIN64)
    PTEB32 Teb32;

    Teb32 = NULL;
#endif

    //
    // Make sure we are not recursing with the address space mutex held.
    //

    Thread = PsGetCurrentThread ();

    if (Thread->AddressSpaceOwner == 1) {
        ASSERT (KeGetCurrentIrql () == APC_LEVEL);
        return STATUS_GUARD_PAGE_VIOLATION;
    }

    Process = NULL;

    Teb = Thread->Tcb.Teb;

    //
    // Create an exception handler as the TEB is within the user's
    // address space.
    //

    try {

        //
        // Initialize default protections early so that they can be used on
        // all code paths.
        //

        ProtectionFlags = PAGE_READWRITE | PAGE_GUARD;
        RevertExecuteFlag = FALSE;
        StackProtection = PAGE_READWRITE;

#if defined(_IA64_)

      if ((Teb->NtTib.StackBase <= FaultingAddress) &&
          (Teb->DeallocationBStore > FaultingAddress)) {

        //
        // Check to see if the faulting address is within
        // the bstore limits and if so try to create another guard
        // page in the bstore.
        //
        //
        //          +----------------+
        //          |                | last page of stack (always no access)
        //          +----------------+
        //          |                |
        //          |                |
        //          |                |
        //          +----------------+
        //          | old guard page | <- faulting address is in this page.               |
        //          +----------------+
        //  bstore  |                |
        //  growth  |    ......      |
        //          |                |
        //    ^     |   allocated    |
        //    |     |                |  StackBase
        //          +----------------+
        //
        //

        NextPage = (ULONG_PTR)PAGE_ALIGN(FaultingAddress) + PAGE_SIZE;

        RegionSize = PAGE_SIZE;

        if ((NextPage + PAGE_SIZE) >= (ULONG_PTR)PAGE_ALIGN(Teb->DeallocationBStore)) {

            //
            // There is no more room for expansion, attempt to
            // commit the page before the last page of the
            // stack.
            //

            NextPage = (ULONG_PTR)PAGE_ALIGN(Teb->DeallocationBStore) - PAGE_SIZE;

            status = ZwAllocateVirtualMemory (NtCurrentProcess(),
                                              (PVOID *)&NextPage,
                                              0,
                                              &RegionSize,
                                              MEM_COMMIT,
                                              PAGE_READWRITE);
            if ( NT_SUCCESS(status) ) {
                Teb->BStoreLimit = (PVOID)( (PUCHAR)NextPage);
            }

            return STATUS_STACK_OVERFLOW;
        }

        Teb->BStoreLimit = (PVOID)((PUCHAR)(NextPage));

      }
      else {
#endif

        DeallocationStack = Teb->DeallocationStack;
        StackLimit = &Teb->NtTib.StackLimit;

        //
        // The stack base and the stack limit are both within the stack.
        //

        if ((Teb->NtTib.StackBase <= FaultingAddress) ||
            (DeallocationStack > FaultingAddress)) {

#if defined(_WIN64)

            //
            // Also check for the 32-bit native stack on NT64.
            //

            Teb32 = (PTEB32) Teb->NtTib.ExceptionList;

            if (Teb32 != NULL) {
                ProbeForReadSmallStructure(Teb32, sizeof(TEB32), sizeof(ULONG));
                if ((ULONG_PTR)Teb32->NtTib.StackBase > (ULONG_PTR)FaultingAddress &&
                    (ULONG_PTR)Teb32->DeallocationStack <= (ULONG_PTR)FaultingAddress) {
                    DeallocationStack = (PVOID)ULongToPtr(Teb32->DeallocationStack);

                    StackLimit = (PVOID *)&Teb32->NtTib.StackLimit;
                }
                else {
                    //
                    // Not within the stack.
                    //

                    return STATUS_GUARD_PAGE_VIOLATION;
                }
            }
            else
#endif
              {
                //
                // Not within the stack.
                //

                return STATUS_GUARD_PAGE_VIOLATION;
            }
        }

        //
        // If the image was marked for no stack extensions we will return
        // stack overflow immediately.
        //

        Process = PsGetCurrentProcessByThread (Thread);

        Peb = Process->Peb;

        if (Peb->NtGlobalFlag & FLG_DISABLE_STACK_EXTENSION) {
            return STATUS_STACK_OVERFLOW;
        }

        //
        // Add execute permission if necessary. We do not need to change anything
        // for the old guard page because either it is the first guard page of the
        // current thread and it will get correct protection during user mode thread
        // initialization (see LdrpInitialize in base\ntdll\ldrinit.c) or it is a 
        // guard page created by this function during stack growth and in this case
        // it gets correct protection. We do not do anything for a wow64 process.
        //

#if defined(_WIN64)
        if (Teb32 == NULL) {
#endif            
            ExecuteFlags = Peb->ExecuteOptions;

            if (ExecuteFlags & (MEM_EXECUTE_OPTION_STACK | MEM_EXECUTE_OPTION_DATA)) {

                if (ExecuteFlags & MEM_EXECUTE_OPTION_STACK) {

                    StackProtection = PAGE_EXECUTE_READWRITE;
                    ProtectionFlags = PAGE_EXECUTE_READWRITE | PAGE_GUARD;
                }
                else {

                    //
                    // The stack must be made non-executable.  The
                    // ZwAllocateVirtualMemory call below will make it executable
                    // because this process is marked as wanting executable data
                    // and ZwAllocate cannot tell this is really a stack
                    // allocation.
                    //

                    ASSERT (ExecuteFlags & MEM_EXECUTE_OPTION_DATA);
                    RevertExecuteFlag = TRUE;
                }
            }
#if defined(_WIN64)
        }
#endif

        //
        // This address is within the current stack, check to see
        // if there is ample room for another guard page and
        // if so attempt to commit a new guard page.
        //

#if EMULATE_USERMODE_STACK_4K

        if (Teb32 != NULL)
        {
            NextPage = ((ULONG_PTR)PAGE_4K_ALIGN(FaultingAddress) - PAGE_4K);
            DeallocationStack = PAGE_4K_ALIGN(DeallocationStack);
            PageSize = RegionSize = PAGE_4K;
            
            //
            // Don't set the 'G' bit on the native PTE. Let's just set
            // 'G' bit on the AltPte.
            //

            ProtectionFlags &= ~PAGE_GUARD;
        }
        else
#endif
        {
            NextPage = ((ULONG_PTR)PAGE_ALIGN(FaultingAddress) - PAGE_SIZE);
            DeallocationStack = PAGE_ALIGN(DeallocationStack);
            PageSize = RegionSize = PAGE_SIZE;
        }

        if ((NextPage - PageSize) <= (ULONG_PTR)DeallocationStack) {

            //
            // There is no more room for expansion, attempt to
            // commit the page before the last page of the
            // stack.
            //

            NextPage = (ULONG_PTR)DeallocationStack + PageSize;

            status = ZwAllocateVirtualMemory (NtCurrentProcess(),
                                              (PVOID *)&NextPage,
                                              0,
                                              &RegionSize,
                                              MEM_COMMIT,
                                              StackProtection);

            if (NT_SUCCESS(status)) {

#if defined(_WIN64)
                if (Teb32) {
                    // update the 32-bit stacklimit
                    *(ULONG *)StackLimit = PtrToUlong((PUCHAR)NextPage);
                }
                else {
                    *StackLimit = (PVOID)( (PUCHAR)NextPage);
                }
#else
                *StackLimit = (PVOID)( (PUCHAR)NextPage);
#endif

                //
                // Revert the EXECUTE bit with an extra protect() call
                // if we get it by default but it is not desired.
                //

                if (RevertExecuteFlag) {

                    status = ZwProtectVirtualMemory (NtCurrentProcess(),
                                                     (PVOID *)&NextPage,
                                                     &RegionSize,
                                                     StackProtection,
                                                     &OldProtection);

                    ASSERT (StackProtection & PAGE_READWRITE);
                }
            }

            return STATUS_STACK_OVERFLOW;
        }
#if defined(_WIN64)
        if (Teb32 != NULL) {

            //
            // Update the 32-bit stack limit.
            //

            *(ULONG *)StackLimit = PtrToUlong((PUCHAR)(NextPage + PageSize));
        }
        else {
            *StackLimit = (PVOID)((PUCHAR)(NextPage + PAGE_SIZE));
        }
#else
        *StackLimit = (PVOID)((PUCHAR)(NextPage + PAGE_SIZE));
#endif

#if defined(_IA64_)
      }
#endif // _IA64_

       //
       // Set the guard page. For wow64 processes the protection
       // will not contain the PAGE_GUARD bit. This is ok since in these
       // cases we will set the bit for the top emulated 4K page.
       //

       status = ZwAllocateVirtualMemory (NtCurrentProcess(),
                                         (PVOID *)&NextPage,
                                         0,
                                         &RegionSize,
                                         MEM_COMMIT,
                                         ProtectionFlags);

       if (NT_SUCCESS(status) || (status == STATUS_ALREADY_COMMITTED)) {

            //
            // Revert the EXECUTE bit with an extra protect() call
            // if we get it by default but it is not desired.
            //

            if (RevertExecuteFlag) {

                if (ProtectionFlags & PAGE_GUARD) {
                    ProtectionFlags = PAGE_READWRITE | PAGE_GUARD;
                }
                else {
                    ProtectionFlags = PAGE_READWRITE;
                }

                status = ZwProtectVirtualMemory (NtCurrentProcess(),
                                                 (PVOID *)&NextPage,
                                                 &RegionSize,
                                                 ProtectionFlags,
                                                 &OldProtection);
            }

#if EMULATE_USERMODE_STACK_4K
            if (Teb32 != NULL) {
                
                LOCK_ADDRESS_SPACE (Process);

                MiProtectFor4kPage ((PVOID)NextPage,
                                    RegionSize,
                                    (MM_READWRITE | MM_GUARD_PAGE),
                                    ALT_CHANGE,
                                    Process);

                UNLOCK_ADDRESS_SPACE (Process);
            }
#endif


            //
            // The guard page is now committed or stack space is
            // already present, return success.
            //

            return STATUS_PAGE_FAULT_GUARD_PAGE;
        }

        return STATUS_STACK_OVERFLOW;

    } except (EXCEPTION_EXECUTE_HANDLER) {

        //
        // An exception has occurred during the referencing of the
        // TEB or TIB, just return a guard page violation and
        // don't deal with the stack overflow.
        //

        return STATUS_GUARD_PAGE_VIOLATION;
    }
}