VirtualBox

Ignore:
Timestamp:
Aug 13, 2015 12:31:23 AM (10 years ago)
Author:
vboxsync
svn:sync-xref-src-repo-rev:
102065
Message:

SUPDrv-win.cpp: Workaround for AudioDG.exe on windows 10 wanting to do some new cpu set management for us, not sure what it is or what I think of it. We need audio though, so allow it for now. Also modified the SUPDRVNTPROTECT handling to make sure we don't try remove structures not in the tree, in case we fail early before it's inserted. Finally, shut up a signed comparisons warning.

File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/src/VBox/HostDrivers/Support/win/SUPDrv-win.cpp

    r57201 r57303  
    207207    /** The kind of process we're protecting. */
    208208    SUPDRVNTPROTECTKIND volatile enmProcessKind;
     209    /** Whether this structure is in the tree. */
     210    bool                fInTree : 1;
    209211    /** 7,: Hack to allow the supid themes service duplicate handle privileges to
    210212     *  our process. */
    … …  
    29382940            if (fSuccess)
    29392941            {
     2942                pNtChild->fInTree         = true;
    29402943                pNtParent->u.pChild       = pNtChild; /* Parent keeps the initial reference. */
    29412944                pNtParent->enmProcessKind = kSupDrvNtProtectKind_StubParent;
    … …  
    32683271            else
    32693272            {
     3273                ACCESS_MASK const fDesiredAccess = pOpInfo->Parameters->CreateHandleInformation.DesiredAccess;
     3274
    32703275                /* Special case 1 on Vista, 7 & 8:
    32713276                   The CreateProcess code passes the handle over to CSRSS.EXE
    … …  
    32843289                {
    32853290                    if (   !pOpInfo->KernelHandle
    3286                         && pOpInfo->Parameters->CreateHandleInformation.DesiredAccess == s_fCsrssStupidDesires)
     3291                        && fDesiredAccess == s_fCsrssStupidDesires)
    32873292                    {
    32883293                        if (g_uNtVerCombined < SUP_MAKE_NT_VER_SIMPLE(6, 3))
    … …  
    33133318                {
    33143319                    pNtProtect->fCsrssFirstProcessCreateHandle = false;
    3315                     if (pOpInfo->Parameters->CreateHandleInformation.DesiredAccess == s_fCsrssStupidDesires)
     3320                    if (fDesiredAccess == s_fCsrssStupidDesires)
    33163321                    {
    33173322                        /* Not needed: PROCESS_CREATE_THREAD, PROCESS_SET_SESSIONID,
    … …  
    33333338                if (   g_uNtVerCombined >= SUP_MAKE_NT_VER_SIMPLE(6, 0)
    33343339                    && g_uNtVerCombined  < SUP_MAKE_NT_VER_SIMPLE(6, 2)
    3335                     && pOpInfo->Parameters->CreateHandleInformation.DesiredAccess == 0x1478 /* 6.1.7600.16385 (win7_rtm.090713-1255) */
     3340                    && fDesiredAccess == 0x1478 /* 6.1.7600.16385 (win7_rtm.090713-1255) */
    33363341                    && pNtProtect->fThemesFirstProcessCreateHandle
    33373342                    && pOpInfo->KernelHandle == 0
    … …  
    33443349                }
    33453350
     3351                /* Special case 6a, Windows 10+: AudioDG.exe opens the process with the
     3352                   PROCESS_SET_LIMITED_INFORMATION right.  It seems like it need it for
     3353                   some myserious and weirdly placed cpu set management of our process.
     3354                   I'd love to understand what that's all about...
     3355                   Currently playing safe and only grand this right, however limited, to
     3356                   audiodg.exe. */
     3357                if (   g_uNtVerCombined >= SUP_MAKE_NT_VER_SIMPLE(10, 0)
     3358                    && (   fDesiredAccess == PROCESS_SET_LIMITED_INFORMATION
     3359                        || fDesiredAccess == (PROCESS_SET_LIMITED_INFORMATION | PROCESS_QUERY_LIMITED_INFORMATION) /* expected fix #1 */
     3360                        || fDesiredAccess == (PROCESS_SET_LIMITED_INFORMATION | PROCESS_QUERY_INFORMATION)         /* expected fix #2 */
     3361                        )
     3362                    && pOpInfo->KernelHandle == 0
     3363                    && ExGetPreviousMode() == UserMode
     3364                    && supdrvNtProtectIsSystem32ProcessMatch(PsGetCurrentProcess(), "audiodg.exe") )
     3365                {
     3366                    fAllowedRights |= PROCESS_SET_LIMITED_INFORMATION;
     3367                    pOpInfo->CallContext = NULL; /* don't assert this. */
     3368                }
     3369
    33463370                Log(("vboxdrv/ProcessHandlePre: %sctx=%04zx/%p wants %#x to %p/pid=%04zx [%d], allow %#x => %#x; %s [prev=%#x]\n",
    33473371                     pOpInfo->KernelHandle ? "k" : "", PsGetProcessId(PsGetCurrentProcess()), PsGetCurrentProcess(),
    3348                      pOpInfo->Parameters->CreateHandleInformation.DesiredAccess,
    3349                      pOpInfo->Object, pNtProtect->AvlCore.Key, pNtProtect->enmProcessKind, fAllowedRights,
    3350                      pOpInfo->Parameters->CreateHandleInformation.DesiredAccess & fAllowedRights,
     3372                     fDesiredAccess, pOpInfo->Object, pNtProtect->AvlCore.Key, pNtProtect->enmProcessKind,
     3373                     fAllowedRights, fDesiredAccess & fAllowedRights,
    33513374                     PsGetProcessImageFileName(PsGetCurrentProcess()), ExGetPreviousMode() ));
    33523375
    … …  
    33733396            else
    33743397            {
     3398                ACCESS_MASK const fDesiredAccess = pOpInfo->Parameters->DuplicateHandleInformation.DesiredAccess;
     3399
    33753400                /* Special case 5 on Vista, 7 & 8:
    33763401                   This is the CSRSS.EXE end of special case #1. */
    … …  
    33793404                    && pNtProtect->cCsrssFirstProcessDuplicateHandle > 0
    33803405                    && pOpInfo->KernelHandle == 0
    3381                     && pOpInfo->Parameters->DuplicateHandleInformation.DesiredAccess == s_fCsrssStupidDesires
     3406                    && fDesiredAccess == s_fCsrssStupidDesires
    33823407                    &&    pNtProtect->hParentPid
    33833408                       == PsGetProcessId((PEPROCESS)pOpInfo->Parameters->DuplicateHandleInformation.SourceProcess)
    … …  
    33993424                }
    34003425
     3426                /* Special case 6b, Windows 10+: AudioDG.exe duplicates the handle it opened above. */
     3427                if (   g_uNtVerCombined >= SUP_MAKE_NT_VER_SIMPLE(10, 0)
     3428                    && (   fDesiredAccess == PROCESS_SET_LIMITED_INFORMATION
     3429                        || fDesiredAccess == (PROCESS_SET_LIMITED_INFORMATION | PROCESS_QUERY_LIMITED_INFORMATION) /* expected fix #1 */
     3430                        || fDesiredAccess == (PROCESS_SET_LIMITED_INFORMATION | PROCESS_QUERY_INFORMATION)         /* expected fix #2 */
     3431                        )
     3432                    && pOpInfo->KernelHandle == 0
     3433                    && ExGetPreviousMode() == UserMode
     3434                    && supdrvNtProtectIsSystem32ProcessMatch(PsGetCurrentProcess(), "audiodg.exe") )
     3435                {
     3436                    fAllowedRights |= PROCESS_SET_LIMITED_INFORMATION;
     3437                    pOpInfo->CallContext = NULL; /* don't assert this. */
     3438                }
     3439
    34013440                Log(("vboxdrv/ProcessHandlePre: %sctx=%04zx/%p[%p] dup from %04zx/%p with %#x to %p in pid=%04zx [%d] %s\n",
    34023441                     pOpInfo->KernelHandle ? "k" : "", PsGetProcessId(PsGetCurrentProcess()), PsGetCurrentProcess(),
    … …  
    34043443                     PsGetProcessId((PEPROCESS)pOpInfo->Parameters->DuplicateHandleInformation.SourceProcess),
    34053444                     pOpInfo->Parameters->DuplicateHandleInformation.SourceProcess,
    3406                      pOpInfo->Parameters->DuplicateHandleInformation.DesiredAccess,
     3445                     fDesiredAccess,
    34073446                     pOpInfo->Object, pNtProtect->AvlCore.Key, pNtProtect->enmProcessKind,
    34083447                     PsGetProcessImageFileName(PsGetCurrentProcess()) ));
    … …  
    36853724        RTSpinlockAcquire(g_hNtProtectLock);
    36863725        bool fSuccess = RTAvlPVInsert(&g_NtProtectTree, &pNtProtect->AvlCore);
     3726        pNtProtect->fInTree = fSuccess;
    36873727        RTSpinlockRelease(g_hNtProtectLock);
    36883728
    … …  
    37253765         */
    37263766        ASMAtomicWriteU32(&pNtProtect->u32Magic, SUPDRVNTPROTECT_MAGIC_DEAD);
    3727         PSUPDRVNTPROTECT pRemoved = (PSUPDRVNTPROTECT)RTAvlPVRemove(&g_NtProtectTree, pNtProtect->AvlCore.Key);
    3728 
    3729         PSUPDRVNTPROTECT pRemovedChild = NULL;
     3767        if (pNtProtect->fInTree)
     3768        {
     3769            PSUPDRVNTPROTECT pRemoved = (PSUPDRVNTPROTECT)RTAvlPVRemove(&g_NtProtectTree, pNtProtect->AvlCore.Key);
     3770            Assert(pRemoved == pNtProtect);
     3771            pNtProtect->fInTree = false;
     3772        }
     3773
    37303774        PSUPDRVNTPROTECT pChild = NULL;
    37313775        if (pNtProtect->enmProcessKind == kSupDrvNtProtectKind_StubParent)
    … …  
    37393783                uint32_t cChildRefs = ASMAtomicDecU32(&pChild->cRefs);
    37403784                if (!cChildRefs)
    3741                     pRemovedChild = (PSUPDRVNTPROTECT)RTAvlPVRemove(&g_NtProtectTree, pChild->AvlCore.Key);
     3785                {
     3786                    Assert(pChild->fInTree);
     3787                    if (pChild->fInTree)
     3788                    {
     3789                        PSUPDRVNTPROTECT pRemovedChild = (PSUPDRVNTPROTECT)RTAvlPVRemove(&g_NtProtectTree, pChild->AvlCore.Key);
     3790                        Assert(pRemovedChild == pChild);
     3791                        pChild->fInTree = false;
     3792                    }
     3793                }
    37423794                else
    37433795                    pChild = NULL;
    … …  
    37483800
    37493801        RTSpinlockRelease(g_hNtProtectLock);
    3750         Assert(pRemoved == pNtProtect);
    3751         Assert(pRemovedChild == pChild);
    37523802
    37533803        if (pNtProtect->pCsrssProcess)
    … …  
    39774027               little overly paranoid as I think we can safely trust the
    39784028               system process... */
    3979             if (   cSystemProcessHandles < (g_uNtVerCombined >= SUP_MAKE_NT_VER_SIMPLE(6, 3) ? 2 : 1)
     4029            if (   cSystemProcessHandles < (g_uNtVerCombined >= SUP_MAKE_NT_VER_SIMPLE(6, 3) ? UINT32_C(2) : UINT32_C(1))
    39804030                && pHandleInfo->UniqueProcessId == PsGetProcessId(PsInitialSystemProcess))
    39814031            {
Note: See TracChangeset for help on using the changeset viewer.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette