Details
-
Bug
-
Resolution: Fixed
-
Critical
-
0.4.16-dev-1796-gad6cb32 https://github.com/reactos/reactos/commit/ad6cb32fa5c40e6ae7c873596d53c4fe76ece8ae
Description
The TIF_MOVESIZETRACKING hack in ENTRY_ReferenceEntryByHandle (introduced in ad6cb32fa5c40e6ae7c873596d53c4fe76ece8ae) causes kernel crashes
Backtrace:
# Child-SP RetAddr Call Site
|
00 fffff880`74ec9730 fffff880`756be181 win32k!REGION_vSyncRegion+0xa4 [C:\ReactOS\reactos\win32ss\gdi\ntgdi\region.c @ 2325] |
01 fffff880`74ec97b0 fffff880`7563ce22 win32k!REGION_LockRgn+0x31 [C:\ReactOS\reactos\win32ss\gdi\ntgdi\region.c @ 2371] |
02 fffff880`74ec97f0 fffff880`7563cbeb win32k!DceUpdateVisRgn+0x142 [C:\ReactOS\reactos\win32ss\user\ntuser\windc.c @ 243] |
03 fffff880`74ec9850 fffff880`756545df win32k!DceResetActiveDCEs+0x25b [C:\ReactOS\reactos\win32ss\user\ntuser\windc.c @ 888] |
04 fffff880`74ec98b0 fffff880`7564fb6c win32k!co_WinPosSetWindowPos+0xbaf [C:\ReactOS\reactos\win32ss\user\ntuser\winpos.c @ 2026] |
05 fffff880`74ec9c00 fffff880`75653f83 win32k!WinPosDoOwnedPopups+0x7cc [C:\ReactOS\reactos\win32ss\user\ntuser\winpos.c @ 1509] |
06 fffff880`74ec9cf0 fffff880`75618786 win32k!co_WinPosSetWindowPos+0x553 [C:\ReactOS\reactos\win32ss\user\ntuser\winpos.c @ 1889] |
07 fffff880`74eca040 fffff880`755b5dc3 win32k!DefWndDoSizeMove+0x1656 [C:\ReactOS\reactos\win32ss\user\ntuser\nonclient.c @ 615] |
08 fffff880`74eca3c0 fffff880`755b6f09 win32k!DefWndHandleSysCommand+0x173 [C:\ReactOS\reactos\win32ss\user\ntuser\defwnd.c @ 140] |
09 fffff880`74eca460 fffff880`756019e5 win32k!IntDefWindowProc+0x509 [C:\ReactOS\reactos\win32ss\user\ntuser\defwnd.c @ 714] |
0a fffff880`74eca850 fffff800`004056b8 win32k!NtUserMessageCall+0x245 [C:\ReactOS\reactos\win32ss\user\ntuser\message.c @ 2590] |
0b fffff880`74ecab30 000007ff`b20b2767 nt!KiSystemCallEntry64+0xe0 |
0c 00000000`0012e848 fffff800`00405e40 user32!NtUserMessageCall+0xa |
What happens:
- DceUpdateVisRgn tries to lock a region that isn't owned by the current process (this is the real bug that needs to be fixed!)
- REGION_LockRgn wrongfully succeeds to lock it
- REGION_vSyncRegion then tries to access the user mode region attribute, which lives in a different process and crashes
Attachments
Issue Links
- blocks
-
-
- Reopened
-