Microsoft/Windows2000
Microsoft/Windows2000
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
45f4a58588
Windows2000/private/ntos/ps/psdelete.c
Microsoft 45f4a58588 First commit
2020-09-30 17:12:32 +02:00

1058 lines
37 KiB
C
Raw Blame History

/*++
Copyright (c) 1989 Microsoft Corporation
Module Name:
psdelete.c
Abstract:
This module implements process and thread object termination and deletion.
Author:
Mark Lucovsky (markl) 01-May-1989
--*/
#include "psp.h"
#ifdef ALLOC_PRAGMA
#pragma alloc_text(PAGE, PspTerminateThreadByPointer)
#pragma alloc_text(PAGE, PspTerminateProcess)
#pragma alloc_text(PAGE, NtTerminateProcess)
#pragma alloc_text(PAGE, NtTerminateThread)
#pragma alloc_text(PAGE, PspNullSpecialApc)
#pragma alloc_text(PAGE, PspExitNormalApc)
#pragma alloc_text(PAGE, PspExitProcess)
#pragma alloc_text(PAGE, PspProcessDelete)
#pragma alloc_text(PAGE, PspThreadDelete)
#pragma alloc_text(PAGE, NtRegisterThreadTerminatePort)
#pragma alloc_text(PAGE, PspExitThread)
#pragma alloc_text(PAGE, PsExitSpecialApc)
#pragma alloc_text(PAGE, PsGetProcessExitTime)
#pragma alloc_text(PAGE, PsSetLegoNotifyRoutine)
#endif
PLEGO_NOTIFY_ROUTINE PspLegoNotifyRoutine;
ULONG PsSetLegoNotifyRoutine(PLEGO_NOTIFY_ROUTINE LegoNotifyRoutine)
{
PAGED_CODE();
PspLegoNotifyRoutine = LegoNotifyRoutine;
return FIELD_OFFSET(KTHREAD,LegoData);
}
VOID PspReaper(IN PVOID Context)
/*++
Routine Description:
This routine implements the thread reaper. The reaper is responsible for processing terminated threads. This includes:
- deallocating their kernel stacks
- releasing their process' CreateDelete lock
- dereferencing their process
- dereferencing themselves
Arguments:
Context - NOT USED
--*/
{
PLIST_ENTRY NextEntry;
KIRQL OldIrql, OldIrql2;
PETHREAD Thread;
PEPROCESS Process;
// Lock the dispatcher data and continually remove entries from the reaper list until no more entries exist.
// N.B. The dispatcher database lock is used to synchronize access to the reaper list. This is done to avoid a race condition with the thread termination code.
KiLockDispatcherDatabase(&OldIrql);
NextEntry = PsReaperListHead.Flink;
while (NextEntry != &PsReaperListHead)
{
// Remove the next thread from the reaper list, get the address of the executive thread object, acquire the context swap lock, and then release the both the context swap dispatcher database locks.
// N.B. The context swap lock is acquired and immediately released.
// This is necessary to ensure that the respective thread has completely passed through the context switch code before it is terminated.
RemoveEntryList(NextEntry);
Thread = CONTAINING_RECORD(NextEntry, ETHREAD, TerminationPortList);
KiLockContextSwap(&OldIrql2);
KiUnlockContextSwap(OldIrql2);
KiUnlockDispatcherDatabase(OldIrql);
// Get the address of the executive process object, release the process' CreateDelete lock and then dereference the process object.
Process = THREAD_TO_PROCESS(Thread);
// Delete the kernel stack and dereference the thread.
MmDeleteKernelStack(Thread->Tcb.StackBase,(BOOLEAN)Thread->Tcb.LargeStack);
Thread->Tcb.InitialStack = NULL;
ObDereferenceObject(Thread);
// Lock the dispatcher database and get the address of the next entry in the list.
KiLockDispatcherDatabase(&OldIrql);
NextEntry = PsReaperListHead.Flink;
}
// Set the reaper not active and unlock the dispatcher database.
PsReaperActive = FALSE;
KiUnlockDispatcherDatabase(OldIrql);
}
NTSTATUS PspTerminateThreadByPointer(IN PETHREAD Thread, IN NTSTATUS ExitStatus)
/*++
Routine Description:
This function causes the specified thread to terminate.
Arguments:
ThreadHandle - Supplies a referenced pointer to the thread to terminate.
ExitStatus - Supplies the exit status associated with the thread.
Return Value:
TBD
--*/
{
PKAPC ExitApc;
PAGED_CODE();
if ( Thread == PsGetCurrentThread() ) {
ObDereferenceObject(Thread);
PspExitThread(ExitStatus);
// Never Returns
} else {
ExitApc = ExAllocatePool(NonPagedPool,(ULONG)sizeof(KAPC));
if ( !ExitApc ) {
return STATUS_INSUFFICIENT_RESOURCES;
}
KeInitializeApc(ExitApc, &Thread->Tcb, OriginalApcEnvironment, PsExitSpecialApc, NULL, PspExitNormalApc, KernelMode, ULongToPtr(ExitStatus) // Sundown: ExitStatus is zero-extended.
);
if ( !KeInsertQueueApc(ExitApc,ExitApc,NULL, 2) ) {
ExFreePool(ExitApc);
return STATUS_UNSUCCESSFUL;
}
}
return STATUS_SUCCESS;
}
NTSTATUS NtTerminateProcess(IN HANDLE ProcessHandle OPTIONAL, IN NTSTATUS ExitStatus)
/*++
Routine Description:
This function causes the specified process and all of its threads to terminate.
Arguments:
ProcessHandle - Supplies a handle to the process to terminate.
ExitStatus - Supplies the exit status associated with the process.
Return Value:
TBD
--*/
{
PETHREAD Thread,Self;
PEPROCESS Process;
PLIST_ENTRY Next;
NTSTATUS st,xst;
BOOLEAN ProcessHandleSpecified;
PAGED_CODE();
Self = PsGetCurrentThread();
if ( ARGUMENT_PRESENT(ProcessHandle) ) {
ProcessHandleSpecified = TRUE;
} else {
ProcessHandleSpecified = FALSE;
ProcessHandle = NtCurrentProcess();
}
st = ObReferenceObjectByHandle(ProcessHandle, PROCESS_TERMINATE, PsProcessType, KeGetPreviousMode(), (PVOID *)&Process, NULL);
if ( !NT_SUCCESS(st) ) {
return(st);
}
// If the exit status is DBG_TERMINATE_PROCESS, then fail the terminate if the process is being debugged.
// This is for shutdown so that we can kill debuggers and not debuggees reliably
if ( ExitStatus == DBG_TERMINATE_PROCESS && Process != PsGetCurrentProcess() ) {
if ( Process->DebugPort ) {
ObDereferenceObject( Process );
return STATUS_ACCESS_DENIED;
} else {
ExitStatus = STATUS_SUCCESS;
}
}
st = STATUS_SUCCESS;
// the following allows NtTerminateProcess to fail properly if called while the exiting process is blocked holding the createdeletelock.
// This can happen during debugger/server lpc transactions that occur in pspexitthread
xst = PsLockProcess(Process,KernelMode,PsLockPollOnTimeout);
if ( xst != STATUS_SUCCESS ) {
ObDereferenceObject( Process );
return STATUS_PROCESS_IS_TERMINATING;
}
Next = Process->ThreadListHead.Flink;
while ( Next != &Process->ThreadListHead)
{
Thread = (PETHREAD)(CONTAINING_RECORD(Next,ETHREAD,ThreadListEntry));
if ( Thread != Self ) {
if ( IS_SYSTEM_THREAD(Thread) ) {
ObDereferenceObject(Process);
PsUnlockProcess(Process);
return STATUS_INVALID_PARAMETER;
}
if ( !Thread->HasTerminated ) {
Thread->HasTerminated = TRUE;
PspTerminateThreadByPointer(Thread, ExitStatus);
KeForceResumeThread(&Thread->Tcb);
}
}
Next = Next->Flink;
}
if ( Process == PsGetCurrentProcess() && ProcessHandleSpecified ) {
Self->HasTerminated = TRUE;
// early set of process exit time will eliminate the deadlocks that occur when csrss tries to create a remote thread in a
// process that is in the process of exiting, and that has an unhandled exit call outstanding to its debugger
KeQuerySystemTime(&Process->ExitTime);
PsUnlockProcess(Process);
ObDereferenceObject(Process);
PspExitThread(ExitStatus);
// Never Returns
}
// early set of process exit time will eliminate the deadlocks
// that occur when csrss tries to create a remote thread in a process that is in the process of exiting, and that has an unhandled exit call outstanding to its debugger
if (ProcessHandleSpecified) {
KeQuerySystemTime(&Process->ExitTime);
}
PsUnlockProcess(Process);
ObDereferenceObject(Process);
return st;
}
NTSTATUS PspTerminateProcess(PEPROCESS Process, NTSTATUS Status, PSLOCKPROCESSMODE LockMode)
/*++
Routine Description:
This function causes the specified process and all of its threads to terminate.
Arguments:
ProcessHandle - Supplies a handle to the process to terminate.
ExitStatus - Supplies the exit status associated with the process.
Return Value:
TBD
--*/
{
PETHREAD Thread;
PLIST_ENTRY Next;
NTSTATUS st;
PAGED_CODE();
if ( Process == PsGetCurrentProcess() ) {
return STATUS_INVALID_PARAMETER;
}
// the following allows NtTerminateProcess to fail properly if called while the exiting process is blocked holding the createdeletelock.
// This can happen during debugger/server lpc transactions that occur in pspexitthread
st = PsLockProcess(Process,KernelMode,LockMode);
if ( st != STATUS_SUCCESS ) {
return st;
}
Next = Process->ThreadListHead.Flink;
while ( Next != &Process->ThreadListHead)
{
Thread = (PETHREAD)(CONTAINING_RECORD(Next,ETHREAD,ThreadListEntry));
if ( IS_SYSTEM_THREAD(Thread) ) {
ObDereferenceObject(Process);
PsUnlockProcess(Process);
return STATUS_INVALID_PARAMETER;
}
if ( !Thread->HasTerminated ) {
Thread->HasTerminated = TRUE;
PspTerminateThreadByPointer(Thread, Status);
KeForceResumeThread(&Thread->Tcb);
}
Next = Next->Flink;
}
PsUnlockProcess(Process);
return STATUS_SUCCESS;
}
NTSTATUS NtTerminateThread(IN HANDLE ThreadHandle OPTIONAL, IN NTSTATUS ExitStatus)
/*++
Routine Description:
This function causes the specified thread to terminate.
Arguments:
ThreadHandle - Supplies a handle to the thread to terminate.
ExitStatus - Supplies the exit status associated with the thread.
Return Value:
TBD
--*/
{
PETHREAD Thread;
NTSTATUS st;
PAGED_CODE();
if ( !ARGUMENT_PRESENT(ThreadHandle) ) {
if ( (PsGetCurrentProcess()->ThreadListHead.Flink == PsGetCurrentProcess()->ThreadListHead.Blink) &&
(PsGetCurrentProcess()->ThreadListHead.Flink == &PsGetCurrentThread()->ThreadListEntry))
{
return( STATUS_CANT_TERMINATE_SELF );
} else {
ThreadHandle = NtCurrentThread();
}
}
st = ObReferenceObjectByHandle(ThreadHandle, THREAD_TERMINATE, PsThreadType, KeGetPreviousMode(), (PVOID *)&Thread, NULL);
if ( !NT_SUCCESS(st) ) {
return(st);
}
if ( IS_SYSTEM_THREAD(Thread) ) {
ObDereferenceObject(Thread);
return STATUS_INVALID_PARAMETER;
}
if ( Thread != PsGetCurrentThread() ) {
if (!Thread->HasTerminated) {
PsLockProcess(THREAD_TO_PROCESS(Thread),KernelMode,PsLockWaitForever);
Thread->HasTerminated = TRUE;
st = PspTerminateThreadByPointer(Thread,ExitStatus);
if ( NT_SUCCESS(st) ) {
KeForceResumeThread(&Thread->Tcb);
}
PsUnlockProcess(THREAD_TO_PROCESS(Thread));
}
} else {
Thread->HasTerminated = TRUE;
PspTerminateThreadByPointer(Thread,ExitStatus);
}
ObDereferenceObject(Thread);
return st;
}
NTSTATUS PsTerminateSystemThread(IN NTSTATUS ExitStatus)
/*++
Routine Description:
This function causes the current thread, which must be a system thread, to terminate.
Arguments:
ExitStatus - Supplies the exit status associated with the thread.
--*/
{
PETHREAD Thread = PsGetCurrentThread();
if ( !IS_SYSTEM_THREAD(Thread) ) {
return STATUS_INVALID_PARAMETER;
}
Thread->HasTerminated = TRUE;
PspExitThread(ExitStatus);
}
VOID PspNullSpecialApc(IN PKAPC Apc, IN PKNORMAL_ROUTINE *NormalRoutine, IN PVOID *NormalContext, IN PVOID *SystemArgument1, IN PVOID *SystemArgument2)
{
PAGED_CODE();
UNREFERENCED_PARAMETER(NormalContext);
UNREFERENCED_PARAMETER(SystemArgument1);
UNREFERENCED_PARAMETER(SystemArgument2);
if ( PsGetCurrentThread()->HasTerminated ) {
*NormalRoutine = NULL;
}
ExFreePool(Apc);
}
VOID PsExitSpecialApc(IN PKAPC Apc, IN PKNORMAL_ROUTINE *NormalRoutine, IN PVOID *NormalContext, IN PVOID *SystemArgument1, IN PVOID *SystemArgument2)
{
NTSTATUS ExitStatus;
PAGED_CODE();
UNREFERENCED_PARAMETER(NormalRoutine);
UNREFERENCED_PARAMETER(NormalContext);
UNREFERENCED_PARAMETER(SystemArgument1);
UNREFERENCED_PARAMETER(SystemArgument2);
if ( Apc->SystemArgument2 ) {
ExitStatus = (NTSTATUS)((LONG_PTR)Apc->NormalContext);
ExFreePool(Apc);
PspExitThread(ExitStatus);
}
}
VOID PspExitNormalApc(IN PVOID NormalContext, IN PVOID SystemArgument1, IN PVOID SystemArgument2)
{
PETHREAD Thread;
PKAPC ExitApc;
NTSTATUS ExitStatus;
PAGED_CODE();
Thread = PsGetCurrentThread();
if ( SystemArgument2 ) {
KeBugCheck(0x12345678);
}
ExitApc = (PKAPC) SystemArgument1;
if ( IS_SYSTEM_THREAD(Thread) ) {
ExitStatus = (NTSTATUS)((LONG_PTR)ExitApc->NormalContext);
ExFreePool(ExitApc);
PspExitThread(ExitStatus);
} else {
KeInitializeApc(ExitApc, &Thread->Tcb, OriginalApcEnvironment, PsExitSpecialApc, NULL, PspExitNormalApc, UserMode, NormalContext);
if ( !KeInsertQueueApc(ExitApc,ExitApc,(PVOID) 1, 2) ) {
ExFreePool(ExitApc);
}
KeForceResumeThread(&Thread->Tcb);
}
}
BOOLEAN PspMarkCidInvalid(IN PHANDLE_TABLE_ENTRY HandleEntry, IN ULONG_PTR Parameter)
{
HandleEntry->Object = (PVOID)Parameter;
return TRUE;
}
DECLSPEC_NORETURN VOID PspExitThread(IN NTSTATUS ExitStatus)
/*++
Routine Description:
This function causes the currently executing thread to terminate.
This function is only called from within the process structure.
It is called either from mainline exit code to exit the current thread, or from PsExitSpecialApc (as a piggyback to user-mode PspExitNormalApc).
Arguments:
ExitStatus - Supplies the exit status associated with the current thread.
--*/
{
PETHREAD Thread;
PEPROCESS Process;
PKAPC Apc;
PLIST_ENTRY FirstEntry;
PLIST_ENTRY NextEntry;
PTERMINATION_PORT TerminationPort;
LPC_CLIENT_DIED_MSG CdMsg;
BOOLEAN LastThread;
PAGED_CODE();
Thread = PsGetCurrentThread();
Process = THREAD_TO_PROCESS(Thread);
if (KeIsAttachedProcess()) {
KeBugCheckEx(INVALID_PROCESS_ATTACH_ATTEMPT, (ULONG_PTR) Process, (ULONG_PTR) Thread->Tcb.ApcState.Process, (ULONG) Thread->Tcb.ApcStateIndex, (ULONG_PTR) Thread);
}
KeLowerIrql(PASSIVE_LEVEL);
if (Thread->Tcb.Priority < LOW_REALTIME_PRIORITY) {
KeSetPriorityThread(&Thread->Tcb, LOW_REALTIME_PRIORITY);
}
PoRundownThread(Thread);// Clear any execution state associated with the thread
// Account for a miss where we try to freeze a thread and bump the freeze count, but in the freeze APC we bail from the APC due to the pending exit APC.
// This results in an active thread running with a biased freeze count and no pending APC.
// When this sort of thread tries to grab the process lock, it ends of spinning since it things a freeze is pending and an APC should occur.
// Wait mode of UserMode allows the kernel stack to page out if necessary
PsLockProcess(Process, UserMode, PsLockIAmExiting);
KeForceResumeThread(&Thread->Tcb);
// Notify registered callout routines of thread deletion.
if (PspCreateThreadNotifyRoutineCount != 0) {
ULONG i;
for (i = 0; i < PSP_MAX_CREATE_THREAD_NOTIFY; i++) {
if (PspCreateThreadNotifyRoutine[i] != NULL) {
(*PspCreateThreadNotifyRoutine[i])(Process->UniqueProcessId, Thread->Cid.UniqueThread, FALSE);
}
}
}
LastThread = FALSE;
if ((Process->ThreadListHead.Flink == Process->ThreadListHead.Blink) && (Process->ThreadListHead.Flink == &Thread->ThreadListEntry)) {
LastThread = TRUE;
if (ExitStatus == STATUS_THREAD_IS_TERMINATING) {
if (Process->ExitStatus == STATUS_PENDING) {
Process->ExitStatus = Process->LastThreadExitStatus;
}
} else {
Process->ExitStatus = ExitStatus;
}
DbgkExitProcess(ExitStatus);
} else {
if (ExitStatus != STATUS_THREAD_IS_TERMINATING) {
Process->LastThreadExitStatus = ExitStatus;
}
DbgkExitThread(ExitStatus);
}
KeLeaveCriticalRegion();
ASSERT(Thread->Tcb.KernelApcDisable == 0);
Thread->Tcb.KernelApcDisable = 0;
// Process the TerminationPortList
if (!IsListEmpty(&Thread->TerminationPortList)) {
CdMsg.PortMsg.u1.s1.DataLength = sizeof(LARGE_INTEGER);
CdMsg.PortMsg.u1.s1.TotalLength = sizeof(LPC_CLIENT_DIED_MSG);
CdMsg.PortMsg.u2.s2.Type = LPC_CLIENT_DIED;
CdMsg.PortMsg.u2.s2.DataInfoOffset = 0;
while (!IsListEmpty(&Thread->TerminationPortList)) {
NextEntry = RemoveHeadList(&Thread->TerminationPortList);
TerminationPort = CONTAINING_RECORD(NextEntry, TERMINATION_PORT, Links);
CdMsg.CreateTime.QuadPart = PS_GET_THREAD_CREATE_TIME(Thread);
LpcRequestPort(TerminationPort->Port, (PPORT_MESSAGE) &CdMsg);
ObDereferenceObject(TerminationPort->Port);
ExFreePool(TerminationPort);
}
} else {
// If there are no ports to send notifications to, but there is an exception port, then we have to send a client died message through the exception port.
// This will allow a server a chance to get notification if an app/thread dies before it even starts
// We only send the exception if the thread creation really worked.
// DeadThread is set when an NtCreateThread returns an error, but the thread will actually execute this path.
// If DeadThread is not set than the thread creation succeeded.
// The other place DeadThread is set is when we were terminated without having any chance to move.
// in this case, DeadThread is set and the exit status is set to STATUS_THREAD_IS_TERMINATING
if ((ExitStatus == STATUS_THREAD_IS_TERMINATING && Thread->DeadThread) || !Thread->DeadThread) {
CdMsg.PortMsg.u1.s1.DataLength = sizeof(LARGE_INTEGER);
CdMsg.PortMsg.u1.s1.TotalLength = sizeof(LPC_CLIENT_DIED_MSG);
CdMsg.PortMsg.u2.s2.Type = LPC_CLIENT_DIED;
CdMsg.PortMsg.u2.s2.DataInfoOffset = 0;
if (PsGetCurrentProcess()->ExceptionPort) {
CdMsg.CreateTime.QuadPart = PS_GET_THREAD_CREATE_TIME(Thread);
LpcRequestPort(PsGetCurrentProcess()->ExceptionPort, (PPORT_MESSAGE) &CdMsg);
}
}
}
// rundown the Win32 structures
if (Thread->Tcb.Win32Thread) {
(PspW32ThreadCallout) (Thread, PsW32ThreadCalloutExit);
}
if (LastThread && Process->Win32Process) {
(PspW32ProcessCallout) (Process, FALSE);
}
// User/Gdi has been given a chance to clean up.
// Now make sure they didn't leave the kernel stack locked which would happen if data was still live on this stack, but was being used by another thread
if (!Thread->Tcb.EnableStackSwap) {
KeBugCheckEx(KERNEL_STACK_LOCKED_AT_EXIT, 0, 0, 0, 0);
}
// Delete the thread's TEB. If the address of the TEB is in user space, then this is a real user mode TEB.
// If the address is in system space, then this is a special system thread TEB allocated from paged or nonpaged pool.
if (Thread->Tcb.Teb) {
if (IS_SYSTEM_THREAD(Thread)) {
ExFreePool(Thread->Tcb.Teb);
} else {
// The thread is a user-mode thread. Look to see if the thread owns the loader lock (and any other key peb-based critical sections.
// If so, do our best to release the locks.
// Since the LoaderLock used to be a mutant, releasing the lock like this is very similar to mutant abandonment and the loader never did anything with abandoned status anyway
try {
PTEB Teb;
PPEB Peb;
PRTL_CRITICAL_SECTION Cs;
int DecrementCount;
Teb = Thread->Tcb.Teb;
Peb = Process->Peb;
Cs = Peb->LoaderLock;
if (Cs) {
ProbeForRead(Cs, sizeof(*Cs), 4);
if (Cs->OwningThread == Thread->Cid.UniqueThread) {
// x86 uses a 1 based recursion count
#if defined(_X86_)
DecrementCount = Cs->RecursionCount;
#else
DecrementCount = Cs->RecursionCount + 1;
#endif
Cs->RecursionCount = 0;
Cs->OwningThread = 0;
// undo lock count increments for recursion cases
while (DecrementCount > 1){
InterlockedDecrement(&Cs->LockCount);
DecrementCount--;
}
// undo final lock count
if (InterlockedDecrement(&Cs->LockCount) >= 0){
NtSetEvent(Cs->LockSemaphore, NULL);
}
}
// if the thread exited while waiting on the loader lock clean it up.
// There is still a potential race here since we can not safely know what happens to a thread after it interlocked increments the lock count but before it sets the waiting on loader lock flag.
// On the release side, it it safe since we mark ownership of the lock before clearing the flag.
// This triggers the first part of this test.
// The only thing out of whack is the recursion count, but this is also safe since in this state, recursion count is 0.
else if ( Teb->WaitingOnLoaderLock ) {
// This code isn't right. We need to bump down our lock count increment.
// A few cases to consider:
// Another thread releases the lock signals the event.
// We take the wait and then die before setting our ID.
// I doubt very much that this can happen because right after we come out of the wait, we set the owner Id (meaning that we would go through the other part of the if).
// Bottom line is that we should just decrement our lock count and get out of the way.
// There is no need to set the event.
// In the RAS stress failure, I saw us setting the event just because the lock count was >= 0.
// The lock was already held by another thread so setting the event let yet another thread also own the lock.
// Last one to release would get a not owner critical section failure
// if ( InterlockedDecrement(&Cs->LockCount) >= 0 ){
// NtSetEvent(Cs->LockSemaphore,NULL);
// }
InterlockedDecrement(&Cs->LockCount);
}
}
#if defined(_WIN64)
if (Process->Wow64Process) {
// Do the same thing for the 32-bit PEB->Ldr
PRTL_CRITICAL_SECTION32 Cs32;
PPEB32 Peb32;
Peb32 = Process->Wow64Process->Wow64;
Cs32 = (PRTL_CRITICAL_SECTION32) ULongToPtr(Peb32->LoaderLock);
if (Cs32) {
ProbeForRead(Cs32, sizeof(*Cs32), 4);
if (Cs32->OwningThread == PtrToUlong(Thread->Cid.UniqueThread)) {
// x86 uses a 1 based recursion count, so the IA64 kernel needs to do the same, since the critsect is really implemented by IA32 usermode.
DecrementCount = Cs32->RecursionCount;
Cs32->RecursionCount = 0;
Cs32->OwningThread = 0;
// undo lock count increments for recursion cases
while (DecrementCount > 1) {
InterlockedDecrement(&Cs32->LockCount);
DecrementCount--;
}
// undo final lock count
if (InterlockedDecrement(&Cs32->LockCount) >= 0){
NtSetEvent(LongToHandle(Cs32->LockSemaphore), NULL);
}
} else {
PTEB32 Teb32 = WOW64_GET_TEB32(Teb);
ProbeForRead(Teb32, sizeof(*Teb32), 4);
if (Teb32->WaitingOnLoaderLock) {
InterlockedDecrement(&Cs32->LockCount);
}
}
}
}
#endif
} except(EXCEPTION_EXECUTE_HANDLER) {
}
#if defined(_WIN64)
if (Process->Wow64Process) {
// Free the 32 bit Teb
try {
PVOID BaseAddress;
SIZE_T RegionSize;
BaseAddress = *(PVOID *) WOW64_TEB32_POINTER_ADDRESS(((PTEB) Thread->Tcb.Teb));// Get the TEB32 pointer
// Free it. ZwFreeVirtualMemory will probe the address for us, ensuring that it is in usermode memory.
RegionSize = PAGE_SIZE;
ZwFreeVirtualMemory(NtCurrentProcess(), &BaseAddress, &RegionSize, MEM_RELEASE);
} except(EXCEPTION_EXECUTE_HANDLER) {
}
}
#endif
MmDeleteTeb(Process, Thread->Tcb.Teb);
Thread->Tcb.Teb = NULL;
}
}
// Rundown The Lists:
// - Cancel Io By Thread
// - Cancel Timers
// - Cancel Registry Notify Requests pending against this thread
// - Perform kernel thread rundown
IoCancelThreadIo(Thread);
ExTimerRundown();
CmNotifyRunDown(Thread);
KeRundownThread();
// delete the Client Id and decrement the reference count for it.
if (!(ExChangeHandle(PspCidTable, Thread->Cid.UniqueThread, PspMarkCidInvalid, PSP_INVALID_ID))) {
KeBugCheck(CID_HANDLE_DELETION);
}
ObDereferenceObject(Thread);
// Let LPC component deal with message stack in Thread->LpcReplyMessage but do it after the client ID becomes invalid.
LpcExitThread(Thread);
// If this is the last thread in the process, then clean the address space
if ( LastThread ) {
if (!(ExChangeHandle(PspCidTable,Process->UniqueProcessId, PspMarkCidInvalid, PSP_INVALID_ID))) {
KeBugCheck(CID_HANDLE_DELETION);
}
KeQuerySystemTime(&Process->ExitTime);
PspExitProcess(TRUE,Process);
}
Thread->ExitStatus = ExitStatus;
KeQuerySystemTime(&Thread->ExitTime);
RemoveEntryList(&Thread->ThreadListEntry);
KeEnterCriticalRegion();
Thread->ThreadListEntry.Flink = NULL;
Thread->ThreadListEntry.Blink = NULL;
PsUnlockProcess(Process);
ASSERT(Thread->Tcb.KernelApcDisable == 0);
if (LastThread) {
// can not hold the process lock while running down the object table since this can lead to a delete routine, which will need the job lock, BUT our lock ordering is always joblock -> processlock
ObKillProcess(TRUE, Process);
if (Process->Job) {
// Now we can fold the process accounting into the job. Don't need to wait for the delete routine.
PspExitProcessFromJob(Process->Job, Process);
}
KeSetProcess(&Process->Pcb, 0, FALSE);
}
(VOID) KeDisableApcQueuingThread(&Thread->Tcb);// Rundown pending APCs
// flush user-mode APC queue
FirstEntry = KeFlushQueueApc(&Thread->Tcb,UserMode);
if ( FirstEntry ) {
NextEntry = FirstEntry;
do {
Apc = CONTAINING_RECORD(NextEntry, KAPC, ApcListEntry);
NextEntry = NextEntry->Flink;
// If the APC has a rundown routine then call it. Otherwise deallocate the APC
if (Apc->RundownRoutine) {
(Apc->RundownRoutine)(Apc);
} else {
ExFreePool(Apc);
}
} while (NextEntry != FirstEntry);
}
if (LastThread) {
MmCleanProcessAddressSpace();
}
if (Thread->Tcb.LegoData && PspLegoNotifyRoutine) {
(PspLegoNotifyRoutine) (&Thread->Tcb);
}
// flush kernel-mode APC queue
// There should never be any kernel mode APCs found this far into thread termination.
// Since we go to PASSIVE_LEVEL upon entering exit.
FirstEntry = KeFlushQueueApc(&Thread->Tcb,KernelMode);
if ( FirstEntry ) {
KeBugCheckEx(KERNEL_APC_PENDING_DURING_EXIT, (ULONG_PTR)FirstEntry, (ULONG_PTR)Thread->Tcb.KernelApcDisable, (ULONG_PTR)KeGetCurrentIrql(), 0);
}
// Terminate the thread.
// N.B. There is no return from this call.
// N.B. The kernel inserts the current thread in the reaper list and activates a thread, if necessary, to reap the terminating thread.
KeTerminateThread(0L);
}
VOID PspExitProcess(IN BOOLEAN TrimAddressSpace, IN PEPROCESS Process)
{
ULONG ActualTime;
PAGED_CODE();
if (!Process->ExitProcessCalled && PspCreateProcessNotifyRoutineCount != 0) {
ULONG i;
for (i=0; i<PSP_MAX_CREATE_PROCESS_NOTIFY; i++) {
if (PspCreateProcessNotifyRoutine[i] != NULL) {
(*PspCreateProcessNotifyRoutine[i])( Process->InheritedFromUniqueProcessId, Process->UniqueProcessId, FALSE);
}
}
}
Process->ExitProcessCalled = TRUE;
PoRundownProcess(Process);
// If the process is on the active list, remove it now. Must be done before ObKill due to code in ex\sysinfo that references the process through the handle table
if ( Process->ActiveProcessLinks.Flink != NULL && Process->ActiveProcessLinks.Blink != NULL ) {
ExAcquireFastMutex(&PspActiveProcessMutex);
RemoveEntryList(&Process->ActiveProcessLinks);
Process->ActiveProcessLinks.Flink = NULL;
Process->ActiveProcessLinks.Blink = NULL;
ExReleaseFastMutex(&PspActiveProcessMutex);
}
if (Process->SecurityPort) {
ObDereferenceObject(Process->SecurityPort);
Process->SecurityPort = NULL ;
}
if ( TrimAddressSpace ) {
// If the current process has previously set the timer resolution, then reset it.
if (Process->SetTimerResolution != FALSE) {
ZwSetTimerResolution(KeMaximumIncrement, FALSE, &ActualTime);
}
if ( Process->Job
&& Process->Job->CompletionPort
&& !(Process->JobStatus & PS_JOB_STATUS_NOT_REALLY_ACTIVE)
&& !(Process->JobStatus & PS_JOB_STATUS_EXIT_PROCESS_REPORTED))
{
ULONG_PTR ExitMessageId;
switch (Process->ExitStatus)
{
case STATUS_GUARD_PAGE_VIOLATION:
case STATUS_DATATYPE_MISALIGNMENT:
case STATUS_BREAKPOINT:
case STATUS_SINGLE_STEP:
case STATUS_ACCESS_VIOLATION:
case STATUS_IN_PAGE_ERROR:
case STATUS_ILLEGAL_INSTRUCTION:
case STATUS_NONCONTINUABLE_EXCEPTION:
case STATUS_INVALID_DISPOSITION:
case STATUS_ARRAY_BOUNDS_EXCEEDED:
case STATUS_FLOAT_DENORMAL_OPERAND:
case STATUS_FLOAT_DIVIDE_BY_ZERO:
case STATUS_FLOAT_INEXACT_RESULT:
case STATUS_FLOAT_INVALID_OPERATION:
case STATUS_FLOAT_OVERFLOW:
case STATUS_FLOAT_STACK_CHECK:
case STATUS_FLOAT_UNDERFLOW:
case STATUS_INTEGER_DIVIDE_BY_ZERO:
case STATUS_INTEGER_OVERFLOW:
case STATUS_PRIVILEGED_INSTRUCTION:
case STATUS_STACK_OVERFLOW:
case STATUS_CONTROL_C_EXIT:
case STATUS_FLOAT_MULTIPLE_FAULTS:
case STATUS_FLOAT_MULTIPLE_TRAPS:
case STATUS_REG_NAT_CONSUMPTION:
ExitMessageId = JOB_OBJECT_MSG_ABNORMAL_EXIT_PROCESS;
break;
default:
ExitMessageId = JOB_OBJECT_MSG_EXIT_PROCESS;
break;
}
PS_SET_CLEAR_BITS(&Process->JobStatus, PS_JOB_STATUS_EXIT_PROCESS_REPORTED, PS_JOB_STATUS_LAST_REPORT_MEMORY);
ExAcquireFastMutex(&Process->Job->MemoryLimitsLock);
if (Process->Job->CompletionPort != NULL) {
IoSetIoCompletion(Process->Job->CompletionPort, Process->Job->CompletionKey, (PVOID) Process->UniqueProcessId, STATUS_SUCCESS, ExitMessageId, FALSE);
}
ExReleaseFastMutex(&Process->Job->MemoryLimitsLock);
}
} else {
KeSetProcess(&Process->Pcb, 0, FALSE);
ObKillProcess(FALSE, Process);
MmCleanProcessAddressSpace();
}
}
VOID PspProcessDelete(IN PVOID Object)
{
PEPROCESS Process;
ULONG AddressSpace;
KAPC_STATE ApcState;
PAGED_CODE();
Process = (PEPROCESS) Object;
if (SeDetailedAuditing && Process->Token != NULL) {
SeAuditProcessExit(Process);
}
if (Process->Job) {
PspRemoveProcessFromJob(Process->Job, Process);
ObDereferenceObject(Process->Job);
}
KeTerminateProcess((PKPROCESS) Process);
AddressSpace = (ULONG) ((PHARDWARE_PTE) (&(Process->Pcb.DirectoryTableBase[0])))->PageFrameNumber;
if (Process->DebugPort) {
ObDereferenceObject(Process->DebugPort);
}
if (Process->ExceptionPort) {
ObDereferenceObject(Process->ExceptionPort);
}
if (Process->UniqueProcessId) {
if (!(ExDestroyHandle(PspCidTable, Process->UniqueProcessId, NULL))) {
KeBugCheck(CID_HANDLE_DELETION);
}
}
PspDeleteLdt(Process);
PspDeleteVdmObjects(Process);
if (AddressSpace) {
// Clean address space of the process
KeStackAttachProcess(&Process->Pcb, &ApcState);
PspExitProcess(FALSE, Process);
KeUnstackDetachProcess(&ApcState);
}
PspDeleteProcessSecurity(Process);
if (AddressSpace) {
MmDeleteProcessAddressSpace(Process);
}
#if DEVL
if (Process->WorkingSetWatch) {
ExFreePool(Process->WorkingSetWatch);
}
#endif // DEVL
PERFINFO_PROCESS_DELETE(Process);
ObDereferenceDeviceMap(Process);
PspDereferenceQuota(Process);
}
VOID PspThreadDelete(IN PVOID Object)
{
PETHREAD Thread;
PEPROCESS Process;
PAGED_CODE();
Thread = (PETHREAD) Object;
PERFINFO_THREAD_DELETE(Thread);
ASSERT(Thread->Tcb.Win32Thread == NULL);
if (Thread->Tcb.InitialStack) {
MmDeleteKernelStack(Thread->Tcb.InitialStack, (BOOLEAN) Thread->Tcb.LargeStack);
}
if (Thread->Cid.UniqueThread) {
if (!(ExDestroyHandle(PspCidTable, Thread->Cid.UniqueThread, NULL))) {
KeBugCheck(CID_HANDLE_DELETION);
}
}
PspDeleteThreadSecurity(Thread);
Process = THREAD_TO_PROCESS(Thread);
if (Process) {
ObDereferenceObject(Process);
}
}
NTSTATUS NtRegisterThreadTerminatePort(IN HANDLE PortHandle)
/*++
Routine Description:
This API allows a thread to register a port to be notified upon thread termination.
Arguments:
PortHandle - Supplies an open handle to a port object that will be sent a termination message when the thread terminates.
Return Value:
TBD
--*/
{
PVOID Port;
PTERMINATION_PORT TerminationPort;
NTSTATUS st;
PAGED_CODE();
st = ObReferenceObjectByHandle (PortHandle, 0, LpcPortObjectType, KeGetPreviousMode(), (PVOID *)&Port, NULL);
if ( !NT_SUCCESS(st) ) {
return st;
}
// Catch exception and dereference port...
try {
TerminationPort = NULL;
TerminationPort = ExAllocatePoolWithQuota(PagedPool,sizeof(TERMINATION_PORT));
TerminationPort->Port = Port;
InsertTailList(&PsGetCurrentThread()->TerminationPortList,&TerminationPort->Links);
} except(EXCEPTION_EXECUTE_HANDLER) {
ObDereferenceObject(Port);
return GetExceptionCode();
}
return STATUS_SUCCESS;
}
LARGE_INTEGER PsGetProcessExitTime(VOID)
/*++
Routine Description:
This routine returns the exit time for the current process.
Return Value:
The function value is the exit time for the current process.
Note:
This routine assumes that the caller wants an error log entry within the bounds of the maximum size.
--*/
{
PAGED_CODE();
return PsGetCurrentProcess()->ExitTime;// Simply return the exit time for this process.
}
#undef PsIsThreadTerminating
BOOLEAN PsIsThreadTerminating(IN PETHREAD Thread)
/*++
Routine Description:
This routine returns TRUE if the specified thread is in the process of terminating.
Arguments:
Thread - Supplies a pointer to the thread to be checked for termination.
Return Value:
TRUE is returned if the thread is terminating, else FALSE is returned.
--*/
{
// Simply return whether or not the thread is in the process of terminating.
if (Thread->HasTerminated) {
return TRUE;
} else {
return FALSE;
}
}
Reference in New Issue View Git Blame Copy Permalink