BCryptGenRandom with paged buffer

[Tim_Roberts]

xxxxx@osr.com wrote:

I was under impression that PTEs are still considered paged, and thus the BSOD
will follow,

I was going to write a reply that started with the equivalent of “Bah! Ridiculous! How could you SAY such a thing, Mr. Shatskih!!”

But the more I thought about it, the more it caused me to wonder. PTEs are certainly pageable, I think we all know and agree that.
…
Mr. Shatskih may very well be correct. A little edge condition that I had not previously considered.

I had exactly the same initial reaction, but in fact here is an MSDN
page that confirms Maxim’s statements precisely:

http://msdn.microsoft.com/en-us/library/windows/hardware/dn614011.aspx

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

[Daniel_Terhell]

“Tim Roberts” wrote in message news:xxxxx@ntdev…

I had exactly the same initial reaction, but in fact here is an MSDN
page that confirms Maxim’s statements precisely:
http://msdn.microsoft.com/en-us/library/windows/hardware/dn614011.aspx

In any case one needs to call MmMapLockedPages* to get a new VA, so perhaps
it can be considered a moot point. MmProbeAndLockPages + MmMapLockedPages
should do the trick of making sure both the buffer and the PTEs are locked
and resident. Right ?

How about getting a non-paging OS kernel and leave all this vintage stuff
for when the server runs in “degraded mode” ?

//Daniel

[Alex_Grig]

Considering this behavior, I wonder if MmLockPagableCodeSection takes care to also lock the PTE, or if the kernel space PTEs are pagable at all.

[OSR_Community_User]

Alex Grig wrote:

The disassembly shows that when the default algorithm provider is used, BCryptGenRandom gets called from a critical region while sharing a resource lite. I think the paging must still work in that context.

Besides that the default crypto provider uses a spinlock held/released by cng!MSCryptLockRng and cng!MSCryptUnlockRng while filling a user provided buffer. So the user buffer is anyway being accessed at the DISPATCH_LEVEL.

Petr Borsodi wrote:

IMHO it is simply a bug in the CNG driver. As is apparent from the analysis the data are copied to the output buffer at the DISPATCH_LEVEL. This is obvious mistake.

So this seems to be the case.
In Win8 and 8.1 the cng.sys looks a bit redesigned compared to win7, and this bug kinda disappeared.

[Maxim_S_Shatskih]

> Mr. Shatskih may very well be correct. A little edge condition that I had not previously considered.

I’ve learned this thing (lock alone will not prohibit PFs, you need nonpaged PTEs for this) on this very forum years ago, which was IIRC told us by some respected MS’s guy.

–
Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com