From 28373a9f842e87f299f8eb1707f9bf8629c511fd Mon Sep 17 00:00:00 2001 From: Ahmed Arif Date: Mon, 27 Jul 2026 14:48:33 +0200 Subject: [PATCH] [NTOS:IO] Do not free the active VPB (#9343) IopDereferenceVpbAndFree frees a zero-reference VPB only while it is still installed in RealDevice->Vpb. This can leave the device with a dangling VPB pointer while detached VPBs are retained. Reverse the identity test so only a detached, nonpersistent VPB is released after its reference count reaches zero. Reference: - https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/ns-wdm-_vpb --- ntoskrnl/io/iomgr/volume.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ntoskrnl/io/iomgr/volume.c b/ntoskrnl/io/iomgr/volume.c index f5164fe412b..199b340a97b 100644 --- a/ntoskrnl/io/iomgr/volume.c +++ b/ntoskrnl/io/iomgr/volume.c @@ -192,7 +192,7 @@ IopDereferenceVpbAndFree(IN PVPB Vpb) Vpb->ReferenceCount--; /* Check if we're out of references */ - if (!Vpb->ReferenceCount && Vpb->RealDevice->Vpb == Vpb && + if (!Vpb->ReferenceCount && Vpb->RealDevice->Vpb != Vpb && !(Vpb->Flags & VPB_PERSISTENT)) { /* Release VPB lock */