From 514aa8290fa7fc3f449389decb893d430247b65c Mon Sep 17 00:00:00 2001
From: Alex Ionescu <aionescu@gmail.com>
Date: Fri, 14 Jul 2006 02:26:44 +0000
Subject: [PATCH] - Fix a serious bug in Kernel Queues. A condition existed
 where an inserted kernel queue with a timeout would crash the system once the
 thread waiting on it had its wait aborted or completed. - Thanks a lot to
 Thomas for his brutal test application which allowed me to discover this bug
 and the bugs addressed in the previous commits (related to the wait list and
 thread scheduler list corruption).

svn path=/trunk/; revision=23057
---
 reactos/ntoskrnl/ke/kthread.c |  2 +-
 reactos/ntoskrnl/ke/queue.c   |  8 ++++++--
 reactos/ntoskrnl/ke/wait.c    | 10 +++++++---
 3 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/reactos/ntoskrnl/ke/kthread.c b/reactos/ntoskrnl/ke/kthread.c
index ec840ca99ab..5cf0762c7d1 100644
--- a/reactos/ntoskrnl/ke/kthread.c
+++ b/reactos/ntoskrnl/ke/kthread.c
@@ -764,7 +764,7 @@ KeInitializeThread(PKPROCESS Process,
     /* Initialize the Suspend Semaphore */
     KeInitializeSemaphore(&Thread->SuspendSemaphore, 0, 128);
 
-    /* FIXME OPTIMIZATION OF DOOM. DO NOT ENABLE FIXME */
+    /* Setup the timer */
     Timer = &Thread->Timer;
     KeInitializeTimer(Timer);
     TimerWaitBlock = &Thread->WaitBlock[TIMER_WAIT_BLOCK];
diff --git a/reactos/ntoskrnl/ke/queue.c b/reactos/ntoskrnl/ke/queue.c
index 91f213d4f22..7709d0832e8 100644
--- a/reactos/ntoskrnl/ke/queue.c
+++ b/reactos/ntoskrnl/ke/queue.c
@@ -390,6 +390,10 @@ KeRemoveQueue(IN PKQUEUE Queue,
                         &WaitBlock->WaitListEntry;
                     Timer->Header.WaitListHead.Blink =
                         &WaitBlock->WaitListEntry;
+                    WaitBlock->WaitListEntry.Flink =
+                        &Timer->Header.WaitListHead;
+                    WaitBlock->WaitListEntry.Blink =
+                        &Timer->Header.WaitListHead;
 
                     /* Create Timer */
                     KiInsertTimer(Timer, *Timeout);
@@ -427,8 +431,8 @@ KeRemoveQueue(IN PKQUEUE Queue,
                 /* Check if we had a timeout */
                 if (Timeout)
                 {
-                    /* FIXME: Fixup interval */
-                    DPRINT1("FIXME!!!\n");
+                    DPRINT1("If you see this message, contact Alex ASAP\n");
+                    KEBUGCHECK(0);
                 }
             }
 
diff --git a/reactos/ntoskrnl/ke/wait.c b/reactos/ntoskrnl/ke/wait.c
index 2907728d5f4..31b7f5ab8dc 100644
--- a/reactos/ntoskrnl/ke/wait.c
+++ b/reactos/ntoskrnl/ke/wait.c
@@ -360,7 +360,9 @@ KeDelayExecutionThread(IN KPROCESSOR_MODE WaitMode,
                 return WaitStatus;
             }
 
-            /* FIXME: Fixup interval */
+            /* Check if we had a timeout */
+            DPRINT1("If you see this message, contact Alex ASAP\n");
+            KEBUGCHECK(0);
         }
 
         /* Acquire again the lock */
@@ -533,7 +535,8 @@ KeWaitForSingleObject(PVOID Object,
             /* Check if we had a timeout */
             if (Timeout)
             {
-                 /* FIXME: Fixup interval */
+                DPRINT1("If you see this message, contact Alex ASAP\n");
+                KEBUGCHECK(0);
             }
         }
 
@@ -813,7 +816,8 @@ KeWaitForMultipleObjects(IN ULONG Count,
             /* Check if we had a timeout */
             if (Timeout)
             {
-                /* FIXME: Fixup interval */
+                DPRINT1("If you see this message, contact Alex ASAP\n");
+                KEBUGCHECK(0);
             }
 
             /* Acquire again the lock */