From 944ccbbe335e71d5024cf90aa30d496e80289e4b Mon Sep 17 00:00:00 2001
From: Cameron Gutman <aicommander@gmail.com>
Date: Sun, 29 May 2011 16:44:34 +0000
Subject: [PATCH] [NTOSKRNL] - Fix a reference leak which prevented driver
 objects passed to IoRegisterPlugPlayNotification from being able to unload
 after the notification was unregistered - Fix a non-paged pool leak

svn path=/trunk/; revision=51997
---
 reactos/ntoskrnl/io/pnpmgr/pnpnotify.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/reactos/ntoskrnl/io/pnpmgr/pnpnotify.c b/reactos/ntoskrnl/io/pnpmgr/pnpnotify.c
index 6e43d7143cf..66768c28075 100644
--- a/reactos/ntoskrnl/io/pnpmgr/pnpnotify.c
+++ b/reactos/ntoskrnl/io/pnpmgr/pnpnotify.c
@@ -23,6 +23,7 @@ typedef struct _PNP_NOTIFY_ENTRY
     PVOID Context;
     UNICODE_STRING Guid;
     PFILE_OBJECT FileObject;
+    PDRIVER_OBJECT DriverObject;
     PDRIVER_NOTIFICATION_CALLBACK_ROUTINE PnpNotificationProc;
 } PNP_NOTIFY_ENTRY, *PPNP_NOTIFY_ENTRY;
 
@@ -319,6 +320,7 @@ IoRegisterPlugPlayNotification(IN IO_NOTIFICATION_EVENT_CATEGORY EventCategory,
     Entry->PnpNotificationProc = CallbackRoutine;
     Entry->EventCategory = EventCategory;
     Entry->Context = Context;
+    Entry->DriverObject = DriverObject;
     switch (EventCategory)
     {
         case EventCategoryDeviceInterfaceChange:
@@ -377,9 +379,14 @@ IoUnregisterPlugPlayNotification(IN PVOID NotificationEntry)
     DPRINT("__FUNCTION__(NotificationEntry %p) called\n", Entry);
 
     KeAcquireGuardedMutex(&PnpNotifyListLock);
-    RtlFreeUnicodeString(&Entry->Guid);
     RemoveEntryList(&Entry->PnpNotifyList);
     KeReleaseGuardedMutex(&PnpNotifyListLock);
 
+    RtlFreeUnicodeString(&Entry->Guid);
+
+    ObDereferenceObject(Entry->DriverObject);
+
+    ExFreePoolWithTag(Entry, TAG_PNP_NOTIFY);
+
     return STATUS_SUCCESS;
 }