From afdd96eaae6bfa4f710d03b08599cc1ab0c6a329 Mon Sep 17 00:00:00 2001 From: Thomas Faber Date: Thu, 14 Jun 2012 22:06:24 +0000 Subject: [PATCH] [NTOSKRNL] - Fix callback pool tags - Fix a reference leak in PsSetCreateProcessNotifyRoutine See issue #7120 for more details. svn path=/trunk/; revision=56735 --- reactos/ntoskrnl/CMakeLists.txt | 2 +- reactos/ntoskrnl/ex/callback.c | 18 +++++------ reactos/ntoskrnl/include/internal/tag.h | 5 +-- reactos/ntoskrnl/ps/psnotify.c | 41 ++++++++++++------------- 4 files changed, 32 insertions(+), 34 deletions(-) diff --git a/reactos/ntoskrnl/CMakeLists.txt b/reactos/ntoskrnl/CMakeLists.txt index bc3d00f1109..3242b9c7642 100644 --- a/reactos/ntoskrnl/CMakeLists.txt +++ b/reactos/ntoskrnl/CMakeLists.txt @@ -132,7 +132,7 @@ list(APPEND SOURCE fstub/disksup.c fstub/fstubex.c fstub/halstub.c - fstub/translate.c + fstub/translate.c inbv/inbv.c inbv/inbvport.c io/iomgr/adapter.c diff --git a/reactos/ntoskrnl/ex/callback.c b/reactos/ntoskrnl/ex/callback.c index d420d3d9da0..7615e0e26f2 100644 --- a/reactos/ntoskrnl/ex/callback.c +++ b/reactos/ntoskrnl/ex/callback.c @@ -59,7 +59,7 @@ ExAllocateCallBack(IN PEX_CALLBACK_FUNCTION Function, /* Allocate a callback */ CallbackBlock = ExAllocatePoolWithTag(PagedPool, sizeof(EX_CALLBACK_ROUTINE_BLOCK), - 'CbRb'); + TAG_CALLBACK_ROUTINE_BLOCK); if (CallbackBlock) { /* Initialize it */ @@ -77,7 +77,7 @@ NTAPI ExFreeCallBack(IN PEX_CALLBACK_ROUTINE_BLOCK CallbackBlock) { /* Just free it from memory */ - ExFreePoolWithTag(CallbackBlock, CALLBACK_TAG); + ExFreePoolWithTag(CallbackBlock, TAG_CALLBACK_ROUTINE_BLOCK); } VOID @@ -124,7 +124,7 @@ ExReferenceCallBackBlock(IN OUT PEX_CALLBACK CallBack) EX_FAST_REF OldValue; ULONG_PTR Count; PEX_CALLBACK_ROUTINE_BLOCK CallbackBlock; - + /* Acquire a reference */ OldValue = ExAcquireFastReference(&CallBack->RoutineBlock); Count = ExGetCountFastReference(OldValue); @@ -140,10 +140,10 @@ ExReferenceCallBackBlock(IN OUT PEX_CALLBACK CallBack) ASSERT(FALSE); return NULL; } - + /* Get the callback block */ CallbackBlock = ExGetObjectFastReference(OldValue); - + /* Check if this is the last reference */ if (Count == 1) { @@ -425,7 +425,7 @@ ExCreateCallback(OUT PCALLBACK_OBJECT *CallbackObject, 0, ExCallbackObjectType, KernelMode, - (PVOID)&Callback, + &Callback, NULL); /* Close the Handle, since we now have the pointer */ @@ -567,7 +567,7 @@ ExRegisterCallback(IN PCALLBACK_OBJECT CallbackObject, /* Allocate memory for the structure */ CallbackRegistration = ExAllocatePoolWithTag(NonPagedPool, sizeof(CALLBACK_REGISTRATION), - CALLBACK_TAG); + TAG_CALLBACK_REGISTRATION); if (!CallbackRegistration) { /* Dereference and fail */ @@ -602,7 +602,7 @@ ExRegisterCallback(IN PCALLBACK_OBJECT CallbackObject, KeReleaseSpinLock(&CallbackObject->Lock, OldIrql); /* Free the registration */ - ExFreePoolWithTag(CallbackRegistration, CALLBACK_TAG); + ExFreePoolWithTag(CallbackRegistration, TAG_CALLBACK_REGISTRATION); CallbackRegistration = NULL; /* Dereference the object */ @@ -676,7 +676,7 @@ ExUnregisterCallback(IN PVOID CallbackRegistrationHandle) KeReleaseSpinLock(&CallbackObject->Lock, OldIrql); /* Delete this registration */ - ExFreePoolWithTag(CallbackRegistration, CALLBACK_TAG); + ExFreePoolWithTag(CallbackRegistration, TAG_CALLBACK_REGISTRATION); /* Remove the reference */ ObDereferenceObject(CallbackObject); diff --git a/reactos/ntoskrnl/include/internal/tag.h b/reactos/ntoskrnl/include/internal/tag.h index fa3526e46eb..d2fd01d135c 100644 --- a/reactos/ntoskrnl/include/internal/tag.h +++ b/reactos/ntoskrnl/include/internal/tag.h @@ -5,8 +5,9 @@ #define TAG_BCB ' BCB' #define TAG_IBCB 'BCBi' -/* formely located in include/callback.h */ -#define CALLBACK_TAG 'KBLC' +/* Executive Callbacks */ +#define TAG_CALLBACK_ROUTINE_BLOCK 'brbC' +#define TAG_CALLBACK_REGISTRATION 'eRBC' /* formely located in dbg/dbgkobj.c */ #define TAG_DEBUG_EVENT 'EgbD' diff --git a/reactos/ntoskrnl/ps/psnotify.c b/reactos/ntoskrnl/ps/psnotify.c index c7cd2f9a10c..c773f7864fb 100644 --- a/reactos/ntoskrnl/ps/psnotify.c +++ b/reactos/ntoskrnl/ps/psnotify.c @@ -48,35 +48,32 @@ PsSetCreateProcessNotifyRoutine(IN PCREATE_PROCESS_NOTIFY_ROUTINE NotifyRoutine, if (!CallBack) continue; /* Check it this is a matching block */ - if (ExGetCallBackBlockRoutine(CallBack) != (PVOID)NotifyRoutine) + if (ExGetCallBackBlockRoutine(CallBack) == (PVOID)NotifyRoutine) { - /* It's not, try the next one */ - continue; - } + /* Try removing it if it matches */ + if (ExCompareExchangeCallBack(&PspProcessNotifyRoutine[i], + NULL, + CallBack)) + { + /* Decrement the number of routines */ + InterlockedDecrement((PLONG)&PspProcessNotifyRoutineCount); - /* It is, clear the current routine */ - if (ExCompareExchangeCallBack(&PspProcessNotifyRoutine[i], - NULL, - CallBack)) - { - /* Decrement the number of routines */ - InterlockedDecrement((PLONG)&PspProcessNotifyRoutineCount); + /* Dereference the block */ + ExDereferenceCallBackBlock(&PspProcessNotifyRoutine[i], + CallBack); + + /* Wait for active callbacks */ + ExWaitForCallBacks(CallBack); + + /* Free the callback and exit */ + ExFreeCallBack(CallBack); + return STATUS_SUCCESS; + } /* Dereference the block */ ExDereferenceCallBackBlock(&PspProcessNotifyRoutine[i], CallBack); - - /* Wait for actice callbacks */ - ExWaitForCallBacks(CallBack); - - /* Free the callback and exit */ - ExFreeCallBack (CallBack); - return STATUS_SUCCESS; } - - /* Dereference the block */ - ExDereferenceCallBackBlock(&PspProcessNotifyRoutine[i], - CallBack); } /* We didn't find any matching block */