From ed15dc5d116188cbc77763d4e10c2468123b4f65 Mon Sep 17 00:00:00 2001
From: Cameron Gutman <aicommander@gmail.com>
Date: Fri, 23 Dec 2011 23:20:09 +0000
Subject: [PATCH] [NTOSKRNL] - Reference the cache segment when flushing to
 avoid a race between deleting the file cache and the balancer flushing pages
 to disk which causes random cache segments to be freed while we're holding a
 lock on it - Fixes a crash in KeReleaseMutex (used to be a crash in
 ExReleasePushLock) during periods of high memory load

svn path=/trunk/; revision=54745
---
 reactos/ntoskrnl/cc/view.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/reactos/ntoskrnl/cc/view.c b/reactos/ntoskrnl/cc/view.c
index b75cb56e6f3..b6bdab50c84 100644
--- a/reactos/ntoskrnl/cc/view.c
+++ b/reactos/ntoskrnl/cc/view.c
@@ -204,10 +204,13 @@ CcRosFlushDirtyPages(ULONG Target, PULONG Count, BOOLEAN Wait)
                                     DirtySegmentListEntry);
         current_entry = current_entry->Flink;
 
+        CcRosCacheSegmentIncRefCount(current);
+
         Locked = current->Bcb->Callbacks->AcquireForLazyWrite(
             current->Bcb->LazyWriteContext, Wait);
         if (!Locked)
         {
+            CcRosCacheSegmentDecRefCount(current);
             continue;
         }
 
@@ -220,6 +223,7 @@ CcRosFlushDirtyPages(ULONG Target, PULONG Count, BOOLEAN Wait)
         {
             current->Bcb->Callbacks->ReleaseFromLazyWrite(
                 current->Bcb->LazyWriteContext);
+            CcRosCacheSegmentDecRefCount(current);
             continue;
         }
 
@@ -229,6 +233,7 @@ CcRosFlushDirtyPages(ULONG Target, PULONG Count, BOOLEAN Wait)
             KeReleaseMutex(&current->Mutex, 0);
             current->Bcb->Callbacks->ReleaseFromLazyWrite(
                 current->Bcb->LazyWriteContext);
+            CcRosCacheSegmentDecRefCount(current);
             continue;
         }
 
@@ -241,6 +246,9 @@ CcRosFlushDirtyPages(ULONG Target, PULONG Count, BOOLEAN Wait)
         KeReleaseMutex(&current->Mutex, 0);
         current->Bcb->Callbacks->ReleaseFromLazyWrite(
             current->Bcb->LazyWriteContext);
+        
+        KeAcquireGuardedMutex(&ViewLock);
+        CcRosCacheSegmentDecRefCount(current);
 
         if (!NT_SUCCESS(Status) &&  (Status != STATUS_END_OF_FILE))
         {
@@ -251,8 +259,7 @@ CcRosFlushDirtyPages(ULONG Target, PULONG Count, BOOLEAN Wait)
             (*Count) += PagesPerSegment;
             Target -= PagesPerSegment;
         }
-        
-        KeAcquireGuardedMutex(&ViewLock);
+
         current_entry = DirtySegmentListHead.Flink;
     }