Skip to content

cm: Fix KCB pushlock leaks in CmpLookInCache and CmpDoOpen #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Copilot wants to merge 1 commit into
base: SMP/smp-bringup
Choose a base branch
from
Draft

cm: Fix KCB pushlock leaks in CmpLookInCache and CmpDoOpen #8

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 19 additions & 10 deletions ntoskrnl/config/cmparse.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -688,13 +688,15 @@ CmpDoOpen(IN PHHIVE Hive,

/*
* The symlink has been found. As in the similar case above,
* the KCB of the symlink exclusively, we don't want anybody
* to mess it up.
* lock the KCB of the symlink exclusively; we don't want
* anybody to mess it up. The lock is now exclusive so
* update IsLockShared accordingly.
*/
CmpUnLockKcbArray(KcbsLocked);
CmpAcquireKcbLockExclusiveByIndex(GET_HASH_INDEX((*CachedKcb)->ConvKey));
KcbsLocked[0] = 1;
KcbsLocked[1] = GET_HASH_INDEX((*CachedKcb)->ConvKey);
IsLockShared = FALSE;
}
else
{
Expand Down Expand Up @@ -1610,20 +1612,27 @@ CmpLookInCache(
if (KeyFoundInCache)
{
/*
* Before we change the KCB we must dereference the prior
* KCB that we no longer need it.
* Reference the new KCB before dropping the old one. If this
* fails we must unlock the KCBs and release the temporary
* reference we took at the start of this function before
* returning, so that the caller sees a clean state.
*/
CmpDereferenceKeyControlBlock(*Kcb);
*Kcb = CurrentKcb;

/* Reference the new KCB now */
if (!CmpReferenceKeyControlBlock(*Kcb))
if (!CmpReferenceKeyControlBlock(CurrentKcb))
{
/* This key is opened too many times, bail out */
DPRINT1("Could not reference the KCB, too many references (KCB 0x%p)\n", Kcb);
DPRINT1("Could not reference the KCB, too many references (KCB 0x%p)\n", CurrentKcb);
CmpUnLockKcbArray(LockedKcbs);
CmpDereferenceKeyControlBlock(*Kcb);
return STATUS_UNSUCCESSFUL;
}

/*
* Dereference the prior KCB that we no longer need
* and switch to the newly referenced one.
*/
CmpDereferenceKeyControlBlock(*Kcb);
*Kcb = CurrentKcb;

/* Update hive and cell data from current KCB */
*Hive = CurrentKcb->KeyHive;
*Cell = CurrentKcb->KeyCell;
Expand Down