Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2025-08-05 16:52:59 +00:00
Code Issues Projects Releases Packages Wiki Activity

- Fix a memory leak in IopUnloadDriver.

Browse source 
- Driver object temporary was not marked temporary, thus it wasn't really deleted after reference counter reached 0. Fix this (inspired by bug #3501).
See issue #3501 for more details.

svn path=/trunk/; revision=36719
This commit is contained in:
Aleksey Bragin 2008-10-11 17:39:12 +00:00
parent 96101fb28c
commit 33e3938bb1
1 changed files with 19 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

29
reactos/ntoskrnl/io/iomgr/driver.c
View file

@ -1010,9 +1010,19 @@ IopUnloadDriver(PUNICODE_STRING DriverServiceName, BOOLEAN UnloadPnpDrivers)
/* /*
* Find the driver object * Find the driver object
*/ */
Status = ObReferenceObjectByName(&ObjectName,
0,
0,
0,
IoDriverObjectType,
KernelMode,
0,
(PVOID*)&DriverObject);
Status = ObReferenceObjectByName(&ObjectName, 0, 0, 0, IoDriverObjectType, /*
KernelMode, 0, (PVOID*)&DriverObject); * Free the buffer for driver object name
*/
ExFreePool(ObjectName.Buffer);
if (!NT_SUCCESS(Status)) if (!NT_SUCCESS(Status))
{ {
@ -1020,12 +1030,6 @@ IopUnloadDriver(PUNICODE_STRING DriverServiceName, BOOLEAN UnloadPnpDrivers)
return Status; return Status;
} }
/*
* Free the buffer for driver object name
*/
ExFreePool(ObjectName.Buffer);
/* /*
* Get path of service... * Get path of service...
*/ */
@ -1097,9 +1101,14 @@ IopUnloadDriver(PUNICODE_STRING DriverServiceName, BOOLEAN UnloadPnpDrivers)
FALSE, NULL); FALSE, NULL);
} }
/* Mark the driver object temporary, so it could be deleted later */
ObMakeTemporaryObject(DriverObject);
/* Dereference it 2 times */
ObDereferenceObject(DriverObject);
ObDereferenceObject(DriverObject);
/* Unload the driver */ /* Unload the driver */
ObDereferenceObject(DriverObject);
ObDereferenceObject(DriverObject);
MmUnloadSystemImage(DriverObject->DriverSection); MmUnloadSystemImage(DriverObject->DriverSection);
return STATUS_SUCCESS; return STATUS_SUCCESS;