From 912704ceb87cec9705e6ff8901749e87086aad7a Mon Sep 17 00:00:00 2001 From: Cameron Gutman Date: Sat, 14 Aug 2010 14:55:12 +0000 Subject: [PATCH] [NTOSKRNL] - Move to the next entry in the thread IRP list before calling IoCancelIrp because if everything works as expected and IoCompleteRequest is called, we could end up with the IRP ripped out from under us before can move to the next element - See issue #5550 for details. svn path=/trunk/; revision=48546 --- reactos/ntoskrnl/io/iomgr/irp.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/reactos/ntoskrnl/io/iomgr/irp.c b/reactos/ntoskrnl/io/iomgr/irp.c index a578e89731a..bd0eb8881d6 100644 --- a/reactos/ntoskrnl/io/iomgr/irp.c +++ b/reactos/ntoskrnl/io/iomgr/irp.c @@ -1047,14 +1047,12 @@ IoCancelThreadIo(IN PETHREAD Thread) NextEntry = ListHead->Flink; while (ListHead != NextEntry) { - /* Get the IRP */ + /* Get the IRP and move to the next entry */ Irp = CONTAINING_RECORD(NextEntry, IRP, ThreadListEntry); + NextEntry = NextEntry->Flink; /* Cancel it */ IoCancelIrp(Irp); - - /* Move to the next entry */ - NextEntry = NextEntry->Flink; } /* Wait 100 milliseconds */