- Save pointer to driver's section in DriverSection during driver loading.

- Fix unloading function to check if a driver to be unloaded really has DriverSection set, and if not, fail.
- Inspired by bug 3221.
See issue #3221 for more details.

svn path=/trunk/; revision=34526

reactos/ntoskrnl/io/iomgr/driver.c

@@ -1085,7 +1085,7 @@ IopUnloadDriver(PUNICODE_STRING DriverServiceName, BOOLEAN UnloadPnpDrivers)
     */
 
     /* Call the load/unload routine, depending on current process */
-   if (DriverObject->DriverUnload)
+   if (DriverObject->DriverUnload && DriverObject->DriverSection)
    {
       if (PsGetCurrentProcess() == PsInitialSystemProcess)
       {
@@ -1111,13 +1111,22 @@ IopUnloadDriver(PUNICODE_STRING DriverServiceName, BOOLEAN UnloadPnpDrivers)
          KeWaitForSingleObject(&LoadParams.Event, UserRequest, KernelMode,
              FALSE, NULL);
       }
+
+      /* Unload the driver */
+      ObDereferenceObject(DriverObject);
+      ObDereferenceObject(DriverObject);
+      MmUnloadSystemImage(DriverObject->DriverSection);
+
+      return STATUS_SUCCESS;
    }
+   else
+   {
+      /* Dereference one time (refd inside this function) */
+      ObDereferenceObject(DriverObject);
 
-   ObDereferenceObject(DriverObject);
+      /* Return unloading failure */
-   ObDereferenceObject(DriverObject);
+      return STATUS_INVALID_DEVICE_REQUEST;
-   MmUnloadSystemImage(DriverObject->DriverSection);
+   }
-
-   return STATUS_SUCCESS;
 }
 
 VOID
@@ -1718,6 +1727,9 @@ IopLoadUnloadDriver(PLOAD_UNLOAD_PARAMS LoadParams)
            }
        }
 
+       /* Store its DriverSection, so that it could be unloaded */
+       DriverObject->DriverSection = ModuleObject;
+
        /* We have a driver for this DeviceNode */
        DeviceNode->Flags |= DN_DRIVER_LOADED;
    }