Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2024-12-28 01:55:19 +00:00
Code Issues Projects Releases Packages Wiki Activity

[BTRFS] Leak the root stream file object on mount.

Browse source 
For whatever (unknown) reason yet, this stream file object
seems to be deleted when still in use while installing
ReactOS on BtrFS partition, leading to use after free.

So, quick and dirty hack: leak it to prevent deletion.

CORE-13769
This commit is contained in:
Pierre Schweitzer 2018-08-15 16:38:56 +02:00
parent 80e11516b1
commit c13ccc92f6
No known key found for this signature in database
GPG key ID: 7545556C3D585B0B
1 changed files with 14 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
drivers/filesystems/btrfs/btrfs.c
View file

@ -4453,7 +4453,21 @@ static NTSTATUS mount_vol(_In_ PDEVICE_OBJECT DeviceObject, _In_ PIRP Irp) {
goto exit;
}
/* HACK: stream file object seems to get deleted at some point
* leading to use after free when installing ReactOS on
* BtrFS.
* Workaround: leak a handle to the fileobject
* XXX: Could be improved by storing it somewhere and releasing it
* on dismount. Or even by referencing again the file object.
*/
#ifndef __REACTOS__
Vcb->root_file = IoCreateStreamFileObject(NULL, DeviceToMount);
#else
{
HANDLE Dummy;
Vcb->root_file = IoCreateStreamFileObjectEx(NULL, DeviceToMount, &Dummy);
}
#endif
Vcb->root_file->FsContext = root_fcb;
Vcb->root_file->SectionObjectPointer = &root_fcb->nonpaged->segment_object;
Vcb->root_file->Vpb = DeviceObject->Vpb;