From f9e430f65ba85e52a0a8d9f694f23373dbb56806 Mon Sep 17 00:00:00 2001 From: Oleg Dubinskiy Date: Wed, 20 Nov 2024 16:52:38 +0100 Subject: [PATCH] [NTOS:FSRTL] FsRtlAcquireFileExclusiveCommon: don't return before acquiring a file resource, except special cases (#7273) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Don't return before file object's resource is acquired in FsRtlAcquireFileExclusiveCommon, except some special return cases, when return is reuired. Based on hpoussin_filter_extra.patch by Herve Poussineau (hpoussin) with improved comment, which matches the actual behaviour now. This is required by fltmgr.sys driver from Windows XP/Server 2003 to work correctly, so this change fixes asserts/exceptions when releasing the file via FsRtlReleaseFile after acquiring, when using 3rd party filter drivers from several antivirus programs (e. g., Avast Free Antivirus all versions, AVG Antivirus Free 18.8, Avira AntiVir Personal 8.2, Dr. Web Security Space 8.0, Kaspersky Antivirus 2012 etc. etc.). CORE-14157, CORE-14635, CORE-19318 * Add braces around return Co-authored-by: Hermès BÉLUSCA - MAÏTO * Improve the comment (make it more detailed) * Correct checks sequence Co-authored-by: Hermès BÉLUSCA - MAÏTO