George Bișoc 5da5e644bb [NTOS:OB] Include the security descriptor charge when charging the paged pool quota of an object ... On ObpChargeQuotaForObject function, the kernel will either charge the default object type charges or the specified information charges obtained from ObCreateObject API call. What happens is that if a paged pool charge is specified on ObCreateObject call the kernel will charge that but when an object is about to be de-allocated, the amount of quota to return back to the system is the amounting of the paged pool charge specified previously by the ObCreateObject call plus the amounting of the security descriptor charge (see oblife.c / line 98). This will result in a fatal crash with a bugcheck of QUOTA_UNDERFLOW because we are returning quota with bits of it that was never charged and that's SecurityDescriptorCharge. A QUOTA_UNDERFLOW bugcheck occurs in two following scenarios: -- When installing Virtualbox Guest Additions and prompting the installer to reboot the system for you -- When logging off and on back to the system and then you restart the system normally This bug has been discovered whilst working on #4555 PR.		2022-06-26 19:47:02 +02:00
..
devicemap.c
obdir.c	[NTOS:OB] Minor refactoring.	2021-09-25 01:09:01 +02:00
obhandle.c	[NTOS:OB] Include the security descriptor charge when charging the paged pool quota of an object	2022-06-26 19:47:02 +02:00
obinit.c	[NTOS:OB] Clarify and fix the usage of the Obp*DirectoryLock*() and ObpReleaseLookupContextObject() functions.	2021-09-25 00:47:43 +02:00
oblife.c	[NTOS:OB] Charge/Return pool quotas of objects	2022-01-11 10:11:10 +01:00
oblink.c	[NTOS:OB] Minor refactoring.	2021-09-25 01:09:01 +02:00
obname.c	[NTOS:OB] Clarify and fix the usage of the Obp*DirectoryLock*() and ObpReleaseLookupContextObject() functions.	2021-09-25 00:47:43 +02:00
obref.c
obsdcach.c
obsecure.c	[NTOS:OB] Specify the query security descriptor tag when freeing the allocation	2022-05-08 19:16:34 +02:00
obwait.c