https://git.reactos.org/?p=reactos.git;a=commitdiff;h=62a4f9d42b6e43c1f84cb…
commit 62a4f9d42b6e43c1f84cb5d999b6e79e5d5bbb2a
Author: Victor Perevertkin <victor.perevertkin(a)reactos.org>
AuthorDate: Sun Dec 27 18:35:52 2020 +0300
Commit: Victor Perevertkin <victor.perevertkin(a)reactos.org>
CommitDate: Sun Dec 27 18:35:52 2020 +0300
[MOUNTMGR] Do not handle device removal notification
Do not treat target device change notification as
DEVICE_INTERFACE_CHANGE_NOTIFICATION. The notification have to be
unregistered while handling GUID_DEVICE_INTERFACE_REMOVAL, so
GUID_TARGET_DEVICE_REMOVE_COMPLETE should never be sent to mountmgr in a
normal case.
CORE-16106
---
drivers/storage/mountmgr/notify.c | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
diff --git a/drivers/storage/mountmgr/notify.c b/drivers/storage/mountmgr/notify.c
index 2c7a05dbc88..262f40ca565 100644
--- a/drivers/storage/mountmgr/notify.c
+++ b/drivers/storage/mountmgr/notify.c
@@ -231,21 +231,19 @@ MountMgrTargetDeviceNotification(IN PVOID NotificationStructure,
{
PDEVICE_EXTENSION DeviceExtension;
PDEVICE_INFORMATION DeviceInformation;
- PDEVICE_INTERFACE_CHANGE_NOTIFICATION Notification;
+ PTARGET_DEVICE_CUSTOM_NOTIFICATION Notification;
DeviceInformation = Context;
DeviceExtension = DeviceInformation->DeviceExtension;
Notification = NotificationStructure;
- /* If it's to signal that removal is complete, then, execute the function */
- if (IsEqualGUID(&(Notification->Event), &GUID_TARGET_DEVICE_REMOVE_COMPLETE))
- {
- MountMgrMountedDeviceRemoval(DeviceExtension, Notification->SymbolicLinkName);
- }
+ /* The notification have to be unregistered already (in device interface change handler) */
+ ASSERT(!IsEqualGUID(&Notification->Event, &GUID_TARGET_DEVICE_REMOVE_COMPLETE));
+
/* It it's to signal that a volume has been mounted
* Verify if a database sync is required and execute it
*/
- else if (IsEqualGUID(&(Notification->Event), &GUID_IO_VOLUME_MOUNT))
+ if (IsEqualGUID(&(Notification->Event), &GUID_IO_VOLUME_MOUNT))
{
/* If we were already mounted, then mark us unmounted */
if (InterlockedCompareExchange(&(DeviceInformation->MountState),
https://git.reactos.org/?p=reactos.git;a=commitdiff;h=a748350fc9c342149e7f8…
commit a748350fc9c342149e7f8dc798a6c696f4ec9ef3
Author: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org>
AuthorDate: Sun Dec 27 00:33:32 2020 +0100
Commit: Hermès Bélusca-Maïto <hermes.belusca-maito(a)reactos.org>
CommitDate: Sun Dec 27 00:52:00 2020 +0100
[NTOS:IO] Fail if the driver name passed to NtLoadDriver() is an empty string.
Otherwise an assertion on the driver name is hit later on.
Can be reproduced by calling NtLoadDriver with a valid UNICODE_STRING
of Length == 0.
---
ntoskrnl/io/iomgr/driver.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/ntoskrnl/io/iomgr/driver.c b/ntoskrnl/io/iomgr/driver.c
index 9f7d5ed5aba..3b033f9ab32 100644
--- a/ntoskrnl/io/iomgr/driver.c
+++ b/ntoskrnl/io/iomgr/driver.c
@@ -1251,7 +1251,7 @@ IopUnloadDriver(PUNICODE_STRING DriverServiceName, BOOLEAN UnloadPnpDrivers)
DPRINT("IopUnloadDriver('%wZ', %u)\n", &CapturedServiceName, UnloadPnpDrivers);
/* We need a service name */
- if (CapturedServiceName.Length == 0)
+ if (CapturedServiceName.Length == 0 || CapturedServiceName.Buffer == NULL)
{
ReleaseCapturedUnicodeString(&CapturedServiceName, PreviousMode);
return STATUS_INVALID_PARAMETER;
@@ -2161,6 +2161,13 @@ NtLoadDriver(IN PUNICODE_STRING DriverServiceName)
DPRINT("NtLoadDriver('%wZ')\n", &CapturedServiceName);
+ /* We need a service name */
+ if (CapturedServiceName.Length == 0 || CapturedServiceName.Buffer == NULL)
+ {
+ ReleaseCapturedUnicodeString(&CapturedServiceName, PreviousMode);
+ return STATUS_INVALID_PARAMETER;
+ }
+
/* Load driver and call its entry point */
DriverObject = NULL;
Status = IopLoadUnloadDriver(&CapturedServiceName, &DriverObject);