https://git.reactos.org/?p=reactos.git;a=commitdiff;h=7d70af61e8fff18b24d9b…
commit 7d70af61e8fff18b24d9baa3bb63c37c96aa21c6
Author:     Jérôme Gardou <jerome.gardou(a)reactos.org>
AuthorDate: Thu Dec 3 17:18:29 2020 +0100
Commit:     Jérôme Gardou <jerome.gardou(a)reactos.org>
CommitDate: Wed Feb 3 09:41:22 2021 +0100
    [NTOS:MM] Acquire file lock when creating section
---
 ntoskrnl/mm/section.c | 29 +++++++++++++++++++++++++----
 1 file changed, 25 insertions(+), 4 deletions(-)
diff --git a/ntoskrnl/mm/section.c b/ntoskrnl/mm/section.c
index e39f82d0f22..08e68a20c33 100644
--- a/ntoskrnl/mm/section.c
+++ b/ntoskrnl/mm/section.c
@@ -4290,6 +4290,7 @@ MmCreateSection (OUT PVOID  * Section,
     NTSTATUS Status;
     ULONG Protection;
     PSECTION *SectionObject = (PSECTION *)Section;
+    BOOLEAN FileLock = FALSE;
     /* Check if an ARM3 section is being created instead */
     if (!(AllocationAttributes & (SEC_IMAGE | SEC_PHYSICALMEMORY)))
@@ -4343,6 +4344,24 @@ MmCreateSection (OUT PVOID  * Section,
                 DPRINT1("Failed to get a handle to the FO: %lx\n", Status);
                 return Status;
             }
+
+            /* Lock the file */
+            Status = FsRtlAcquireToCreateMappedSection(FileObject,
SectionPageProtection);
+            if (!NT_SUCCESS(Status))
+            {
+                ObDereferenceObject(FileObject);
+                return Status;
+            }
+
+            FileLock = TRUE;
+
+            /* Deny access if there are writes on the file */
+            if ((AllocationAttributes & SEC_IMAGE) && (Status ==
STATUS_FILE_LOCKED_WITH_WRITERS))
+            {
+                DPRINT1("Cannot create image maps with writers open on the
file!\n");
+                Status = STATUS_ACCESS_DENIED;
+                goto Quit;
+            }
         }
         else
         {
@@ -4365,7 +4384,6 @@ MmCreateSection (OUT PVOID  * Section,
                                       SectionPageProtection,
                                       AllocationAttributes,
                                       FileObject);
-        ObDereferenceObject(FileObject);
     }
 #ifndef NEWCC
     else if (FileObject != NULL)
@@ -4378,7 +4396,6 @@ MmCreateSection (OUT PVOID  * Section,
                                           AllocationAttributes,
                                           FileObject,
                                           FileHandle != NULL);
-        ObDereferenceObject(FileObject);
     }
 #else
     else if (FileHandle != NULL || FileObject != NULL)
@@ -4396,10 +4413,14 @@ MmCreateSection (OUT PVOID  * Section,
     {
         /* All cases should be handled above */
         Status = STATUS_INVALID_PARAMETER;
-        if (FileObject)
-            ObDereferenceObject(FileObject);
     }
+Quit:
+    if (FileLock)
+        FsRtlReleaseFile(FileObject);
+    if (FileObject)
+        ObDereferenceObject(FileObject);
+
     return Status;
 }