[ros-diffs] 02/02: [BTRFS] Leak the root stream file object on mount.

[Pierre Schweitzer]

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=c13ccc92f66d9fd537ffd…

commit c13ccc92f66d9fd537ffdd4c0324af5b9c2723e1
Author:     Pierre Schweitzer <pierre(a)reactos.org>
AuthorDate: Wed Aug 15 16:38:56 2018 +0200
Commit:     Pierre Schweitzer <pierre(a)reactos.org>
CommitDate: Wed Aug 15 16:38:56 2018 +0200

    [BTRFS] Leak the root stream file object on mount.
    
    For whatever (unknown) reason yet, this stream file object
    seems to be deleted when still in use while installing
    ReactOS on BtrFS partition, leading to use after free.
    
    So, quick and dirty hack: leak it to prevent deletion.
    
    CORE-13769
---
 drivers/filesystems/btrfs/btrfs.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/filesystems/btrfs/btrfs.c b/drivers/filesystems/btrfs/btrfs.c
index 27a1572db8..c4960cd421 100644
--- a/drivers/filesystems/btrfs/btrfs.c
+++ b/drivers/filesystems/btrfs/btrfs.c
@@ -4453,7 +4453,21 @@ static NTSTATUS mount_vol(_In_ PDEVICE_OBJECT DeviceObject, _In_
PIRP Irp) {
         goto exit;
     }
 
+    /* HACK: stream file object seems to get deleted at some point
+     * leading to use after free when installing ReactOS on
+     * BtrFS.
+     * Workaround: leak a handle to the fileobject
+     * XXX: Could be improved by storing it somewhere and releasing it
+     * on dismount. Or even by referencing again the file object.
+     */
+#ifndef __REACTOS__
     Vcb->root_file = IoCreateStreamFileObject(NULL, DeviceToMount);
+#else
+    {
+        HANDLE Dummy;
+        Vcb->root_file = IoCreateStreamFileObjectEx(NULL, DeviceToMount, &Dummy);
+    }
+#endif
     Vcb->root_file->FsContext = root_fcb;
     Vcb->root_file->SectionObjectPointer =
&root_fcb->nonpaged->segment_object;
     Vcb->root_file->Vpb = DeviceObject->Vpb;