[ros-diffs] [reactos] 62/100: [NTOS:CC] Fix potnetial use-after-free

[Jérôme Gardou]

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=8287a098b94d5cf60a9604...

commit 8287a098b94d5cf60a9604e711fba19d3a758be5
Author:     Jérôme Gardou [e-mail]
AuthorDate: Tue Dec 29 11:26:25 2020 +0100
Commit:     Jérôme Gardou [e-mail]
CommitDate: Wed Feb 3 09:41:23 2021 +0100

[NTOS:CC] Fix potnetial use-after-free
---
 ntoskrnl/cc/view.c | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/ntoskrnl/cc/view.c b/ntoskrnl/cc/view.c
index e6ac23c2b6e..6f0490c31d0 100644
--- a/ntoskrnl/cc/view.c
+++ b/ntoskrnl/cc/view.c
@@ -208,8 +208,6 @@ CcRosFlushDirtyPages (
     BOOLEAN CalledFromLazy)
 {
     PLIST_ENTRY current_entry;
-    PROS_VACB current;
-    BOOLEAN Locked;
     NTSTATUS Status;
     KIRQL OldIrql;
     BOOLEAN FlushAll = (Target == MAXULONG);
@@ -229,6 +227,10 @@ CcRosFlushDirtyPages (

while (((current_entry != &DirtyVacbListHead) && (Target > 0)) || FlushAll)
     {
+        PROS_SHARED_CACHE_MAP SharedCacheMap;
+        PROS_VACB current;
+        BOOLEAN Locked;
+
         if (current_entry == &DirtyVacbListHead)
         {
             ASSERT(FlushAll);
@@ -244,17 +246,17 @@ CcRosFlushDirtyPages (

CcRosVacbIncRefCount(current);

+        SharedCacheMap = current->SharedCacheMap;
+
         /* When performing lazy write, don't handle temporary files */
-        if (CalledFromLazy &&
-            BooleanFlagOn(current->SharedCacheMap->FileObject->Flags, FO_TEMPORARY_FILE))
+        if (CalledFromLazy && BooleanFlagOn(SharedCacheMap->FileObject->Flags, FO_TEMPORARY_FILE))
         {
             CcRosVacbDecRefCount(current);
             continue;
         }

/* Don't attempt to lazy write the files that asked not to */
-        if (CalledFromLazy &&
-            BooleanFlagOn(current->SharedCacheMap->Flags, WRITEBEHIND_DISABLED))
+        if (CalledFromLazy && BooleanFlagOn(SharedCacheMap->Flags, WRITEBEHIND_DISABLED))
         {
             CcRosVacbDecRefCount(current);
             continue;
@@ -263,32 +265,30 @@ CcRosFlushDirtyPages (
         ASSERT(current->Dirty);

/* Do not lazy-write the same file concurrently. Fastfat ASSERTS on that */
-        if (current->SharedCacheMap->Flags & SHARED_CACHE_MAP_IN_LAZYWRITE)
+        if (SharedCacheMap->Flags & SHARED_CACHE_MAP_IN_LAZYWRITE)
         {
             CcRosVacbDecRefCount(current);
             continue;
         }

-        current->SharedCacheMap->Flags |= SHARED_CACHE_MAP_IN_LAZYWRITE;
+        SharedCacheMap->Flags |= SHARED_CACHE_MAP_IN_LAZYWRITE;

KeReleaseQueuedSpinLock(LockQueueMasterLock, OldIrql);

-        Locked = current->SharedCacheMap->Callbacks->AcquireForLazyWrite(
-                     current->SharedCacheMap->LazyWriteContext, Wait);
+        Locked = SharedCacheMap->Callbacks->AcquireForLazyWrite(SharedCacheMap->LazyWriteContext, Wait);
         if (!Locked)
         {
             DPRINT("Not locked!");
             ASSERT(!Wait);
-            OldIrql = KeAcquireQueuedSpinLock(LockQueueMasterLock);
             CcRosVacbDecRefCount(current);
-            current->SharedCacheMap->Flags &= ~SHARED_CACHE_MAP_IN_LAZYWRITE;
+            OldIrql = KeAcquireQueuedSpinLock(LockQueueMasterLock);
+            SharedCacheMap->Flags &= ~SHARED_CACHE_MAP_IN_LAZYWRITE;
             continue;
         }

Status = CcRosFlushVacb(current);

-        current->SharedCacheMap->Callbacks->ReleaseFromLazyWrite(
-            current->SharedCacheMap->LazyWriteContext);
+        SharedCacheMap->Callbacks->ReleaseFromLazyWrite(SharedCacheMap->LazyWriteContext);

/* We release the VACB before acquiring the lock again, because
          * CcRosVacbDecRefCount might free the VACB, as CcRosFlushVacb dropped a
@@ -297,7 +297,7 @@ CcRosFlushDirtyPages (
         CcRosVacbDecRefCount(current);
         OldIrql = KeAcquireQueuedSpinLock(LockQueueMasterLock);

-        current->SharedCacheMap->Flags &= ~SHARED_CACHE_MAP_IN_LAZYWRITE;
+        SharedCacheMap->Flags &= ~SHARED_CACHE_MAP_IN_LAZYWRITE;

if (!NT_SUCCESS(Status) && (Status != STATUS_END_OF_FILE) &&
             (Status != STATUS_MEDIA_WRITE_PROTECTED))