Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions drivers/filesystems/udfs/read.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,7 @@ UDFCommonRead(
PVCB Vcb = NULL;
BOOLEAN VcbAcquired = FALSE;
BOOLEAN FcbAcquired = FALSE;
BOOLEAN PagingIoResourceAcquired = FALSE;
PVOID SystemBuffer = NULL;

BOOLEAN Wait;
Expand Down Expand Up @@ -157,6 +158,11 @@ UDFCommonRead(

UDFAcquireFcbSharedStarveExclusive(IrpContext, Fcb, FALSE);
FcbAcquired = TRUE;
// Acquire PagingIo resource shared to serialize with writes that hold
// it exclusively while modifying the extent mapping (UDFResizeExtent).
// This prevents a use-after-free when iterating DataLoc.Mapping.
UDFAcquireResourceShared(&Fcb->FcbNonpaged->FcbPagingIoResource, TRUE);
PagingIoResourceAcquired = TRUE;

} else {

Expand Down Expand Up @@ -406,6 +412,9 @@ try_exit: NOTHING;

} _SEH2_FINALLY {

if (PagingIoResourceAcquired) {
UDFReleaseResource(&Fcb->FcbNonpaged->FcbPagingIoResource);
}
if (FcbAcquired) {

UDFReleaseFcb(IrpContext, Fcb);
Expand Down