ReactOS  0.4.15-dev-2522-g9e0a3cd
obref.c File Reference
#include <ntoskrnl.h>
#include <debug.h>
Include dependency graph for obref.c:

Go to the source code of this file.

Macros

#define NDEBUG
 

Functions

BOOLEAN FASTCALL ObReferenceObjectSafe (IN PVOID Object)
 
VOID NTAPI ObpDeferObjectDeletion (IN POBJECT_HEADER Header)
 
LONG FASTCALL ObReferenceObjectEx (IN PVOID Object, IN LONG Count)
 
LONG FASTCALL ObDereferenceObjectEx (IN PVOID Object, IN LONG Count)
 
VOID FASTCALL ObInitializeFastReference (IN PEX_FAST_REF FastRef, IN PVOID Object OPTIONAL)
 
PVOID FASTCALL ObFastReferenceObjectLocked (IN PEX_FAST_REF FastRef)
 
PVOID FASTCALL ObFastReferenceObject (IN PEX_FAST_REF FastRef)
 
VOID FASTCALL ObFastDereferenceObject (IN PEX_FAST_REF FastRef, IN PVOID Object)
 
PVOID FASTCALL ObFastReplaceObject (IN PEX_FAST_REF FastRef, PVOID Object)
 
NTSTATUS NTAPI ObReferenceFileObjectForWrite (IN HANDLE Handle, IN KPROCESSOR_MODE AccessMode, OUT PFILE_OBJECT *FileObject, OUT POBJECT_HANDLE_INFORMATION HandleInformation)
 
LONG_PTR FASTCALL ObfReferenceObject (IN PVOID Object)
 
LONG_PTR FASTCALL ObfDereferenceObject (IN PVOID Object)
 
VOID NTAPI ObDereferenceObjectDeferDelete (IN PVOID Object)
 
VOID NTAPI ObDereferenceObject (IN PVOID Object)
 
NTSTATUS NTAPI ObReferenceObjectByPointer (IN PVOID Object, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode)
 
NTSTATUS NTAPI ObReferenceObjectByName (IN PUNICODE_STRING ObjectPath, IN ULONG Attributes, IN PACCESS_STATE PassedAccessState, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, IN OUT PVOID ParseContext, OUT PVOID *ObjectPtr)
 
NTSTATUS NTAPI ObReferenceObjectByHandle (IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
 

Macro Definition Documentation

◆ NDEBUG

#define NDEBUG

Definition at line 15 of file obref.c.

Function Documentation

◆ ObDereferenceObject()

VOID NTAPI ObDereferenceObject ( IN PVOID  Object)

Definition at line 373 of file obref.c.

374 {
375  /* Call the fastcall function */
377 }
LONG_PTR FASTCALL ObfDereferenceObject(IN PVOID Object)
Definition: obref.c:318
_Must_inspect_result_ _In_ WDFCOLLECTION _In_ WDFOBJECT Object

Referenced by ObFastDereferenceObject().

◆ ObDereferenceObjectDeferDelete()

VOID NTAPI ObDereferenceObjectDeferDelete ( IN PVOID  Object)

Definition at line 358 of file obref.c.

359 {
361 
362  /* Check whether the object can now be deleted. */
363  if (!InterlockedDecrementSizeT(&Header->PointerCount))
364  {
365  /* Add us to the deferred deletion list */
367  }
368 }
#define OBJECT_TO_OBJECT_HEADER(o)
Definition: obtypes.h:111
VOID NTAPI ObpDeferObjectDeletion(IN POBJECT_HEADER Header)
Definition: obref.c:53
Definition: Header.h:8
_Must_inspect_result_ _In_ WDFCOLLECTION _In_ WDFOBJECT Object
#define InterlockedDecrementSizeT(a)
Definition: interlocked.h:153

Referenced by CmpDoCreateChild(), CmpFlushNotifiesOnKeyBodyList(), IopCompleteRequest(), and ObpDereferenceNameInfo().

◆ ObDereferenceObjectEx()

LONG FASTCALL ObDereferenceObjectEx ( IN PVOID  Object,
IN LONG  Count 
)

Definition at line 88 of file obref.c.

90 {
92  LONG_PTR NewCount;
93 
94  /* Extract the object header */
96 
97  /* Check whether the object can now be deleted. */
98  NewCount = InterlockedExchangeAddSizeT(&Header->PointerCount, -Count) - Count;
99  if (!NewCount) ObpDeferObjectDeletion(Header);
100 
101  /* Return the current count */
102  return NewCount;
103 }
#define OBJECT_TO_OBJECT_HEADER(o)
Definition: obtypes.h:111
VOID NTAPI ObpDeferObjectDeletion(IN POBJECT_HEADER Header)
Definition: obref.c:53
Definition: Header.h:8
int Count
Definition: noreturn.cpp:7
#define InterlockedExchangeAddSizeT(a, b)
Definition: interlocked.h:196
_Must_inspect_result_ _In_ WDFCOLLECTION _In_ WDFOBJECT Object
__int3264 LONG_PTR
Definition: mstsclib_h.h:276

Referenced by ExpTimerApcKernelRoutine(), ExTimerRundown(), NtCancelTimer(), NtSetTimer(), ObFastReferenceObject(), ObFastReplaceObject(), and PspCreateThread().

◆ ObFastDereferenceObject()

VOID FASTCALL ObFastDereferenceObject ( IN PEX_FAST_REF  FastRef,
IN PVOID  Object 
)

Definition at line 167 of file obref.c.

169 {
170  /* Release a fast reference. If this failed, use the slow path */
172 }
VOID NTAPI ObDereferenceObject(IN PVOID Object)
Definition: obref.c:373
FORCEINLINE BOOLEAN ExReleaseFastReference(IN PEX_FAST_REF FastRef, IN PVOID Object)
Definition: ex.h:664
_Must_inspect_result_ _In_ WDFCOLLECTION _In_ WDFOBJECT Object

Referenced by NtOpenThreadTokenEx(), PsImpersonateClient(), PspCreateProcess(), PspCreateThread(), PspExitThread(), PspInitializeProcessSecurity(), PspSetPrimaryToken(), SeIsTokenChild(), SeIsTokenSibling(), SepImpersonateAnonymousToken(), and SeReleaseSubjectContext().

◆ ObFastReferenceObject()

PVOID FASTCALL ObFastReferenceObject ( IN PEX_FAST_REF  FastRef)

Definition at line 132 of file obref.c.

133 {
134  EX_FAST_REF OldValue;
136  PVOID Object;
137 
138  /* Reference the object and get it pointer */
139  OldValue = ExAcquireFastReference(FastRef);
140  Object = ExGetObjectFastReference(OldValue);
141 
142  /* Check how many references are left */
143  Count = ExGetCountFastReference(OldValue);
144 
145  /* Check if the reference count is over 1 */
146  if (Count > 1) return Object;
147 
148  /* Check if the reference count has reached 0 */
149  if (!Count) return NULL;
150 
151  /* Otherwise, reference the object 7 times */
153 
154  /* Now update the reference count */
155  if (!ExInsertFastReference(FastRef, Object))
156  {
157  /* We failed: completely dereference the object */
159  }
160 
161  /* Return the Object */
162  return Object;
163 }
LONG FASTCALL ObReferenceObjectEx(IN PVOID Object, IN LONG Count)
Definition: obref.c:77
FORCEINLINE PVOID ExGetObjectFastReference(IN EX_FAST_REF FastRef)
Definition: ex.h:559
FORCEINLINE BOOLEAN ExInsertFastReference(IN OUT PEX_FAST_REF FastRef, IN PVOID Object)
Definition: ex.h:625
uint32_t ULONG_PTR
Definition: typedefs.h:65
FORCEINLINE EX_FAST_REF ExAcquireFastReference(IN OUT PEX_FAST_REF FastRef)
Definition: ex.h:596
LONG FASTCALL ObDereferenceObjectEx(IN PVOID Object, IN LONG Count)
Definition: obref.c:88
int Count
Definition: noreturn.cpp:7
FORCEINLINE ULONG ExGetCountFastReference(IN EX_FAST_REF FastRef)
Definition: ex.h:567
_Must_inspect_result_ _In_ WDFCOLLECTION _In_ WDFOBJECT Object
#define NULL
Definition: types.h:112
#define MAX_FAST_REFS
Definition: ex.h:131

Referenced by PsReferenceEffectiveToken(), and PsReferencePrimaryToken().

◆ ObFastReferenceObjectLocked()

PVOID FASTCALL ObFastReferenceObjectLocked ( IN PEX_FAST_REF  FastRef)

Definition at line 119 of file obref.c.

120 {
121  PVOID Object;
122  EX_FAST_REF OldValue = *FastRef;
123 
124  /* Get the object and reference it slowly */
125  Object = ExGetObjectFastReference(OldValue);
127  return Object;
128 }
FORCEINLINE PVOID ExGetObjectFastReference(IN EX_FAST_REF FastRef)
Definition: ex.h:559
_Must_inspect_result_ _In_ WDFCOLLECTION _In_ WDFOBJECT Object
#define ObReferenceObject
Definition: obfuncs.h:204

Referenced by PsReferenceEffectiveToken(), and PsReferencePrimaryToken().

◆ ObFastReplaceObject()

PVOID FASTCALL ObFastReplaceObject ( IN PEX_FAST_REF  FastRef,
PVOID  Object 
)

Definition at line 176 of file obref.c.

178 {
179  EX_FAST_REF OldValue;
180  PVOID OldObject;
181  ULONG Count;
182 
183  /* Check if we were given an object and reference it 7 times */
185 
186  /* Do the swap */
187  OldValue = ExSwapFastReference(FastRef, Object);
188  OldObject = ExGetObjectFastReference(OldValue);
189 
190  /* Check if we had an active object and dereference it */
191  Count = ExGetCountFastReference(OldValue);
192  if ((OldObject) && (Count)) ObDereferenceObjectEx(OldObject, Count);
193 
194  /* Return the old object */
195  return OldObject;
196 }
LONG FASTCALL ObReferenceObjectEx(IN PVOID Object, IN LONG Count)
Definition: obref.c:77
FORCEINLINE PVOID ExGetObjectFastReference(IN EX_FAST_REF FastRef)
Definition: ex.h:559
FORCEINLINE EX_FAST_REF ExSwapFastReference(IN PEX_FAST_REF FastRef, IN PVOID Object)
Definition: ex.h:699
LONG FASTCALL ObDereferenceObjectEx(IN PVOID Object, IN LONG Count)
Definition: obref.c:88
int Count
Definition: noreturn.cpp:7
FORCEINLINE ULONG ExGetCountFastReference(IN EX_FAST_REF FastRef)
Definition: ex.h:567
_Must_inspect_result_ _In_ WDFCOLLECTION _In_ WDFOBJECT Object
unsigned int ULONG
Definition: retypes.h:1
#define MAX_FAST_REFS
Definition: ex.h:131

◆ ObfDereferenceObject()

LONG_PTR FASTCALL ObfDereferenceObject ( IN PVOID  Object)

Definition at line 318 of file obref.c.

319 {
321  LONG_PTR NewCount;
322 
323  /* Extract the object header */
325 
326  if (Header->PointerCount < Header->HandleCount)
327  {
328  DPRINT1("Misbehaving object: %wZ\n", &Header->Type->Name);
329  return Header->PointerCount;
330  }
331 
332  /* Check whether the object can now be deleted. */
333  NewCount = InterlockedDecrementSizeT(&Header->PointerCount);
334  if (!NewCount)
335  {
336  /* Sanity check */
337  ASSERT(Header->HandleCount == 0);
338 
339  /* Check if APCs are still active */
340  if (!KeAreAllApcsDisabled())
341  {
342  /* Remove the object */
344  }
345  else
346  {
347  /* Add us to the deferred deletion list */
349  }
350  }
351 
352  /* Return the new count */
353  return NewCount;
354 }
BOOLEAN NTAPI KeAreAllApcsDisabled(VOID)
Definition: apc.c:985
#define OBJECT_TO_OBJECT_HEADER(o)
Definition: obtypes.h:111
VOID NTAPI ObpDeferObjectDeletion(IN POBJECT_HEADER Header)
Definition: obref.c:53
#define FALSE
Definition: types.h:117
Definition: Header.h:8
VOID NTAPI ObpDeleteObject(IN PVOID Object, IN BOOLEAN CalledFromWorkerThread)
Definition: oblife.c:148
#define ASSERT(a)
Definition: mode.c:45
_Must_inspect_result_ _In_ WDFCOLLECTION _In_ WDFOBJECT Object
__int3264 LONG_PTR
Definition: mstsclib_h.h:276
#define DPRINT1
Definition: precomp.h:8
#define InterlockedDecrementSizeT(a)
Definition: interlocked.h:153

Referenced by ObDereferenceObject().

◆ ObfReferenceObject()

LONG_PTR FASTCALL ObfReferenceObject ( IN PVOID  Object)

Definition at line 308 of file obref.c.

309 {
310  ASSERT(Object);
311 
312  /* Get the header and increment the reference count */
314 }
#define OBJECT_TO_OBJECT_HEADER(o)
Definition: obtypes.h:111
#define InterlockedIncrementSizeT(a)
Definition: interlocked.h:220
#define ASSERT(a)
Definition: mode.c:45
_Must_inspect_result_ _In_ WDFCOLLECTION _In_ WDFOBJECT Object

◆ ObInitializeFastReference()

VOID FASTCALL ObInitializeFastReference ( IN PEX_FAST_REF  FastRef,
IN PVOID Object  OPTIONAL 
)

Definition at line 107 of file obref.c.

109 {
110  /* Check if we were given an object and reference it 7 times */
112 
113  /* Setup the fast reference */
115 }
LONG FASTCALL ObReferenceObjectEx(IN PVOID Object, IN LONG Count)
Definition: obref.c:77
FORCEINLINE VOID ExInitializeFastReference(OUT PEX_FAST_REF FastRef, IN OPTIONAL PVOID Object)
Definition: ex.h:575
_Must_inspect_result_ _In_ WDFCOLLECTION _In_ WDFOBJECT Object
#define MAX_FAST_REFS
Definition: ex.h:131

Referenced by PspInitializeProcessSecurity(), SeAssignPrimaryToken(), and SepInitializationPhase0().

◆ ObpDeferObjectDeletion()

VOID NTAPI ObpDeferObjectDeletion ( IN POBJECT_HEADER  Header)

Definition at line 53 of file obref.c.

54 {
55  PVOID Entry;
56 
57  /* Loop while trying to update the list */
58  do
59  {
60  /* Get the current entry */
62 
63  /* Link our object to the list */
64  Header->NextToFree = Entry;
65 
66  /* Update the list */
68  Header,
69  Entry) != Entry);
70 
71  /* Queue the work item if needed */
73 }
VOID NTAPI ExQueueWorkItem(IN PWORK_QUEUE_ITEM WorkItem, IN WORK_QUEUE_TYPE QueueType)
Definition: work.c:711
struct _Entry Entry
Definition: kefuncs.h:627
WORK_QUEUE_ITEM ObpReaperWorkItem
Definition: oblife.c:28
Definition: Header.h:8
#define InterlockedCompareExchangePointer
Definition: interlocked.h:129
volatile PVOID ObpReaperList
Definition: oblife.c:29
base of all file and directory entries
Definition: entries.h:82

Referenced by ObDereferenceObjectDeferDelete(), ObDereferenceObjectEx(), and ObfDereferenceObject().

◆ ObReferenceFileObjectForWrite()

NTSTATUS NTAPI ObReferenceFileObjectForWrite ( IN HANDLE  Handle,
IN KPROCESSOR_MODE  AccessMode,
OUT PFILE_OBJECT FileObject,
OUT POBJECT_HANDLE_INFORMATION  HandleInformation 
)

Definition at line 200 of file obref.c.

204 {
207  POBJECT_HEADER ObjectHeader;
208  PHANDLE_TABLE_ENTRY HandleEntry;
210 
211  /* Assume failure */
212  *FileObject = NULL;
213 
214  /* Check if this is a special handle */
215  if (HandleToLong(Handle) < 0)
216  {
217  /* Make sure we have a valid kernel handle */
219  {
220  return STATUS_INVALID_HANDLE;
221  }
222 
223  /* Use the kernel handle table and get the actual handle value */
226  }
227  else
228  {
229  /* Otherwise use this process's handle table */
230  HandleTable = PsGetCurrentProcess()->ObjectTable;
231  }
232 
233  ASSERT(HandleTable != NULL);
235 
236  /* Get the handle entry */
237  HandleEntry = ExMapHandleToPointer(HandleTable, Handle);
238  if (HandleEntry)
239  {
240  /* Get the object header and validate the type*/
241  ObjectHeader = ObpGetHandleObject(HandleEntry);
242 
243  /* Get the desired access from the file object */
245  &DesiredAccess)))
246  {
248  }
249  else
250  {
251  /* Extract the granted access from the handle entry */
253  {
254  /* FIXME: Translate granted access */
255  GrantedAccess = HandleEntry->GrantedAccess;
256  }
257  else
258  {
260  }
261 
262  /* FIXME: Get handle information for audit */
263 
264  HandleInformation->GrantedAccess = GrantedAccess;
265 
266  /* FIXME: Get handle attributes */
267  HandleInformation->HandleAttributes = 0;
268 
269  /* Do granted and desired access match? */
271  {
272  /* FIXME: Audit access if required */
273 
274  /* Reference the object directly since we have its header */
275  InterlockedIncrementSizeT(&ObjectHeader->PointerCount);
276 
277  /* Unlock the handle */
280 
281  *FileObject = (PFILE_OBJECT)&ObjectHeader->Body;
282 
283  /* Return success */
284  ASSERT(*FileObject != NULL);
285  return STATUS_SUCCESS;
286  }
287 
288  /* No match, deny write access */
290 
292  }
293  }
294  else
295  {
297  }
298 
299  /* Return failure status */
301  return Status;
302 }
_Must_inspect_result_ _In_ WDFDEVICE _In_ ULONG _In_ ACCESS_MASK DesiredAccess
Definition: wdfdevice.h:2654
#define BooleanFlagOn(F, SF)
Definition: ext2fs.h:183
PHANDLE_TABLE_ENTRY NTAPI ExMapHandleToPointer(IN PHANDLE_TABLE HandleTable, IN HANDLE Handle)
Definition: handle.c:1010
LONG NTSTATUS
Definition: precomp.h:26
#define NtCurrentThread()
static XMS_HANDLE HandleTable[XMS_MAX_HANDLES]
Definition: himem.c:83
VOID NTAPI ExUnlockHandleTableEntry(IN PHANDLE_TABLE HandleTable, IN PHANDLE_TABLE_ENTRY HandleTableEntry)
Definition: handle.c:887
#define STATUS_INVALID_HANDLE
Definition: ntstatus.h:245
#define InterlockedIncrementSizeT(a)
Definition: interlocked.h:220
_In_ PEPROCESS _In_ KPROCESSOR_MODE AccessMode
Definition: mmfuncs.h:395
#define PsGetCurrentProcess
Definition: psfuncs.h:17
Definition: extypes.h:595
#define ObpGetHandleObject(x)
Definition: ob.h:86
PHANDLE_TABLE ObpKernelHandleTable
Definition: obhandle.c:20
_In_ WDFREQUEST _In_ WDFFILEOBJECT FileObject
Definition: wdfdevice.h:547
#define NtCurrentProcess()
Definition: nt_native.h:1657
Status
Definition: gdiplustypes.h:24
#define STATUS_OBJECT_TYPE_MISMATCH
Definition: ntstatus.h:273
#define ASSERT(a)
Definition: mode.c:45
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
ULONG GrantedAccess
Definition: extypes.h:606
NTSTATUS NTAPI IoComputeDesiredAccessFileObject(IN PFILE_OBJECT FileObject, IN PACCESS_MASK DesiredAccess)
Definition: util.c:26
_In_ ACCESS_MASK _In_opt_ POBJECT_TYPE _In_ KPROCESSOR_MODE _Out_ PVOID _Out_opt_ POBJECT_HANDLE_INFORMATION HandleInformation
Definition: obfuncs.h:40
#define STATUS_ACCESS_DENIED
Definition: udferr_usr.h:145
* PFILE_OBJECT
Definition: iotypes.h:1998
#define KeEnterCriticalRegion()
Definition: ke_x.h:88
#define KeLeaveCriticalRegion()
Definition: ke_x.h:119
LONG_PTR PointerCount
Definition: obtypes.h:487
#define NULL
Definition: types.h:112
#define FLG_KERNEL_STACK_TRACE_DB
Definition: pstypes.h:68
_In_ HANDLE Handle
Definition: extypes.h:390
#define ObpAccessProtectCloseBit
Definition: ob.h:59
#define STATUS_SUCCESS
Definition: shellext.h:65
#define ObKernelHandleToHandle(Handle)
Definition: ob.h:78
_In_ PSECURITY_SUBJECT_CONTEXT _In_ BOOLEAN _In_ ACCESS_MASK _In_ ACCESS_MASK _Outptr_opt_ PPRIVILEGE_SET _In_ PGENERIC_MAPPING _In_ KPROCESSOR_MODE _Out_ PACCESS_MASK GrantedAccess
Definition: sefuncs.h:13
ULONG NtGlobalFlag
Definition: init.c:52
ULONG ACCESS_MASK
Definition: nt_native.h:40
#define HandleToLong(h)
Definition: basetsd.h:80

Referenced by NtWriteFile().

◆ ObReferenceObjectByHandle()

NTSTATUS NTAPI ObReferenceObjectByHandle ( IN HANDLE  Handle,
IN ACCESS_MASK  DesiredAccess,
IN POBJECT_TYPE  ObjectType,
IN KPROCESSOR_MODE  AccessMode,
OUT PVOID Object,
OUT POBJECT_HANDLE_INFORMATION HandleInformation  OPTIONAL 
)

Definition at line 494 of file obref.c.

500 {
501  PHANDLE_TABLE_ENTRY HandleEntry;
502  POBJECT_HEADER ObjectHeader;
507  PETHREAD CurrentThread;
509  PAGED_CODE();
510 
511  /* Assume failure */
512  *Object = NULL;
513 
514  /* Check if this is a special handle */
515  if (HandleToLong(Handle) < 0)
516  {
517  /* Check if this is the current process */
518  if (Handle == NtCurrentProcess())
519  {
520  /* Check if this is the right object type */
521  if ((ObjectType == PsProcessType) || !(ObjectType))
522  {
523  /* Get the current process and granted access */
525  GrantedAccess = CurrentProcess->GrantedAccess;
526 
527  /* Validate access */
528  /* ~GrantedAccess = RefusedAccess.*/
529  /* ~GrantedAccess & DesiredAccess = list of refused bits. */
530  /* !(~GrantedAccess & DesiredAccess) == TRUE means ALL requested rights are granted */
531  if ((AccessMode == KernelMode) ||
533  {
534  /* Check if the caller wanted handle information */
535  if (HandleInformation)
536  {
537  /* Return it */
538  HandleInformation->HandleAttributes = 0;
539  HandleInformation->GrantedAccess = GrantedAccess;
540  }
541 
542  /* Reference ourselves */
543  ObjectHeader = OBJECT_TO_OBJECT_HEADER(CurrentProcess);
544  InterlockedExchangeAddSizeT(&ObjectHeader->PointerCount, 1);
545 
546  /* Return the pointer */
548  ASSERT(*Object != NULL);
550  }
551  else
552  {
553  /* Access denied */
555  }
556  }
557  else
558  {
559  /* The caller used this special handle value with a non-process type */
561  }
562 
563  /* Return the status */
564  return Status;
565  }
566  else if (Handle == NtCurrentThread())
567  {
568  /* Check if this is the right object type */
569  if ((ObjectType == PsThreadType) || !(ObjectType))
570  {
571  /* Get the current process and granted access */
572  CurrentThread = PsGetCurrentThread();
573  GrantedAccess = CurrentThread->GrantedAccess;
574 
575  /* Validate access */
576  /* ~GrantedAccess = RefusedAccess.*/
577  /* ~GrantedAccess & DesiredAccess = list of refused bits. */
578  /* !(~GrantedAccess & DesiredAccess) == TRUE means ALL requested rights are granted */
579  if ((AccessMode == KernelMode) ||
581  {
582  /* Check if the caller wanted handle information */
583  if (HandleInformation)
584  {
585  /* Return it */
586  HandleInformation->HandleAttributes = 0;
587  HandleInformation->GrantedAccess = GrantedAccess;
588  }
589 
590  /* Reference ourselves */
591  ObjectHeader = OBJECT_TO_OBJECT_HEADER(CurrentThread);
592  InterlockedExchangeAddSizeT(&ObjectHeader->PointerCount, 1);
593 
594  /* Return the pointer */
595  *Object = CurrentThread;
596  ASSERT(*Object != NULL);
598  }
599  else
600  {
601  /* Access denied */
603  }
604  }
605  else
606  {
607  /* The caller used this special handle value with a non-process type */
609  }
610 
611  /* Return the status */
612  return Status;
613  }
614  else if (AccessMode == KernelMode)
615  {
616  /* Use the kernel handle table and get the actual handle value */
619  }
620  else
621  {
622  /* Invalid access, fail */
623  return STATUS_INVALID_HANDLE;
624  }
625  }
626  else
627  {
628  /* Otherwise use this process's handle table */
629  HandleTable = PsGetCurrentProcess()->ObjectTable;
630  }
631 
632  /* Enter a critical region while we touch the handle table */
633  ASSERT(HandleTable != NULL);
635 
636  /* Get the handle entry */
637  HandleEntry = ExMapHandleToPointer(HandleTable, Handle);
638  if (HandleEntry)
639  {
640  /* Get the object header and validate the type*/
641  ObjectHeader = ObpGetHandleObject(HandleEntry);
642  if (!(ObjectType) || (ObjectType == ObjectHeader->Type))
643  {
644  /* Get the granted access and validate it */
645  GrantedAccess = HandleEntry->GrantedAccess;
646 
647  /* Validate access */
648  /* ~GrantedAccess = RefusedAccess.*/
649  /* ~GrantedAccess & DesiredAccess = list of refused bits. */
650  /* !(~GrantedAccess & DesiredAccess) == TRUE means ALL requested rights are granted */
651  if ((AccessMode == KernelMode) ||
653  {
654  /* Reference the object directly since we have its header */
655  InterlockedIncrementSizeT(&ObjectHeader->PointerCount);
656 
657  /* Mask out the internal attributes */
659 
660  /* Check if the caller wants handle information */
661  if (HandleInformation)
662  {
663  /* Fill out the information */
664  HandleInformation->HandleAttributes = Attributes;
665  HandleInformation->GrantedAccess = GrantedAccess;
666  }
667 
668  /* Return the pointer */
669  *Object = &ObjectHeader->Body;
670 
671  /* Unlock the handle */
674 
675  /* Return success */
676  ASSERT(*Object != NULL);
677  return STATUS_SUCCESS;
678  }
679  else
680  {
681  /* Requested access failed */
682  DPRINT("Rights not granted: %x\n", ~GrantedAccess & DesiredAccess);
684  }
685  }
686  else
687  {
688  /* Invalid object type */
690  }
691 
692  /* Unlock the entry */
694  }
695  else
696  {
697  /* Invalid handle */
699  }
700 
701  /* Return failure status */
703  *Object = NULL;
704  return Status;
705 }
ObjectType
Definition: metafile.c:80
_Must_inspect_result_ _In_ WDFDEVICE _In_ ULONG _In_ ACCESS_MASK DesiredAccess
Definition: wdfdevice.h:2654
#define PsGetCurrentThread()
Definition: env_spec_w32.h:81
ULONG_PTR ObAttributes
Definition: extypes.h:600
PHANDLE_TABLE_ENTRY NTAPI ExMapHandleToPointer(IN PHANDLE_TABLE HandleTable, IN HANDLE Handle)
Definition: handle.c:1010
LONG NTSTATUS
Definition: precomp.h:26
#define NtCurrentThread()
static XMS_HANDLE HandleTable[XMS_MAX_HANDLES]
Definition: himem.c:83
VOID NTAPI ExUnlockHandleTableEntry(IN PHANDLE_TABLE HandleTable, IN PHANDLE_TABLE_ENTRY HandleTableEntry)
Definition: handle.c:887
#define STATUS_INVALID_HANDLE
Definition: ntstatus.h:245
#define OBJECT_TO_OBJECT_HEADER(o)
Definition: obtypes.h:111
#define InterlockedIncrementSizeT(a)
Definition: interlocked.h:220
_In_ PEPROCESS _In_ KPROCESSOR_MODE AccessMode
Definition: mmfuncs.h:395
#define PsGetCurrentProcess
Definition: psfuncs.h:17
Definition: extypes.h:595
#define ObpGetHandleObject(x)
Definition: ob.h:86
PHANDLE_TABLE ObpKernelHandleTable
Definition: obhandle.c:20
#define NtCurrentProcess()
Definition: nt_native.h:1657
Status
Definition: gdiplustypes.h:24
#define STATUS_OBJECT_TYPE_MISMATCH
Definition: ntstatus.h:273
ULONG CurrentProcess
Definition: shell.c:125
#define ASSERT(a)
Definition: mode.c:45
ULONG GrantedAccess
Definition: extypes.h:606
_In_ ACCESS_MASK _In_opt_ POBJECT_TYPE _In_ KPROCESSOR_MODE _Out_ PVOID _Out_opt_ POBJECT_HANDLE_INFORMATION HandleInformation
Definition: obfuncs.h:40
#define STATUS_ACCESS_DENIED
Definition: udferr_usr.h:145
POBJECT_TYPE PsThreadType
Definition: thread.c:20
#define InterlockedExchangeAddSizeT(a, b)
Definition: interlocked.h:196
#define KeEnterCriticalRegion()
Definition: ke_x.h:88
_Must_inspect_result_ _In_ WDFCOLLECTION _In_ WDFOBJECT Object
#define KeLeaveCriticalRegion()
Definition: ke_x.h:119
LONG_PTR PointerCount
Definition: obtypes.h:487
#define NULL
Definition: types.h:112
_In_ HANDLE Handle
Definition: extypes.h:390
unsigned int ULONG
Definition: retypes.h:1
#define STATUS_SUCCESS
Definition: shellext.h:65
#define ObKernelHandleToHandle(Handle)
Definition: ob.h:78
#define DPRINT
Definition: sndvol32.h:71
POBJECT_TYPE Type
Definition: obtypes.h:493
#define OBJ_HANDLE_ATTRIBUTES
Definition: ob.h:52
_In_ PSECURITY_SUBJECT_CONTEXT _In_ BOOLEAN _In_ ACCESS_MASK _In_ ACCESS_MASK _Outptr_opt_ PPRIVILEGE_SET _In_ PGENERIC_MAPPING _In_ KPROCESSOR_MODE _Out_ PACCESS_MASK GrantedAccess
Definition: sefuncs.h:13
POBJECT_TYPE PsProcessType
Definition: process.c:20
ULONG ACCESS_MASK
Definition: nt_native.h:40
#define HandleToLong(h)
Definition: basetsd.h:80
#define PAGED_CODE()
_Must_inspect_result_ _In_ WDFDMAENABLER _In_ _In_opt_ PWDF_OBJECT_ATTRIBUTES Attributes

Referenced by _IRQL_requires_max_(), _Success_(), add_device(), AdvancedErrorChecks(), AfdAccept(), AfdEnumEvents(), AfdEventSelect(), BasicBehaviorChecks(), BehaviorChecks(), BroadcastOpen(), CmGetSystemDriverList(), CmpConvertHandleToKernelHandle(), CmpCreateEvent(), CmpCreateRegistryRoot(), CmpIsHiveAlreadyLoaded(), CmpLinkHiveToMaster(), CompBattGetDeviceObjectPointer(), Control(), create_snapshot(), CreateGreenFdo(), CreateMixerPinAndSetFormat(), FxSystemThread::CreateThread(), DispTdiAssociateAddress(), DriverEntry(), duplicate_extents(), EngMapEvent(), ExCreateCallback(), ExpCreateWorkerThread(), ExpInitializeWorkerThreads(), ExpInitNls(), Ext2InvalidateVolumes(), FFSInvalidateVolumes(), FsRtlTest_OpenTestDirectory(), FsRtlTest_OpenTestFile(), GetObjectType(), IKsPin_PinMasterClock(), InitCsrApiPort(), InitThreadCallback(), IntCreateDesktop(), IntGdiAddFontResourceEx(), IntResolveDesktop(), IntValidateDesktopHandle(), IntValidateWindowStationHandle(), invalidate_volumes(), IoCreateDriver(), IopCreateEvent(), IopDeviceFsIoControl(), IopGetDeviceObjectPointer(), IopInitializeDriverModule(), IopMarkBootPartition(), IopOpenLinkOrRenameTarget(), KernelModeTest(), KmtStartThread(), KspEnableEvent(), LockHandles(), LpcpCopyRequestData(), MiCreateMemoryEvent(), MiQueryMemoryBasicInformation(), MiQueryMemorySectionName(), MmCreateArm3Section(), MmCreateSection(), MmLoadSystemImage(), MountMgrVolumeMountPointChanged(), Mx::MxReferenceObjectByHandle(), nfs41_DeleteConnection(), NtAccessCheck(), NtAdjustPrivilegesToken(), NtAlertResumeThread(), NtAlertThread(), NtAllocateVirtualMemory(), NtAssignProcessToJobObject(), NtCancelIoFile(), NtCancelTimer(), NtClearEvent(), NtCompareTokens(), NtCompleteConnectPort(), NtCreatePagingFile(), NtCreateProfile(), NtDebugActiveProcess(), NtDebugContinue(), NtDeleteKey(), NtDeleteValueKey(), NtDuplicateObject(), NtDuplicateToken(), NtEnumerateKey(), NtEnumerateValueKey(), NtExtendSection(), NtFlushBuffersFile(), NtFlushInstructionCache(), NtFlushKey(), NtFlushVirtualMemory(), NtFreeVirtualMemory(), NtGetContextThread(), NtGetWriteWatch(), NtImpersonateAnonymousToken(), NtImpersonateClientOfPort(), NtImpersonateThread(), NtIsProcessInJob(), NtLoadKeyEx(), NtLockFile(), NtLockVirtualMemory(), NtMakePermanentObject(), NtMakeTemporaryObject(), NtMapViewOfSection(), NtNotifyChangeDirectoryFile(), NtOpenObjectAuditAlarm(), NtOpenThreadTokenEx(), NtPrivilegeCheck(), NtPrivilegedServiceAuditAlarm(), NtProtectVirtualMemory(), NtPulseEvent(), NtQueryDirectoryFile(), NtQueryDirectoryObject(), NtQueryEvent(), NtQueryInformationFile(), NtQueryInformationJobObject(), NtQueryInformationProcess(), NtQueryInformationThread(), NtQueryInformationToken(), NtQueryIoCompletion(), NtQueryKey(), NtQueryMutant(), NtQueryObject(), NtQueryOpenSubKeys(), NtQuerySection(), NtQuerySecurityObject(), NtQuerySemaphore(), NtQuerySymbolicLinkObject(), NtQueryTimer(), NtQueryValueKey(), NtQueryVolumeInformationFile(), NtQueueApcThreadEx(), NtReadFile(), NtReadVirtualMemory(), NtRegisterThreadTerminatePort(), NtReleaseMutant(), NtReleaseSemaphore(), NtRemoveIoCompletion(), NtRemoveProcessDebug(), NtReplyPort(), NtReplyWaitReceivePortEx(), NtRequestPort(), NtRequestWaitReplyPort(), NtResetEvent(), NtResetWriteWatch(), NtResumeProcess(), NtResumeThread(), NtSaveKeyEx(), NtSaveMergedKeys(), NtSecureConnectPort(), NtSetContextThread(), NtSetDefaultHardErrorPort(), NtSetEvent(), NtSetEventBoostPriority(), NtSetHighEventPair(), NtSetHighWaitLowEventPair(), NtSetInformationDebugObject(), NtSetInformationFile(), NtSetInformationJobObject(), NtSetInformationObject(), NtSetInformationProcess(), NtSetInformationThread(), NtSetInformationToken(), NtSetIoCompletion(), NtSetLowEventPair(), NtSetLowWaitHighEventPair(), NtSetSecurityObject(), NtSetTimer(), NtSetValueKey(), NtSetVolumeInformationFile(), NtSignalAndWaitForSingleObject(), NtStartProfile(), NtStopProfile(), NtSuspendProcess(), NtSuspendThread(), NtTerminateJobObject(), NtTerminateProcess(), NtTerminateThread(), NtUnloadKey2(), NtUnlockFile(), NtUnlockVirtualMemory(), NtUnmapViewOfSection(), NtUserConsoleControl(), NtUserGetGuiResources(), NtUserGetObjectInformation(), NtUserGetThreadDesktop(), NtUserProcessConnect(), NtUserQueryInformationThread(), NtUserResolveDesktop(), NtUserSetInformationThread(), NtUserWaitForInputIdle(), NtWaitForDebugEvent(), NtWaitForSingleObject(), NtWaitHighEventPair(), NtWaitLowEventPair(), NtWriteFile(), NtWriteVirtualMemory(), ObInitSystem(), ObpLookupObjectName(), ObSetDeviceMap(), ObSetDirectoryDeviceMap(), ObtCreateObjectTypes(), OpenDevice(), OpenInputDevice(), FxIoTargetRemote::OpenTargetHandle(), PageFileBehaviorChecks(), Pin_fnDeviceIoControl(), Pin_fnWrite(), PopAddRemoveSysCapsCallback(), PsAssignImpersonationToken(), PsLocateSystemDll(), PsOpenTokenOfProcess(), PspAssignPrimaryToken(), PspCreateProcess(), PspCreateThread(), PspInitPhase0(), PspSetPrimaryToken(), RegisterUncProvider(), RfsdInvalidateVolumes(), send_subvol(), SepAccessCheckAndAuditAlarm(), START_TEST(), StartThread(), SystemProcessTest(), TdiOpenDevice(), TdiUnload(), TestEventConcurrent(), TestIoCreateFile(), TestObRootSecurity(), TestProviderInfo(), TestReference(), TestSharedCacheMap(), TestSymlinks(), TestTcpConnect(), UDFCommonDeviceControl(), UDFInvalidateVolumes(), UserSetProcessWindowStation(), VerifyEventWaitable(), VfatSetRenameInformation(), VfdCreateDevice(), VfdOpenImage(), ViMountImage(), WdmAudControlDeviceState(), WdmAudControlOpenMixer(), WdmAudFrameSize(), WdmAudOpenSysAudioDevices(), WdmAudReadWrite(), and WdmAudResetStream().

◆ ObReferenceObjectByName()

NTSTATUS NTAPI ObReferenceObjectByName ( IN PUNICODE_STRING  ObjectPath,
IN ULONG  Attributes,
IN PACCESS_STATE  PassedAccessState,
IN ACCESS_MASK  DesiredAccess,
IN POBJECT_TYPE  ObjectType,
IN KPROCESSOR_MODE  AccessMode,
IN OUT PVOID  ParseContext,
OUT PVOID ObjectPtr 
)

Definition at line 409 of file obref.c.

417 {
418  PVOID Object = NULL;
422  AUX_ACCESS_DATA AuxData;
424  PAGED_CODE();
425 
426  /* Fail quickly */
427  if (!ObjectPath) return STATUS_OBJECT_NAME_INVALID;
428 
429  /* Capture the name */
431  if (!NT_SUCCESS(Status)) return Status;
432 
433  /* We also need a valid name after capture */
434  if (!ObjectName.Length) return STATUS_OBJECT_NAME_INVALID;
435 
436  /* Check if we didn't get an access state */
437  if (!PassedAccessState)
438  {
439  /* Use our built-in access state */
442  &AuxData,
444  &ObjectType->TypeInfo.GenericMapping);
445  if (!NT_SUCCESS(Status)) goto Quickie;
446  }
447 
448  /* Find the object */
449  *ObjectPtr = NULL;
451  &ObjectName,
452  Attributes,
453  ObjectType,
454  AccessMode,
455  ParseContext,
456  NULL,
457  NULL,
459  &Context,
460  &Object);
461 
462  /* Cleanup after lookup */
464 
465  /* Check if the lookup succeeded */
466  if (NT_SUCCESS(Status))
467  {
468  /* Check if access is allowed */
471  FALSE,
472  AccessMode,
473  &Status))
474  {
475  /* Return the object */
476  *ObjectPtr = Object;
477  }
478  }
479 
480  /* Free the access state */
482  {
484  }
485 
486 Quickie:
487  /* Free the captured name if we had one, and return status */
489  return Status;
490 }
ObjectType
Definition: metafile.c:80
BOOLEAN NTAPI ObpCheckObjectReference(IN PVOID Object, IN OUT PACCESS_STATE AccessState, IN BOOLEAN LockHeld, IN KPROCESSOR_MODE AccessMode, OUT PNTSTATUS AccessStatus)
Definition: obsecure.c:340
_Must_inspect_result_ _In_ WDFDEVICE _In_ ULONG _In_ ACCESS_MASK DesiredAccess
Definition: wdfdevice.h:2654
NTSTATUS NTAPI SeCreateAccessState(IN OUT PACCESS_STATE AccessState, IN PAUX_ACCESS_DATA AuxData, IN ACCESS_MASK Access, IN PGENERIC_MAPPING GenericMapping)
Definition: access.c:439
#define TRUE
Definition: types.h:120
VOID NTAPI ObpFreeObjectNameBuffer(IN PUNICODE_STRING Name)
Definition: oblife.c:347
LONG NTSTATUS
Definition: precomp.h:26
_Inout_opt_ PACCESS_STATE PassedAccessState
Definition: obfuncs.h:71
_In_ PVOID _Out_opt_ PULONG_PTR _Outptr_opt_ PCUNICODE_STRING * ObjectName
Definition: cmfuncs.h:62
#define FALSE
Definition: types.h:117
_In_ PEPROCESS _In_ KPROCESSOR_MODE AccessMode
Definition: mmfuncs.h:395
Status
Definition: gdiplustypes.h:24
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:32
_In_opt_ PVOID _In_opt_ PUNICODE_STRING _In_ PSECURITY_DESCRIPTOR _In_ PACCESS_STATE AccessState
Definition: sefuncs.h:414
_Must_inspect_result_ _In_ WDFCOLLECTION _In_ WDFOBJECT Object
FORCEINLINE VOID ObpReleaseLookupContext(IN POBP_LOOKUP_CONTEXT Context)
Definition: ob_x.h:255
#define STATUS_OBJECT_NAME_INVALID
Definition: udferr_usr.h:148
VOID NTAPI SeDeleteAccessState(IN PACCESS_STATE AccessState)
Definition: access.c:460
#define NULL
Definition: types.h:112
struct tagContext Context
Definition: acpixf.h:1034
NTSTATUS NTAPI ObpCaptureObjectName(IN PUNICODE_STRING CapturedName, IN PUNICODE_STRING ObjectName, IN KPROCESSOR_MODE AccessMode, IN BOOLEAN AllocateFromLookaside)
NTSTATUS NTAPI ObpLookupObjectName(IN HANDLE RootHandle OPTIONAL, IN OUT PUNICODE_STRING ObjectName, IN ULONG Attributes, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, IN OUT PVOID ParseContext, IN PSECURITY_QUALITY_OF_SERVICE SecurityQos OPTIONAL, IN PVOID InsertObject OPTIONAL, IN OUT PACCESS_STATE AccessState, OUT POBP_LOOKUP_CONTEXT LookupContext, OUT PVOID *FoundObject)
Definition: obname.c:448
#define PAGED_CODE()
_Must_inspect_result_ _In_ WDFDMAENABLER _In_ _In_opt_ PWDF_OBJECT_ATTRIBUTES Attributes

Referenced by CreateClientPort(), IopGetDriverPathInformation(), IopUnloadDriver(), NtSecureConnectPort(), ObtClose(), PiAttachFilterDriversCallback(), and TestReference().

◆ ObReferenceObjectByPointer()

NTSTATUS NTAPI ObReferenceObjectByPointer ( IN PVOID  Object,
IN ACCESS_MASK  DesiredAccess,
IN POBJECT_TYPE  ObjectType,
IN KPROCESSOR_MODE  AccessMode 
)

Definition at line 381 of file obref.c.

385 {
387 
388  /* Get the header */
390 
391  /*
392  * Validate object type if the call is for UserMode.
393  * NOTE: Unless it's a symbolic link (Caz Yokoyama [MSFT])
394  */
395  if ((Header->Type != ObjectType) && ((AccessMode != KernelMode) ||
397  {
398  /* Invalid type */
400  }
401 
402  /* Increment the reference count and return success */
403  InterlockedIncrementSizeT(&Header->PointerCount);
404  return STATUS_SUCCESS;
405 }
ObjectType
Definition: metafile.c:80
#define OBJECT_TO_OBJECT_HEADER(o)
Definition: obtypes.h:111
Definition: Header.h:8
#define InterlockedIncrementSizeT(a)
Definition: interlocked.h:220
_In_ PEPROCESS _In_ KPROCESSOR_MODE AccessMode
Definition: mmfuncs.h:395
#define STATUS_OBJECT_TYPE_MISMATCH
Definition: ntstatus.h:273
_Must_inspect_result_ _In_ WDFCOLLECTION _In_ WDFOBJECT Object
#define ObpSymbolicLinkObjectType
Definition: ObTypes.c:124
#define STATUS_SUCCESS
Definition: shellext.h:65

Referenced by CcRosInitializeFileCache(), ClassRetrieveDeviceRelations(), co_UserCreateWindowEx(), DriverEntry(), HalpDmaAllocateChildAdapter(), IoWMIQueryAllData(), MmPageOutPhysicalAddress(), ObOpenObjectByPointer(), ObpLookupObjectName(), ObpParseSymbolicLink(), RxpWorkerThreadDispatcher(), RxSpinUpRequestsDispatcher(), ScsiClassClaimDevice(), SepImpersonateAnonymousToken(), and TestReference().

◆ ObReferenceObjectEx()

LONG FASTCALL ObReferenceObjectEx ( IN PVOID  Object,
IN LONG  Count 
)

Definition at line 77 of file obref.c.

79 {
80  /* Increment the reference count and return the count now */
82  PointerCount,
83  Count) + Count;
84 }
#define OBJECT_TO_OBJECT_HEADER(o)
Definition: obtypes.h:111
int Count
Definition: noreturn.cpp:7
#define InterlockedExchangeAddSizeT(a, b)
Definition: interlocked.h:196
_Must_inspect_result_ _In_ WDFCOLLECTION _In_ WDFOBJECT Object

Referenced by ObFastReferenceObject(), ObFastReplaceObject(), ObInitializeFastReference(), and PspCreateThread().

◆ ObReferenceObjectSafe()

BOOLEAN FASTCALL ObReferenceObjectSafe ( IN PVOID  Object)

Definition at line 22 of file obref.c.

23 {
24  POBJECT_HEADER ObjectHeader;
25  LONG_PTR OldValue, NewValue;
26 
27  /* Get the object header */
28  ObjectHeader = OBJECT_TO_OBJECT_HEADER(Object);
29 
30  /* Get the current reference count and fail if it's zero */
31  OldValue = ObjectHeader->PointerCount;
32  if (!OldValue) return FALSE;
33 
34  /* Start reference loop */
35  do
36  {
37  /* Increase the reference count */
38  NewValue = InterlockedCompareExchangeSizeT(&ObjectHeader->PointerCount,
39  OldValue + 1,
40  OldValue);
41  if (OldValue == NewValue) return TRUE;
42 
43  /* Keep looping */
44  OldValue = NewValue;
45  } while (OldValue);
46 
47  /* If we got here, then the reference count is now 0 */
48  return FALSE;
49 }
#define TRUE
Definition: types.h:120
#define OBJECT_TO_OBJECT_HEADER(o)
Definition: obtypes.h:111
#define FALSE
Definition: types.h:117
_Must_inspect_result_ _In_ WDFCOLLECTION _In_ WDFOBJECT Object
__int3264 LONG_PTR
Definition: mstsclib_h.h:276
LONG_PTR PointerCount
Definition: obtypes.h:487
#define InterlockedCompareExchangeSizeT(Destination, Exchange, Comperand)
Definition: ex.h:1516

Referenced by _Function_class_(), CmpFlushNotifiesOnKeyBodyList(), NtImpersonateClientOfPort(), NtRequestPort(), PsGetNextProcess(), PsGetNextProcessThread(), PsLookupProcessByProcessId(), PsLookupProcessThreadByCid(), PsLookupThreadByThreadId(), PspExitThread(), and SepCleanupLUIDDeviceMapDirectory().