ReactOS 0.4.15-dev-8390-g075894b
obref.c File Reference
#include <ntoskrnl.h>
#include <debug.h>
Include dependency graph for obref.c:

Go to the source code of this file.

Macros

#define NDEBUG
 

Functions

BOOLEAN FASTCALL ObReferenceObjectSafe (IN PVOID Object)
 
VOID NTAPI ObpDeferObjectDeletion (IN POBJECT_HEADER Header)
 
LONG FASTCALL ObReferenceObjectEx (IN PVOID Object, IN LONG Count)
 
LONG FASTCALL ObDereferenceObjectEx (IN PVOID Object, IN LONG Count)
 
VOID FASTCALL ObInitializeFastReference (IN PEX_FAST_REF FastRef, IN PVOID Object OPTIONAL)
 
PVOID FASTCALL ObFastReferenceObjectLocked (IN PEX_FAST_REF FastRef)
 
PVOID FASTCALL ObFastReferenceObject (IN PEX_FAST_REF FastRef)
 
VOID FASTCALL ObFastDereferenceObject (IN PEX_FAST_REF FastRef, IN PVOID Object)
 
PVOID FASTCALL ObFastReplaceObject (IN PEX_FAST_REF FastRef, PVOID Object)
 
NTSTATUS NTAPI ObReferenceFileObjectForWrite (IN HANDLE Handle, IN KPROCESSOR_MODE AccessMode, OUT PFILE_OBJECT *FileObject, OUT POBJECT_HANDLE_INFORMATION HandleInformation)
 
LONG_PTR FASTCALL ObfReferenceObject (IN PVOID Object)
 
LONG_PTR FASTCALL ObfDereferenceObject (IN PVOID Object)
 
VOID NTAPI ObDereferenceObjectDeferDelete (IN PVOID Object)
 
VOID NTAPI ObDereferenceObject (IN PVOID Object)
 
NTSTATUS NTAPI ObReferenceObjectByPointer (IN PVOID Object, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode)
 
NTSTATUS NTAPI ObReferenceObjectByName (IN PUNICODE_STRING ObjectPath, IN ULONG Attributes, IN PACCESS_STATE PassedAccessState, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, IN OUT PVOID ParseContext, OUT PVOID *ObjectPtr)
 
NTSTATUS NTAPI ObReferenceObjectByHandle (IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
 

Macro Definition Documentation

◆ NDEBUG

#define NDEBUG

Definition at line 15 of file obref.c.

Function Documentation

◆ ObDereferenceObject()

VOID NTAPI ObDereferenceObject ( IN PVOID  Object)

Definition at line 373 of file obref.c.

374{
375 /* Call the fastcall function */
377}
LONG_PTR FASTCALL ObfDereferenceObject(IN PVOID Object)
Definition: obref.c:318
_Must_inspect_result_ _In_ WDFCOLLECTION _In_ WDFOBJECT Object

◆ ObDereferenceObjectDeferDelete()

VOID NTAPI ObDereferenceObjectDeferDelete ( IN PVOID  Object)

Definition at line 358 of file obref.c.

359{
361
362 /* Check whether the object can now be deleted. */
363 if (!InterlockedDecrementSizeT(&Header->PointerCount))
364 {
365 /* Add us to the deferred deletion list */
367 }
368}
Definition: Header.h:9
#define InterlockedDecrementSizeT(a)
Definition: interlocked.h:153
#define OBJECT_TO_OBJECT_HEADER(o)
Definition: obtypes.h:111
VOID NTAPI ObpDeferObjectDeletion(IN POBJECT_HEADER Header)
Definition: obref.c:53

Referenced by CmpDoCreate(), CmpDoCreateChild(), CmpFlushNotifiesOnKeyBodyList(), IopCompleteRequest(), and ObpDereferenceNameInfo().

◆ ObDereferenceObjectEx()

LONG FASTCALL ObDereferenceObjectEx ( IN PVOID  Object,
IN LONG  Count 
)

Definition at line 88 of file obref.c.

90{
92 LONG_PTR NewCount;
93
94 /* Extract the object header */
96
97 /* Check whether the object can now be deleted. */
98 NewCount = InterlockedExchangeAddSizeT(&Header->PointerCount, -Count) - Count;
99 if (!NewCount) ObpDeferObjectDeletion(Header);
100
101 /* Return the current count */
102 return NewCount;
103}
#define InterlockedExchangeAddSizeT(a, b)
Definition: interlocked.h:196
__int3264 LONG_PTR
Definition: mstsclib_h.h:276
int Count
Definition: noreturn.cpp:7

Referenced by ExpTimerApcKernelRoutine(), ExTimerRundown(), NtCancelTimer(), NtSetTimer(), ObFastReferenceObject(), ObFastReplaceObject(), and PspCreateThread().

◆ ObFastDereferenceObject()

VOID FASTCALL ObFastDereferenceObject ( IN PEX_FAST_REF  FastRef,
IN PVOID  Object 
)

Definition at line 167 of file obref.c.

169{
170 /* Release a fast reference. If this failed, use the slow path */
172}
FORCEINLINE BOOLEAN ExReleaseFastReference(IN PEX_FAST_REF FastRef, IN PVOID Object)
Definition: ex.h:685
#define ObDereferenceObject
Definition: obfuncs.h:203

Referenced by PsImpersonateClient(), PspCreateProcess(), PspCreateThread(), PspExitThread(), PspInitializeProcessSecurity(), PspSetPrimaryToken(), SeIsTokenChild(), SeIsTokenSibling(), SepImpersonateAnonymousToken(), SepOpenThreadToken(), and SeReleaseSubjectContext().

◆ ObFastReferenceObject()

PVOID FASTCALL ObFastReferenceObject ( IN PEX_FAST_REF  FastRef)

Definition at line 132 of file obref.c.

133{
134 EX_FAST_REF OldValue;
137
138 /* Reference the object and get it pointer */
139 OldValue = ExAcquireFastReference(FastRef);
141
142 /* Check how many references are left */
143 Count = ExGetCountFastReference(OldValue);
144
145 /* Check if the reference count is over 1 */
146 if (Count > 1) return Object;
147
148 /* Check if the reference count has reached 0 */
149 if (!Count) return NULL;
150
151 /* Otherwise, reference the object 7 times */
153
154 /* Now update the reference count */
155 if (!ExInsertFastReference(FastRef, Object))
156 {
157 /* We failed: completely dereference the object */
159 }
160
161 /* Return the Object */
162 return Object;
163}
#define NULL
Definition: types.h:112
#define MAX_FAST_REFS
Definition: ex.h:133
FORCEINLINE ULONG ExGetCountFastReference(IN EX_FAST_REF FastRef)
Definition: ex.h:588
FORCEINLINE BOOLEAN ExInsertFastReference(IN OUT PEX_FAST_REF FastRef, IN PVOID Object)
Definition: ex.h:646
FORCEINLINE PVOID ExGetObjectFastReference(IN EX_FAST_REF FastRef)
Definition: ex.h:580
FORCEINLINE EX_FAST_REF ExAcquireFastReference(IN OUT PEX_FAST_REF FastRef)
Definition: ex.h:617
LONG FASTCALL ObDereferenceObjectEx(IN PVOID Object, IN LONG Count)
Definition: obref.c:88
LONG FASTCALL ObReferenceObjectEx(IN PVOID Object, IN LONG Count)
Definition: obref.c:77
uint32_t ULONG_PTR
Definition: typedefs.h:65

Referenced by PsReferenceEffectiveToken(), and PsReferencePrimaryToken().

◆ ObFastReferenceObjectLocked()

PVOID FASTCALL ObFastReferenceObjectLocked ( IN PEX_FAST_REF  FastRef)

Definition at line 119 of file obref.c.

120{
122 EX_FAST_REF OldValue = *FastRef;
123
124 /* Get the object and reference it slowly */
127 return Object;
128}
#define ObReferenceObject
Definition: obfuncs.h:204

Referenced by PsReferenceEffectiveToken(), and PsReferencePrimaryToken().

◆ ObFastReplaceObject()

PVOID FASTCALL ObFastReplaceObject ( IN PEX_FAST_REF  FastRef,
PVOID  Object 
)

Definition at line 176 of file obref.c.

178{
179 EX_FAST_REF OldValue;
180 PVOID OldObject;
181 ULONG Count;
182
183 /* Check if we were given an object and reference it 7 times */
185
186 /* Do the swap */
187 OldValue = ExSwapFastReference(FastRef, Object);
188 OldObject = ExGetObjectFastReference(OldValue);
189
190 /* Check if we had an active object and dereference it */
191 Count = ExGetCountFastReference(OldValue);
192 if ((OldObject) && (Count)) ObDereferenceObjectEx(OldObject, Count);
193
194 /* Return the old object */
195 return OldObject;
196}
FORCEINLINE EX_FAST_REF ExSwapFastReference(IN PEX_FAST_REF FastRef, IN PVOID Object)
Definition: ex.h:720
uint32_t ULONG
Definition: typedefs.h:59

◆ ObfDereferenceObject()

LONG_PTR FASTCALL ObfDereferenceObject ( IN PVOID  Object)

Definition at line 318 of file obref.c.

319{
321 LONG_PTR NewCount;
322
323 /* Extract the object header */
325
326 if (Header->PointerCount < Header->HandleCount)
327 {
328 DPRINT1("Misbehaving object: %wZ\n", &Header->Type->Name);
329 return Header->PointerCount;
330 }
331
332 /* Check whether the object can now be deleted. */
333 NewCount = InterlockedDecrementSizeT(&Header->PointerCount);
334 if (!NewCount)
335 {
336 /* Sanity check */
337 ASSERT(Header->HandleCount == 0);
338
339 /* Check if APCs are still active */
341 {
342 /* Remove the object */
344 }
345 else
346 {
347 /* Add us to the deferred deletion list */
349 }
350 }
351
352 /* Return the new count */
353 return NewCount;
354}
#define DPRINT1
Definition: precomp.h:8
#define FALSE
Definition: types.h:117
#define ASSERT(a)
Definition: mode.c:44
BOOLEAN NTAPI KeAreAllApcsDisabled(VOID)
Definition: apc.c:985
VOID NTAPI ObpDeleteObject(IN PVOID Object, IN BOOLEAN CalledFromWorkerThread)
Definition: oblife.c:147

Referenced by ObDereferenceObject().

◆ ObfReferenceObject()

LONG_PTR FASTCALL ObfReferenceObject ( IN PVOID  Object)

Definition at line 308 of file obref.c.

309{
310 ASSERT(Object);
311
312 /* Get the header and increment the reference count */
314}
#define InterlockedIncrementSizeT(a)
Definition: interlocked.h:220

◆ ObInitializeFastReference()

VOID FASTCALL ObInitializeFastReference ( IN PEX_FAST_REF  FastRef,
IN PVOID Object  OPTIONAL 
)

Definition at line 107 of file obref.c.

109{
110 /* Check if we were given an object and reference it 7 times */
112
113 /* Setup the fast reference */
115}
FORCEINLINE VOID ExInitializeFastReference(OUT PEX_FAST_REF FastRef, IN OPTIONAL PVOID Object)
Definition: ex.h:596

Referenced by PspInitializeProcessSecurity(), SeAssignPrimaryToken(), and SepInitializationPhase0().

◆ ObpDeferObjectDeletion()

VOID NTAPI ObpDeferObjectDeletion ( IN POBJECT_HEADER  Header)

Definition at line 53 of file obref.c.

54{
56
57 /* Loop while trying to update the list */
58 do
59 {
60 /* Get the current entry */
62
63 /* Link our object to the list */
64 Header->NextToFree = Entry;
65
66 /* Update the list */
68 Header,
69 Entry) != Entry);
70
71 /* Queue the work item if needed */
73}
#define InterlockedCompareExchangePointer
Definition: interlocked.h:129
volatile PVOID ObpReaperList
Definition: oblife.c:29
WORK_QUEUE_ITEM ObpReaperWorkItem
Definition: oblife.c:28
base of all file and directory entries
Definition: entries.h:83
VOID NTAPI ExQueueWorkItem(IN PWORK_QUEUE_ITEM WorkItem, IN WORK_QUEUE_TYPE QueueType)
Definition: work.c:723
@ CriticalWorkQueue
Definition: extypes.h:189

Referenced by ObDereferenceObjectDeferDelete(), ObDereferenceObjectEx(), and ObfDereferenceObject().

◆ ObReferenceFileObjectForWrite()

NTSTATUS NTAPI ObReferenceFileObjectForWrite ( IN HANDLE  Handle,
IN KPROCESSOR_MODE  AccessMode,
OUT PFILE_OBJECT FileObject,
OUT POBJECT_HANDLE_INFORMATION  HandleInformation 
)

Definition at line 200 of file obref.c.

204{
207 POBJECT_HEADER ObjectHeader;
208 PHANDLE_TABLE_ENTRY HandleEntry;
210
211 /* Assume failure */
212 *FileObject = NULL;
213
214 /* Check if this is a special handle */
215 if (HandleToLong(Handle) < 0)
216 {
217 /* Make sure we have a valid kernel handle */
219 {
221 }
222
223 /* Use the kernel handle table and get the actual handle value */
226 }
227 else
228 {
229 /* Otherwise use this process's handle table */
230 HandleTable = PsGetCurrentProcess()->ObjectTable;
231 }
232
235
236 /* Get the handle entry */
238 if (HandleEntry)
239 {
240 /* Get the object header and validate the type*/
241 ObjectHeader = ObpGetHandleObject(HandleEntry);
242
243 /* Get the desired access from the file object */
245 &DesiredAccess)))
246 {
248 }
249 else
250 {
251 /* Extract the granted access from the handle entry */
253 {
254 /* FIXME: Translate granted access */
255 GrantedAccess = HandleEntry->GrantedAccess;
256 }
257 else
258 {
259 GrantedAccess = HandleEntry->GrantedAccess & ~ObpAccessProtectCloseBit;
260 }
261
262 /* FIXME: Get handle information for audit */
263
264 HandleInformation->GrantedAccess = GrantedAccess;
265
266 /* FIXME: Get handle attributes */
267 HandleInformation->HandleAttributes = 0;
268
269 /* Do granted and desired access match? */
271 {
272 /* FIXME: Audit access if required */
273
274 /* Reference the object directly since we have its header */
276
277 /* Unlock the handle */
280
281 *FileObject = (PFILE_OBJECT)&ObjectHeader->Body;
282
283 /* Return success */
285 return STATUS_SUCCESS;
286 }
287
288 /* No match, deny write access */
290
292 }
293 }
294 else
295 {
297 }
298
299 /* Return failure status */
301 return Status;
302}
LONG NTSTATUS
Definition: precomp.h:26
#define HandleToLong(h)
Definition: basetsd.h:80
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:33
#define BooleanFlagOn(F, SF)
Definition: ext2fs.h:183
ULONG Handle
Definition: gdb_input.c:15
Status
Definition: gdiplustypes.h:25
static XMS_HANDLE HandleTable[XMS_MAX_HANDLES]
Definition: himem.c:83
#define FLG_KERNEL_STACK_TRACE_DB
Definition: pstypes.h:68
#define KeLeaveCriticalRegion()
Definition: ke_x.h:119
#define KeEnterCriticalRegion()
Definition: ke_x.h:88
#define KernelMode
Definition: asm.h:34
ULONG ACCESS_MASK
Definition: nt_native.h:40
#define NtCurrentProcess()
Definition: nt_native.h:1657
PHANDLE_TABLE_ENTRY NTAPI ExMapHandleToPointer(IN PHANDLE_TABLE HandleTable, IN HANDLE Handle)
Definition: handle.c:1046
VOID NTAPI ExUnlockHandleTableEntry(IN PHANDLE_TABLE HandleTable, IN PHANDLE_TABLE_ENTRY HandleTableEntry)
Definition: handle.c:923
ULONG NtGlobalFlag
Definition: init.c:54
NTSTATUS NTAPI IoComputeDesiredAccessFileObject(IN PFILE_OBJECT FileObject, IN PACCESS_MASK DesiredAccess)
Definition: util.c:26
#define STATUS_INVALID_HANDLE
Definition: ntstatus.h:245
#define STATUS_OBJECT_TYPE_MISMATCH
Definition: ntstatus.h:273
PHANDLE_TABLE ObpKernelHandleTable
Definition: obhandle.c:20
#define ObpGetHandleObject(x)
Definition: ob.h:91
#define ObKernelHandleToHandle(Handle)
Definition: ob.h:83
#define STATUS_SUCCESS
Definition: shellext.h:65
Definition: extypes.h:596
ULONG GrantedAccess
Definition: extypes.h:606
LONG_PTR PointerCount
Definition: obtypes.h:487
#define STATUS_ACCESS_DENIED
Definition: udferr_usr.h:145
_Must_inspect_result_ _In_ WDFDEVICE _In_ ULONG _In_ ACCESS_MASK DesiredAccess
Definition: wdfdevice.h:2658
_In_ WDFREQUEST _In_ WDFFILEOBJECT FileObject
Definition: wdfdevice.h:550
* PFILE_OBJECT
Definition: iotypes.h:1998
_In_ PEPROCESS _In_ KPROCESSOR_MODE AccessMode
Definition: mmfuncs.h:396
_In_ ACCESS_MASK _In_opt_ POBJECT_TYPE _In_ KPROCESSOR_MODE _Out_ PVOID _Out_opt_ POBJECT_HANDLE_INFORMATION HandleInformation
Definition: obfuncs.h:44
#define PsGetCurrentProcess
Definition: psfuncs.h:17
_In_ PSECURITY_SUBJECT_CONTEXT _In_ BOOLEAN _In_ ACCESS_MASK _In_ ACCESS_MASK _Outptr_opt_ PPRIVILEGE_SET _In_ PGENERIC_MAPPING _In_ KPROCESSOR_MODE _Out_ PACCESS_MASK GrantedAccess
Definition: sefuncs.h:20
#define NtCurrentThread()

Referenced by NtWriteFile().

◆ ObReferenceObjectByHandle()

NTSTATUS NTAPI ObReferenceObjectByHandle ( IN HANDLE  Handle,
IN ACCESS_MASK  DesiredAccess,
IN POBJECT_TYPE  ObjectType,
IN KPROCESSOR_MODE  AccessMode,
OUT PVOID Object,
OUT POBJECT_HANDLE_INFORMATION HandleInformation  OPTIONAL 
)

Definition at line 494 of file obref.c.

500{
501 PHANDLE_TABLE_ENTRY HandleEntry;
502 POBJECT_HEADER ObjectHeader;
505 PEPROCESS CurrentProcess;
507 PETHREAD CurrentThread;
509 PAGED_CODE();
510
511 /* Assume failure */
512 *Object = NULL;
513
514 /* Check if this is a special handle */
515 if (HandleToLong(Handle) < 0)
516 {
517 /* Check if this is the current process */
518 if (Handle == NtCurrentProcess())
519 {
520 /* Check if this is the right object type */
521 if ((ObjectType == PsProcessType) || !(ObjectType))
522 {
523 /* Get the current process and granted access */
524 CurrentProcess = PsGetCurrentProcess();
525 GrantedAccess = CurrentProcess->GrantedAccess;
526
527 /* Validate access */
528 /* ~GrantedAccess = RefusedAccess.*/
529 /* ~GrantedAccess & DesiredAccess = list of refused bits. */
530 /* !(~GrantedAccess & DesiredAccess) == TRUE means ALL requested rights are granted */
531 if ((AccessMode == KernelMode) ||
533 {
534 /* Check if the caller wanted handle information */
536 {
537 /* Return it */
538 HandleInformation->HandleAttributes = 0;
539 HandleInformation->GrantedAccess = GrantedAccess;
540 }
541
542 /* Reference ourselves */
543 ObjectHeader = OBJECT_TO_OBJECT_HEADER(CurrentProcess);
544 InterlockedExchangeAddSizeT(&ObjectHeader->PointerCount, 1);
545
546 /* Return the pointer */
547 *Object = CurrentProcess;
548 ASSERT(*Object != NULL);
550 }
551 else
552 {
553 /* Access denied */
555 }
556 }
557 else
558 {
559 /* The caller used this special handle value with a non-process type */
561 }
562
563 /* Return the status */
564 return Status;
565 }
566 else if (Handle == NtCurrentThread())
567 {
568 /* Check if this is the right object type */
569 if ((ObjectType == PsThreadType) || !(ObjectType))
570 {
571 /* Get the current process and granted access */
572 CurrentThread = PsGetCurrentThread();
573 GrantedAccess = CurrentThread->GrantedAccess;
574
575 /* Validate access */
576 /* ~GrantedAccess = RefusedAccess.*/
577 /* ~GrantedAccess & DesiredAccess = list of refused bits. */
578 /* !(~GrantedAccess & DesiredAccess) == TRUE means ALL requested rights are granted */
579 if ((AccessMode == KernelMode) ||
581 {
582 /* Check if the caller wanted handle information */
584 {
585 /* Return it */
586 HandleInformation->HandleAttributes = 0;
587 HandleInformation->GrantedAccess = GrantedAccess;
588 }
589
590 /* Reference ourselves */
591 ObjectHeader = OBJECT_TO_OBJECT_HEADER(CurrentThread);
592 InterlockedExchangeAddSizeT(&ObjectHeader->PointerCount, 1);
593
594 /* Return the pointer */
595 *Object = CurrentThread;
596 ASSERT(*Object != NULL);
598 }
599 else
600 {
601 /* Access denied */
603 }
604 }
605 else
606 {
607 /* The caller used this special handle value with a non-process type */
609 }
610
611 /* Return the status */
612 return Status;
613 }
614 else if (AccessMode == KernelMode)
615 {
616 /* Use the kernel handle table and get the actual handle value */
619 }
620 else
621 {
622 /* Invalid access, fail */
624 }
625 }
626 else
627 {
628 /* Otherwise use this process's handle table */
629 HandleTable = PsGetCurrentProcess()->ObjectTable;
630 }
631
632 /* Enter a critical region while we touch the handle table */
635
636 /* Get the handle entry */
638 if (HandleEntry)
639 {
640 /* Get the object header and validate the type*/
641 ObjectHeader = ObpGetHandleObject(HandleEntry);
642 if (!(ObjectType) || (ObjectType == ObjectHeader->Type))
643 {
644 /* Get the granted access and validate it */
645 GrantedAccess = HandleEntry->GrantedAccess;
646
647 /* Validate access */
648 /* ~GrantedAccess = RefusedAccess.*/
649 /* ~GrantedAccess & DesiredAccess = list of refused bits. */
650 /* !(~GrantedAccess & DesiredAccess) == TRUE means ALL requested rights are granted */
651 if ((AccessMode == KernelMode) ||
653 {
654 /* Reference the object directly since we have its header */
656
657 /* Mask out the internal attributes */
659
660 /* Check if the caller wants handle information */
662 {
663 /* Fill out the information */
664 HandleInformation->HandleAttributes = Attributes;
665 HandleInformation->GrantedAccess = GrantedAccess;
666 }
667
668 /* Return the pointer */
669 *Object = &ObjectHeader->Body;
670
671 /* Unlock the handle */
674
675 /* Return success */
676 ASSERT(*Object != NULL);
677 return STATUS_SUCCESS;
678 }
679 else
680 {
681 /* Requested access failed */
682 DPRINT("Rights not granted: %x\n", ~GrantedAccess & DesiredAccess);
684 }
685 }
686 else
687 {
688 /* Invalid object type */
690 }
691
692 /* Unlock the entry */
694 }
695 else
696 {
697 /* Invalid handle */
699 }
700
701 /* Return failure status */
703 *Object = NULL;
704 return Status;
705}
#define PAGED_CODE()
#define PsGetCurrentThread()
Definition: env_spec_w32.h:81
ObjectType
Definition: metafile.c:81
POBJECT_TYPE PsProcessType
Definition: process.c:20
POBJECT_TYPE PsThreadType
Definition: thread.c:20
#define OBJ_HANDLE_ATTRIBUTES
Definition: ob.h:52
#define DPRINT
Definition: sndvol32.h:73
ULONG_PTR ObAttributes
Definition: extypes.h:600
POBJECT_TYPE Type
Definition: obtypes.h:493
_Must_inspect_result_ _In_ WDFDMAENABLER _In_ _In_opt_ PWDF_OBJECT_ATTRIBUTES Attributes

Referenced by _IRQL_requires_max_(), _Success_(), add_device(), AdvancedErrorChecks(), AfdAccept(), AfdEnumEvents(), AfdEventSelect(), BasicBehaviorChecks(), BehaviorChecks(), BroadcastOpen(), CmGetSystemDriverList(), CmpConvertHandleToKernelHandle(), CmpCreateEvent(), CmpCreateRegistryRoot(), CmpIsHiveAlreadyLoaded(), CmpLinkHiveToMaster(), CompBattGetDeviceObjectPointer(), Control(), create_snapshot(), CreateGreenFdo(), CreateMixerPinAndSetFormat(), FxSystemThread::CreateThread(), DispTdiAssociateAddress(), DriverEntry(), duplicate_extents(), EngMapEvent(), ExCreateCallback(), ExpCreateWorkerThread(), ExpInitializeWorkerThreads(), ExpInitNls(), Ext2InvalidateVolumes(), FsRtlTest_OpenTestDirectory(), FsRtlTest_OpenTestFile(), GetObjectType(), IKsPin_PinMasterClock(), InitCsrApiPort(), InitThreadCallback(), IntCreateDesktop(), IntGdiAddFontResourceEx(), IntInitWin32PowerManagement(), IntResolveDesktop(), IntValidateDesktopHandle(), IntValidateWindowStationHandle(), IntVerifyKeyboardFileHandle(), invalidate_volumes(), IoCreateDriver(), IopCreateEvent(), IopDeviceFsIoControl(), IopGetDeviceObjectPointer(), IopInitializeDriverModule(), IopMarkBootPartition(), IopOpenLinkOrRenameTarget(), KernelModeTest(), KmtStartThread(), KspEnableEvent(), LockHandles(), LpcpCopyRequestData(), MiCreateMemoryEvent(), MiQueryMemoryBasicInformation(), MiQueryMemorySectionName(), MmCreateArm3Section(), MmCreateSection(), MmLoadSystemImage(), MountMgrVolumeMountPointChanged(), Mx::MxReferenceObjectByHandle(), nfs41_DeleteConnection(), NtAdjustGroupsToken(), NtAdjustPrivilegesToken(), NtAlertResumeThread(), NtAlertThread(), NtAllocateVirtualMemory(), NtAssignProcessToJobObject(), NtCancelIoFile(), NtCancelTimer(), NtClearEvent(), NtCompareTokens(), NtCompleteConnectPort(), NtCreatePagingFile(), NtCreateProfile(), NtDebugActiveProcess(), NtDebugContinue(), NtDeleteKey(), NtDeleteValueKey(), NtDuplicateObject(), NtDuplicateToken(), NtEnumerateKey(), NtEnumerateValueKey(), NtExtendSection(), NtFilterToken(), NtFlushBuffersFile(), NtFlushInstructionCache(), NtFlushKey(), NtFlushVirtualMemory(), NtFreeVirtualMemory(), NtGetContextThread(), NtGetWriteWatch(), NtImpersonateAnonymousToken(), NtImpersonateClientOfPort(), NtImpersonateThread(), NtIsProcessInJob(), NtLoadKeyEx(), NtLockFile(), NtLockVirtualMemory(), NtMakePermanentObject(), NtMakeTemporaryObject(), NtMapViewOfSection(), NtNotifyChangeDirectoryFile(), NtOpenObjectAuditAlarm(), NtOpenThreadTokenEx(), NtPrivilegeCheck(), NtPrivilegedServiceAuditAlarm(), NtProtectVirtualMemory(), NtPulseEvent(), NtQueryDirectoryFile(), NtQueryDirectoryObject(), NtQueryEvent(), NtQueryInformationFile(), NtQueryInformationJobObject(), NtQueryInformationProcess(), NtQueryInformationThread(), NtQueryInformationToken(), NtQueryIoCompletion(), NtQueryKey(), NtQueryMutant(), NtQueryObject(), NtQueryOpenSubKeys(), NtQuerySection(), NtQuerySecurityObject(), NtQuerySemaphore(), NtQuerySymbolicLinkObject(), NtQueryTimer(), NtQueryValueKey(), NtQueryVolumeInformationFile(), NtQueueApcThreadEx(), NtReadFile(), NtReadVirtualMemory(), NtRegisterThreadTerminatePort(), NtReleaseMutant(), NtReleaseSemaphore(), NtRemoveIoCompletion(), NtRemoveProcessDebug(), NtReplyPort(), NtReplyWaitReceivePortEx(), NtRequestPort(), NtRequestWaitReplyPort(), NtResetEvent(), NtResetWriteWatch(), NtResumeProcess(), NtResumeThread(), NtSaveKeyEx(), NtSaveMergedKeys(), NtSecureConnectPort(), NtSetContextThread(), NtSetDefaultHardErrorPort(), NtSetEvent(), NtSetEventBoostPriority(), NtSetHighEventPair(), NtSetHighWaitLowEventPair(), NtSetInformationDebugObject(), NtSetInformationFile(), NtSetInformationJobObject(), NtSetInformationObject(), NtSetInformationProcess(), NtSetInformationThread(), NtSetInformationToken(), NtSetIoCompletion(), NtSetLowEventPair(), NtSetLowWaitHighEventPair(), NtSetSecurityObject(), NtSetTimer(), NtSetValueKey(), NtSetVolumeInformationFile(), NtSignalAndWaitForSingleObject(), NtStartProfile(), NtStopProfile(), NtSuspendProcess(), NtSuspendThread(), NtTerminateJobObject(), NtTerminateProcess(), NtTerminateThread(), NtUnloadKey2(), NtUnlockFile(), NtUnlockVirtualMemory(), NtUnmapViewOfSection(), NtUserConsoleControl(), NtUserGetGuiResources(), NtUserGetObjectInformation(), NtUserGetThreadDesktop(), NtUserProcessConnect(), NtUserQueryInformationThread(), NtUserResolveDesktop(), NtUserSetInformationThread(), NtUserWaitForInputIdle(), NtWaitForDebugEvent(), NtWaitForSingleObject(), NtWaitHighEventPair(), NtWaitLowEventPair(), NtWriteFile(), NtWriteVirtualMemory(), ObInitSystem(), ObpLookupObjectName(), ObSetDeviceMap(), ObSetDirectoryDeviceMap(), ObtCreateObjectTypes(), OpenDevice(), OpenInputDevice(), FxIoTargetRemote::OpenTargetHandle(), PageFileBehaviorChecks(), Pin_fnDeviceIoControl(), Pin_fnWrite(), PopAddRemoveSysCapsCallback(), PsAssignImpersonationToken(), PsLocateSystemDll(), PsOpenTokenOfProcess(), PspAssignPrimaryToken(), PspCreateProcess(), PspCreateThread(), PspInitPhase0(), PspSetPrimaryToken(), RegisterUncProvider(), send_subvol(), SepAccessCheck(), SepAccessCheckAndAuditAlarm(), SepOpenThreadToken(), START_TEST(), StartThread(), SystemProcessTest(), TdiOpenDevice(), TdiUnload(), TestEventConcurrent(), TestIoCreateFile(), TestObRootSecurity(), TestProviderInfo(), TestReference(), TestSharedCacheMap(), TestSymlinks(), TestTcpConnect(), UDFCommonDeviceControl(), UDFInvalidateVolumes(), UserSetProcessWindowStation(), VerifyEventWaitable(), VfatSetRenameInformation(), VfdCreateDevice(), VfdOpenImage(), ViMountImage(), WdmAudControlDeviceState(), WdmAudControlOpenMixer(), WdmAudFrameSize(), WdmAudOpenSysAudioDevices(), WdmAudReadWrite(), and WdmAudResetStream().

◆ ObReferenceObjectByName()

NTSTATUS NTAPI ObReferenceObjectByName ( IN PUNICODE_STRING  ObjectPath,
IN ULONG  Attributes,
IN PACCESS_STATE  PassedAccessState,
IN ACCESS_MASK  DesiredAccess,
IN POBJECT_TYPE  ObjectType,
IN KPROCESSOR_MODE  AccessMode,
IN OUT PVOID  ParseContext,
OUT PVOID ObjectPtr 
)

Definition at line 409 of file obref.c.

417{
418 PVOID Object = NULL;
422 AUX_ACCESS_DATA AuxData;
424 PAGED_CODE();
425
426 /* Fail quickly */
427 if (!ObjectPath) return STATUS_OBJECT_NAME_INVALID;
428
429 /* Capture the name */
431 if (!NT_SUCCESS(Status)) return Status;
432
433 /* We also need a valid name after capture */
434 if (!ObjectName.Length) return STATUS_OBJECT_NAME_INVALID;
435
436 /* Check if we didn't get an access state */
438 {
439 /* Use our built-in access state */
442 &AuxData,
444 &ObjectType->TypeInfo.GenericMapping);
445 if (!NT_SUCCESS(Status)) goto Quickie;
446 }
447
448 /* Find the object */
449 *ObjectPtr = NULL;
451 &ObjectName,
455 ParseContext,
456 NULL,
457 NULL,
459 &Context,
460 &Object);
461
462 /* Cleanup after lookup */
464
465 /* Check if the lookup succeeded */
466 if (NT_SUCCESS(Status))
467 {
468 /* Check if access is allowed */
471 FALSE,
473 &Status))
474 {
475 /* Return the object */
476 *ObjectPtr = Object;
477 }
478 }
479
480 /* Free the access state */
482 {
484 }
485
486Quickie:
487 /* Free the captured name if we had one, and return status */
489 return Status;
490}
#define TRUE
Definition: types.h:120
NTSTATUS NTAPI SeCreateAccessState(_Inout_ PACCESS_STATE AccessState, _In_ PAUX_ACCESS_DATA AuxData, _In_ ACCESS_MASK Access, _In_ PGENERIC_MAPPING GenericMapping)
Creates an access state.
Definition: access.c:121
VOID NTAPI SeDeleteAccessState(_In_ PACCESS_STATE AccessState)
Deletes an allocated access state from the memory.
Definition: access.c:150
NTSTATUS NTAPI ObpCaptureObjectName(IN PUNICODE_STRING CapturedName, IN PUNICODE_STRING ObjectName, IN KPROCESSOR_MODE AccessMode, IN BOOLEAN AllocateFromLookaside)
BOOLEAN NTAPI ObpCheckObjectReference(IN PVOID Object, IN OUT PACCESS_STATE AccessState, IN BOOLEAN LockHeld, IN KPROCESSOR_MODE AccessMode, OUT PNTSTATUS AccessStatus)
Definition: obsecure.c:340
VOID NTAPI ObpFreeObjectNameBuffer(IN PUNICODE_STRING Name)
Definition: oblife.c:346
NTSTATUS NTAPI ObpLookupObjectName(IN HANDLE RootHandle OPTIONAL, IN OUT PUNICODE_STRING ObjectName, IN ULONG Attributes, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, IN OUT PVOID ParseContext, IN PSECURITY_QUALITY_OF_SERVICE SecurityQos OPTIONAL, IN PVOID InsertObject OPTIONAL, IN OUT PACCESS_STATE AccessState, OUT POBP_LOOKUP_CONTEXT LookupContext, OUT PVOID *FoundObject)
Definition: obname.c:446
FORCEINLINE VOID ObpReleaseLookupContext(IN POBP_LOOKUP_CONTEXT Context)
Releases an initialized object directory lookup context. Unlocks it if necessary, and dereferences th...
Definition: ob_x.h:323
#define STATUS_OBJECT_NAME_INVALID
Definition: udferr_usr.h:148
_In_ PVOID _Out_opt_ PULONG_PTR _Outptr_opt_ PCUNICODE_STRING * ObjectName
Definition: cmfuncs.h:64
_Inout_opt_ PACCESS_STATE PassedAccessState
Definition: obfuncs.h:71
_In_opt_ PVOID _In_opt_ PUNICODE_STRING _In_ PSECURITY_DESCRIPTOR _In_ PACCESS_STATE AccessState
Definition: sefuncs.h:417

Referenced by CreateClientPort(), IopGetDriverPathInformation(), IopUnloadDriver(), NtSecureConnectPort(), ObtClose(), PiAttachFilterDriversCallback(), and TestReference().

◆ ObReferenceObjectByPointer()

NTSTATUS NTAPI ObReferenceObjectByPointer ( IN PVOID  Object,
IN ACCESS_MASK  DesiredAccess,
IN POBJECT_TYPE  ObjectType,
IN KPROCESSOR_MODE  AccessMode 
)

Definition at line 381 of file obref.c.

385{
387
388 /* Get the header */
390
391 /*
392 * Validate object type if the call is for UserMode.
393 * NOTE: Unless it's a symbolic link (Caz Yokoyama [MSFT])
394 */
395 if ((Header->Type != ObjectType) && ((AccessMode != KernelMode) ||
397 {
398 /* Invalid type */
400 }
401
402 /* Increment the reference count and return success */
403 InterlockedIncrementSizeT(&Header->PointerCount);
404 return STATUS_SUCCESS;
405}
#define ObpSymbolicLinkObjectType
Definition: ObTypes.c:119

Referenced by CcRosInitializeFileCache(), ClassRetrieveDeviceRelations(), co_UserCreateWindowEx(), DriverEntry(), IoWMIQueryAllData(), MmPageOutPhysicalAddress(), ObOpenObjectByPointer(), ObpLookupObjectName(), ObpParseSymbolicLink(), RxpWorkerThreadDispatcher(), RxSpinUpRequestsDispatcher(), SepImpersonateAnonymousToken(), and TestReference().

◆ ObReferenceObjectEx()

LONG FASTCALL ObReferenceObjectEx ( IN PVOID  Object,
IN LONG  Count 
)

Definition at line 77 of file obref.c.

79{
80 /* Increment the reference count and return the count now */
82 PointerCount,
83 Count) + Count;
84}

Referenced by ObFastReferenceObject(), ObFastReplaceObject(), ObInitializeFastReference(), and PspCreateThread().

◆ ObReferenceObjectSafe()

BOOLEAN FASTCALL ObReferenceObjectSafe ( IN PVOID  Object)

Definition at line 22 of file obref.c.

23{
24 POBJECT_HEADER ObjectHeader;
25 LONG_PTR OldValue, NewValue;
26
27 /* Get the object header */
28 ObjectHeader = OBJECT_TO_OBJECT_HEADER(Object);
29
30 /* Get the current reference count and fail if it's zero */
31 OldValue = ObjectHeader->PointerCount;
32 if (!OldValue) return FALSE;
33
34 /* Start reference loop */
35 do
36 {
37 /* Increase the reference count */
38 NewValue = InterlockedCompareExchangeSizeT(&ObjectHeader->PointerCount,
39 OldValue + 1,
40 OldValue);
41 if (OldValue == NewValue) return TRUE;
42
43 /* Keep looping */
44 OldValue = NewValue;
45 } while (OldValue);
46
47 /* If we got here, then the reference count is now 0 */
48 return FALSE;
49}
#define InterlockedCompareExchangeSizeT(Destination, Exchange, Comperand)
Definition: ex.h:1539

Referenced by _Function_class_(), CmpFlushNotifiesOnKeyBodyList(), NtImpersonateClientOfPort(), NtRequestPort(), PsGetNextProcess(), PsGetNextProcessThread(), PsLookupProcessByProcessId(), PsLookupProcessThreadByCid(), PsLookupThreadByThreadId(), PspExitThread(), and SepCleanupLUIDDeviceMapDirectory().