ReactOS  0.4.9-dev-717-g6d91262
obref.c File Reference
#include <ntoskrnl.h>
#include <debug.h>
Include dependency graph for obref.c:

Go to the source code of this file.

Macros

#define NDEBUG
 

Functions

BOOLEAN FASTCALL ObReferenceObjectSafe (IN PVOID Object)
 
VOID NTAPI ObpDeferObjectDeletion (IN POBJECT_HEADER Header)
 
LONG FASTCALL ObReferenceObjectEx (IN PVOID Object, IN LONG Count)
 
LONG FASTCALL ObDereferenceObjectEx (IN PVOID Object, IN LONG Count)
 
VOID FASTCALL ObInitializeFastReference (IN PEX_FAST_REF FastRef, IN PVOID Object OPTIONAL)
 
PVOID FASTCALL ObFastReferenceObjectLocked (IN PEX_FAST_REF FastRef)
 
PVOID FASTCALL ObFastReferenceObject (IN PEX_FAST_REF FastRef)
 
VOID FASTCALL ObFastDereferenceObject (IN PEX_FAST_REF FastRef, IN PVOID Object)
 
PVOID FASTCALL ObFastReplaceObject (IN PEX_FAST_REF FastRef, PVOID Object)
 
NTSTATUS NTAPI ObReferenceFileObjectForWrite (IN HANDLE Handle, IN KPROCESSOR_MODE AccessMode, OUT PFILE_OBJECT *FileObject, OUT POBJECT_HANDLE_INFORMATION HandleInformation)
 
LONG_PTR FASTCALL ObfReferenceObject (IN PVOID Object)
 
LONG_PTR FASTCALL ObfDereferenceObject (IN PVOID Object)
 
VOID NTAPI ObDereferenceObjectDeferDelete (IN PVOID Object)
 
VOID NTAPI ObDereferenceObject (IN PVOID Object)
 
NTSTATUS NTAPI ObReferenceObjectByPointer (IN PVOID Object, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode)
 
NTSTATUS NTAPI ObReferenceObjectByName (IN PUNICODE_STRING ObjectPath, IN ULONG Attributes, IN PACCESS_STATE PassedAccessState, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, IN OUT PVOID ParseContext, OUT PVOID *ObjectPtr)
 
NTSTATUS NTAPI ObReferenceObjectByHandle (IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
 

Variables

ULONG ObpAccessProtectCloseBit
 

Macro Definition Documentation

#define NDEBUG

Definition at line 15 of file obref.c.

Function Documentation

VOID NTAPI ObDereferenceObject ( IN PVOID  Object)

Definition at line 375 of file obref.c.

Referenced by _Dispatch_type_(), _Function_class_(), _Requires_lock_held_(), _Success_(), add_device(), add_volume_device(), AdvancedErrorChecks(), AfdAccept(), AfdCloseSocket(), AfdEnumEvents(), AfdEventSelect(), BasicBehaviorChecks(), BehaviorChecks(), BuildDesktopNameList(), Bus_GetDeviceCapabilities(), CcpDereferenceCache(), CcPerformReadAhead(), CcpMapData(), CcpReadAhead(), CcpUnmapCache(), CcRosDeleteFileCache(), CcRosInitializeFileCache(), CcUninitializeCacheMap(), CdCreateInternalStream(), CdDeleteInternalStream(), CdDeleteVcb(), CdfsFCBInitializeCache(), CdfsMountVolume(), CdReMountOldVcb(), CdRomCreateDeviceObject(), CdUnload(), ClassCreateDeviceObject(), ClasspFailurePredict(), CleanupTest(), CloseClientPort(), CmBattUnload(), CmGetSystemDriverList(), CmpCreateRegistryRoot(), CmpDoCreateChild(), CmpDoOpen(), CmpIsHiveAlreadyLoaded(), CmpOpenHiveFiles(), co_HOOK_CallHooks(), co_IntRegisterLogonProcess(), co_UserCreateWindowEx(), CompBattAddNewBattery(), CompBattRemoveBattery(), Control(), create_snapshot(), CreateGreenFdo(), CreateMixerPinAndSetFormat(), DbgkClearProcessDebugObject(), DbgkOpenProcessDebugPort(), DbgkpCloseObject(), DbgkpFreeDebugEvent(), DbgkpPostFakeProcessCreateMessages(), DbgkpPostFakeThreadMessages(), DbgkpQueueMessage(), DbgkpSetProcessDebugObject(), DecrementGdiHandleCount(), DestroyPortDriver(), disk_arrival(), DiskCreateFdo(), DiskDeviceControl(), DiskSendFailurePredictIoctl(), DispTdiAssociateAddress(), DriverEntry(), DriverUnload(), duplicate_extents(), EngFreeModule(), EngFreeSectionMem(), EngUnmapEvent(), ExFreePoolWithTag(), ExitThreadCallback(), ExpCreateWorkerThread(), ExpDebuggerWorker(), ExpDeleteProfile(), ExpWorkerThreadBalanceManager(), ExRegisterCallback(), ExReturnPoolQuota(), ExShutdownSystem(), Ext2DestroyVcb(), Ext2FloppyFlush(), Ext2InitializeVcb(), Ext2InvalidateVolumes(), Ext2MountVolume(), Ext2TearDownStream(), ExUnregisterCallback(), FatCloseEaFile(), FatDeferredFlush(), FatDeleteVcb(), FatExplicitDeviceAccessGranted(), FatOpenEaFile(), FatSetRenameInfo(), FatTearDownVcb(), FFSFloppyFlush(), FFSFreeVcb(), FFSInvalidateVolumes(), finish_removing_device(), FinishThread(), FltpEnumerateFileSystemVolumes(), FltpGetBaseDeviceObjectName(), FltpIsAttachedToDevice(), FsRtlCancelExclusiveIrp(), FsRtlNotifyVolumeEvent(), FsRtlOpBatchBreakClosePending(), FsRtlOplockBreakToII(), FsRtlOplockBreakToNone(), FsRtlOplockCleanup(), FsRtlRemoveAndCompleteIrp(), FsRtlTest_StartTest(), FsRtlUninitializeOplock(), get_device_pnp_name_guid(), GetDeviceId(), GetProcessLuid(), GreenQueryBusRelations(), GspQuery(), GspQueryThreadStatus(), GspSetThread(), HalGetAdapter(), HalPutDmaAdapter(), i8042SendHookWorkItem(), IKsPin_PinMasterClock(), IncrementGdiHandleCount(), InitGdiHandleTable(), InitializeCmdEventInfo(), IntAllowSetForegroundWindow(), IntDesktopObjectDelete(), IntDesktopObjectParse(), IntFreeDesktopHeap(), IntGdiAddFontResource(), IntSetThreadDesktop(), IntTID2PTI(), IntUnmapDesktopView(), invalidate_volumes(), IoAttachDevice(), IoCompletion(), IoCreateDevice(), IoCreateStreamFileObjectEx(), IoDeleteController(), IoDeleteDriver(), IoFreeErrorLogEntry(), IoGetBootDiskInformation(), IopActionInitChildServices(), IopAttachFilterDriversCallback(), IopCancelRemoveDeviceRelations(), IopCleanupAfterException(), IopCleanupFailedIrp(), IopCleanupIrp(), IopCompleteRequest(), IopCreateArcNamesCd(), IopCreateArcNamesDisk(), IopCreateDriver(), IopCreateEvent(), IopCreateFile(), IopDeleteDevice(), IopDeleteFile(), IopDeviceActionWorker(), IopDeviceFsIoControl(), IopDeviceStatus(), IopEnumerateDevice(), IopGetDeviceDepth(), IopGetDeviceProperty(), IopGetDeviceRelations(), IopGetFileInformation(), IopGetInterfaceDeviceList(), IopGetRelatedDevice(), IopGetSetSecurityObject(), IopInitializeBootDrivers(), IopInitializeBuiltinDriver(), IopInitializeDevice(), IopInitiatePnpIrp(), IopLoadUnloadDriver(), IopLogWorker(), IopMarkBootPartition(), IopMountVolume(), IopOpenLinkOrRenameTarget(), IopParseDevice(), IopQueryRemoveDeviceRelations(), IopReportTargetDeviceChangeAsyncWorker(), IopResetDevice(), IopSendRemoveDevice(), IopSetDeviceSecurityDescriptors(), IopShutdownBaseFileSystems(), IopSynchronousCall(), IopUnloadDevice(), IopUnloadDriver(), IopUnloadSafeCompletion(), IopWorkItemCallback(), IoRegisterPlugPlayNotification(), IoSetDeviceInterfaceState(), IoShutdownSystem(), IoUnregisterFsRegistrationChange(), IoUnregisterPlugPlayNotification(), IoUnregisterShutdownNotification(), IoVolumeDeviceToDosName(), IoWMIQueryAllData(), IsFtVolume(), IssueUniqueIdChangeNotify(), IssueUniqueIdChangeNotifyWorker(), KdbpAttachToProcess(), KdbpAttachToThread(), KdbpCmdProc(), KdbpCmdThread(), KdbpReleaseFileForSymbols(), KdbpSymLoadModuleSymbols(), KdpGdbEnterDebuggerException(), KernelModeTest(), KmtFinishThread(), KsDiscardEvent(), LpcpCopyRequestData(), LpcpCreatePort(), LpcpDeletePort(), LpcpDestroyPortQueue(), LpcpFreeToPortZone(), LpcRequestPort(), LpcRequestWaitReplyPort(), MiQueryMemoryBasicInformation(), MiQueryMemorySectionName(), MmCreateArm3Section(), MmCreateCacheSection(), MmCreateDataFileSection(), MmCreateImageSection(), MmCreatePageFileSection(), MmCreatePhysicalMemorySection(), MmCreateSection(), MmFinalizeSegment(), MmGetFileNameForAddress(), MmLoadSystemImage(), MmPageOutPhysicalAddress(), MmpDeleteSection(), MmpPageOutPhysicalAddress(), MmQuitNextSession(), MmUnloadSystemImage(), MmUnmapViewOfSegment(), mount_vol(), MountMgrNotifyNameChange(), MountMgrVolumeMountPointChanged(), MupCloseUncProvider(), MupDereferenceCcb(), nfs41_DeleteConnection(), NpCancelWaiter(), NpCancelWaitQueueIrp(), NpDeleteEventTableEntry(), NpFreeClientSecurityContext(), NpTimerDispatch(), NtAcceptConnectPort(), NtAccessCheck(), NtAdjustPrivilegesToken(), NtAlertResumeThread(), NtAlertThread(), NtAllocateVirtualMemory(), NtAssignProcessToJobObject(), NtCancelIoFile(), NtClearEvent(), NtCompareTokens(), NtCompleteConnectPort(), NtCreateJobObject(), NtCreatePagingFile(), NtCreateProfile(), NtCreateSymbolicLinkObject(), NtDebugActiveProcess(), NtDebugContinue(), NtDeleteKey(), NtDeleteValueKey(), NtDuplicateObject(), NtDuplicateToken(), NtEnumerateKey(), NtEnumerateValueKey(), NtExtendSection(), NtFlushBuffersFile(), NtFlushInstructionCache(), NtFlushKey(), NtFlushVirtualMemory(), NtFreeVirtualMemory(), NtfsFCBInitializeCache(), NtGetContextThread(), NtGetWriteWatch(), NtImpersonateClientOfPort(), NtImpersonateThread(), NtIsProcessInJob(), NtLoadKeyEx(), NtLockFile(), NtLockVirtualMemory(), NtMakePermanentObject(), NtMakeTemporaryObject(), NtMapViewOfSection(), NtNotifyChangeDirectoryFile(), NtOpenObjectAuditAlarm(), NtOpenProcess(), NtOpenProcessTokenEx(), NtOpenThread(), NtOpenThreadTokenEx(), NtPrivilegeCheck(), NtPrivilegedServiceAuditAlarm(), NtProtectVirtualMemory(), NtPulseEvent(), NtQueryDirectoryFile(), NtQueryDirectoryObject(), NtQueryEvent(), NtQueryInformationFile(), NtQueryInformationProcess(), NtQueryInformationThread(), NtQueryInformationToken(), NtQueryIoCompletion(), NtQueryKey(), NtQueryMutant(), NtQueryObject(), NtQueryOpenSubKeys(), NtQuerySection(), NtQuerySecurityObject(), NtQuerySemaphore(), NtQuerySymbolicLinkObject(), NtQueryTimer(), NtQueryValueKey(), NtQueryVolumeInformationFile(), NtQueueApcThread(), NtReadFile(), NtReadVirtualMemory(), NtRegisterThreadTerminatePort(), NtReleaseMutant(), NtReleaseSemaphore(), NtRemoveIoCompletion(), NtRemoveProcessDebug(), NtReplyPort(), NtReplyWaitReceivePortEx(), NtRequestPort(), NtRequestWaitReplyPort(), NtResetEvent(), NtResetWriteWatch(), NtResumeProcess(), NtResumeThread(), NtSaveKeyEx(), NtSaveMergedKeys(), NtSecureConnectPort(), NtSetContextThread(), NtSetEvent(), NtSetEventBoostPriority(), NtSetHighEventPair(), NtSetHighWaitLowEventPair(), NtSetInformationDebugObject(), NtSetInformationFile(), NtSetInformationObject(), NtSetInformationProcess(), NtSetInformationThread(), NtSetInformationToken(), NtSetIoCompletion(), NtSetLowEventPair(), NtSetLowWaitHighEventPair(), NtSetSecurityObject(), NtSetValueKey(), NtSetVolumeInformationFile(), NtSignalAndWaitForSingleObject(), NtStartProfile(), NtStopProfile(), NtSuspendProcess(), NtSuspendThread(), NtTerminateJobObject(), NtTerminateProcess(), NtTerminateThread(), NtUnloadKey2(), NtUnlockFile(), NtUnlockVirtualMemory(), NtUnmapViewOfSection(), NtUserBuildHwndList(), NtUserChangeClipboardChain(), NtUserCloseDesktop(), NtUserCloseWindowStation(), NtUserConsoleControl(), NtUserCountClipboardFormats(), NtUserCreateDesktop(), NtUserCreateWindowStation(), NtUserGetClipboardData(), NtUserGetClipboardOwner(), NtUserGetClipboardSequenceNumber(), NtUserGetClipboardViewer(), NtUserGetGuiResources(), NtUserGetGUIThreadInfo(), NtUserGetObjectInformation(), NtUserGetOpenClipboardWindow(), NtUserGetPriorityClipboardFormat(), NtUserGetThreadDesktop(), NtUserIsClipboardFormatAvailable(), NtUserLockWindowStation(), NtUserPostThreadMessage(), NtUserProcessConnect(), NtUserQueryInformationThread(), NtUserResolveDesktop(), NtUserSetClipboardViewer(), NtUserSetInformationThread(), NtUserSetShellWindowEx(), NtUserSetWindowsHookEx(), NtUserSetWindowStationUser(), NtUserSetWinEventHook(), NtUserSwitchDesktop(), NtUserUnlockWindowStation(), NtUserWaitForInputIdle(), NtWaitForDebugEvent(), NtWaitForMultipleObjects(), NtWaitForSingleObject(), NtWaitHighEventPair(), NtWaitLowEventPair(), NtWriteFile(), NtWriteVirtualMemory(), ObDereferenceDeviceMap(), ObDuplicateObject(), ObFastDereferenceObject(), ObfDereferenceDeviceMap(), ObInsertObject(), ObOpenObjectByName(), ObOpenObjectByPointer(), ObpCloseHandleTableEntry(), ObpCreateDeviceMap(), ObpCreateHandle(), ObpDeleteNameCheck(), ObpDuplicateHandleCallback(), ObpLookupEntryDirectory(), ObpLookupObjectName(), ObpReleaseLookupContextObject(), ObtClose(), PageFileBehaviorChecks(), PatchKeyboardDriver(), PciGetDeviceCapabilities(), PciQueryForPciBusInterface(), PciSendIoctl(), Pin_fnDeviceIoControl(), Pin_fnWrite(), PopAddRemoveSysCapsCallback(), PopQuerySystemPowerStateTraverse(), PopRequestPowerIrpCompletion(), PopSetSystemPowerState(), PopSetSystemPowerStateTraverse(), PoRequestPowerIrp(), PoRequestShutdownWait(), probe_volume(), PsAssignImpersonationToken(), PsDereferenceImpersonationToken(), PsDereferencePrimaryToken(), PsGetNextProcess(), PsGetNextProcessThread(), PsOpenTokenOfProcess(), PspAssignPrimaryToken(), PspCreateProcess(), PspCreateThread(), PspDeleteJob(), PspDeleteProcess(), PspDeleteThread(), PspDeleteThreadSecurity(), PspExitProcess(), PspExitThread(), PspReapRoutine(), PspSetPrimaryToken(), PspSetQuotaLimits(), PsRestoreImpersonation(), PsRevertThreadToSelf(), QSI_DEF(), QueryDeviceInformation(), QuerySuggestedLinkName(), RawInputThreadMain(), RawMountVolume(), RawUnload(), read_registry(), ReconcileThisDatabaseWithMasterWorker(), RegisterForTargetDeviceNotification(), remove_volume_child(), ResetCsrApiPort(), ResetCsrProcess(), RfsdFloppyFlush(), RfsdFreeVcb(), RfsdInvalidateVolumes(), RxpWorkerThreadDispatcher(), RxUnregisterMinirdr(), ScsiClassClaimDevice(), SearchForLegacyDrivers(), SeCreateClientSecurity(), SeCreateClientSecurityFromSubjectContext(), SeDeassignPrimaryToken(), SeLocateProcessImageName(), send_subvol(), SendLinkCreated(), SendLinkDeleted(), SendOnlineNotification(), SepAccessCheckAndAuditAlarm(), SepCreateToken(), SepDuplicateToken(), START_TEST(), SysAudio_Shutdown(), SystemProcessTest(), TdiCloseDevice(), TestCreateSection(), TestEventConcurrent(), TestIoCreateFile(), TestLowerDeviceKernelAPI(), TestObjectTypes(), TestObRootSecurity(), TestPhysicalMemorySection(), TestProviderInfo(), TestReference(), TestSharedCacheMap(), TestSymlinks(), TestTcpConnect(), UDFCheckOtherFSByName(), UDFCommonDeviceControl(), UDFInvalidateVolumes(), uninit(), Unload(), UnlockHandles(), USBH_FdoQueryBusRelations(), USBPORT_IsCompanionController(), USBPORT_QueryPciBusInterface(), UserClipboardFreeWindow(), UserClipboardRelease(), UserCloseClipboard(), UserCreateHeap(), UserCreateMenu(), UserDeleteW32Process(), UserEmptyClipboard(), UserEnumClipboardFormats(), UserGetShellWindow(), UserOpenClipboard(), UserSetClipboardData(), UserSetProcessWindowStation(), VerifyEventWaitable(), VfatCleanupFile(), VfatDismountVolume(), vfatFCBInitializeCacheFromVolume(), VfatMount(), VfatSetRenameInformation(), VfdCreateDevice(), VfdDeleteDevice(), VfdOpenImage(), ViDeleteDevice(), ViEjectMedia(), vol_close(), volume_arrival(), WdmAudCloseAllMixers(), WdmAudControlCloseMixer(), WdmAudControlDeviceState(), WdmAudControlOpenMixer(), WdmAudFrameSize(), WdmAudResetStream(), WmipOpenGuidForEvents(), WmipRegisterGuids(), and xHalQueryDriveLayout().

376 {
377  /* Call the fastcall function */
379 }
LONG_PTR FASTCALL ObfDereferenceObject(IN PVOID Object)
Definition: obref.c:320
static IUnknown Object
Definition: main.c:512
VOID NTAPI ObDereferenceObjectDeferDelete ( IN PVOID  Object)

Definition at line 360 of file obref.c.

Referenced by CmpDoCreateChild(), CmpFlushNotifiesOnKeyBodyList(), IopCompleteRequest(), and ObpDereferenceNameInfo().

361 {
363 
364  /* Check whether the object can now be deleted. */
365  if (!InterlockedDecrement(&Header->PointerCount))
366  {
367  /* Add us to the deferred deletion list */
368  ObpDeferObjectDeletion(Header);
369  }
370 }
#define OBJECT_TO_OBJECT_HEADER(o)
Definition: obtypes.h:111
VOID NTAPI ObpDeferObjectDeletion(IN POBJECT_HEADER Header)
Definition: obref.c:55
Definition: Header.h:8
static IUnknown Object
Definition: main.c:512
#define InterlockedDecrement
Definition: armddk.h:52
LONG_PTR PointerCount
Definition: obtypes.h:487
LONG FASTCALL ObDereferenceObjectEx ( IN PVOID  Object,
IN LONG  Count 
)

Definition at line 90 of file obref.c.

Referenced by ExpTimerApcKernelRoutine(), ExTimerRundown(), NtCancelTimer(), NtSetTimer(), ObFastReferenceObject(), ObFastReplaceObject(), and PspCreateThread().

92 {
94  LONG NewCount;
95 
96  /* Extract the object header */
98 
99  /* Check whether the object can now be deleted. */
100  NewCount = InterlockedExchangeAdd(&Header->PointerCount, -Count) - Count;
101  if (!NewCount) ObpDeferObjectDeletion(Header);
102 
103  /* Return the current count */
104  return NewCount;
105 }
_Inout_ __drv_aliasesMem PSLIST_ENTRY _Inout_ PSLIST_ENTRY _In_ ULONG Count
Definition: exfuncs.h:1015
#define OBJECT_TO_OBJECT_HEADER(o)
Definition: obtypes.h:111
VOID NTAPI ObpDeferObjectDeletion(IN POBJECT_HEADER Header)
Definition: obref.c:55
Definition: Header.h:8
long LONG
Definition: pedump.c:60
#define InterlockedExchangeAdd
Definition: interlocked.h:181
static IUnknown Object
Definition: main.c:512
LONG_PTR PointerCount
Definition: obtypes.h:487
VOID FASTCALL ObFastDereferenceObject ( IN PEX_FAST_REF  FastRef,
IN PVOID  Object 
)

Definition at line 169 of file obref.c.

Referenced by NtOpenThreadTokenEx(), PspCreateProcess(), PspCreateThread(), PspExitThread(), PspInitializeProcessSecurity(), PspSetPrimaryToken(), SeIsTokenChild(), and SeReleaseSubjectContext().

171 {
172  /* Release a fast reference. If this failed, use the slow path */
174 }
VOID NTAPI ObDereferenceObject(IN PVOID Object)
Definition: obref.c:375
static IUnknown Object
Definition: main.c:512
FORCEINLINE BOOLEAN ExReleaseFastReference(IN PEX_FAST_REF FastRef, IN PVOID Object)
Definition: ex.h:639
PVOID FASTCALL ObFastReferenceObject ( IN PEX_FAST_REF  FastRef)

Definition at line 134 of file obref.c.

Referenced by PsReferenceEffectiveToken(), and PsReferencePrimaryToken().

135 {
136  EX_FAST_REF OldValue;
138  PVOID Object;
139 
140  /* Reference the object and get it pointer */
141  OldValue = ExAcquireFastReference(FastRef);
142  Object = ExGetObjectFastReference(OldValue);
143 
144  /* Check how many references are left */
145  Count = ExGetCountFastReference(OldValue);
146 
147  /* Check if the reference count is over 1 */
148  if (Count > 1) return Object;
149 
150  /* Check if the reference count has reached 0 */
151  if (!Count) return NULL;
152 
153  /* Otherwise, reference the object 7 times */
155 
156  /* Now update the reference count */
157  if (!ExInsertFastReference(FastRef, Object))
158  {
159  /* We failed: completely dereference the object */
161  }
162 
163  /* Return the Object */
164  return Object;
165 }
DWORD *typedef PVOID
Definition: winlogon.h:52
LONG FASTCALL ObReferenceObjectEx(IN PVOID Object, IN LONG Count)
Definition: obref.c:79
FORCEINLINE PVOID ExGetObjectFastReference(IN EX_FAST_REF FastRef)
Definition: ex.h:534
FORCEINLINE BOOLEAN ExInsertFastReference(IN OUT PEX_FAST_REF FastRef, IN PVOID Object)
Definition: ex.h:600
_Inout_ __drv_aliasesMem PSLIST_ENTRY _Inout_ PSLIST_ENTRY _In_ ULONG Count
Definition: exfuncs.h:1015
uint32_t ULONG_PTR
Definition: typedefs.h:63
FORCEINLINE EX_FAST_REF ExAcquireFastReference(IN OUT PEX_FAST_REF FastRef)
Definition: ex.h:571
smooth NULL
Definition: ftsmooth.c:416
LONG FASTCALL ObDereferenceObjectEx(IN PVOID Object, IN LONG Count)
Definition: obref.c:90
FORCEINLINE ULONG ExGetCountFastReference(IN EX_FAST_REF FastRef)
Definition: ex.h:542
static IUnknown Object
Definition: main.c:512
#define MAX_FAST_REFS
Definition: ex.h:128
PVOID FASTCALL ObFastReferenceObjectLocked ( IN PEX_FAST_REF  FastRef)

Definition at line 121 of file obref.c.

Referenced by PsReferenceEffectiveToken(), and PsReferencePrimaryToken().

122 {
123  PVOID Object;
124  EX_FAST_REF OldValue = *FastRef;
125 
126  /* Get the object and reference it slowly */
127  Object = ExGetObjectFastReference(OldValue);
128  if (Object) ObReferenceObject(Object);
129  return Object;
130 }
DWORD *typedef PVOID
Definition: winlogon.h:52
FORCEINLINE PVOID ExGetObjectFastReference(IN EX_FAST_REF FastRef)
Definition: ex.h:534
static IUnknown Object
Definition: main.c:512
#define ObReferenceObject
Definition: obfuncs.h:204
PVOID FASTCALL ObFastReplaceObject ( IN PEX_FAST_REF  FastRef,
PVOID  Object 
)

Definition at line 178 of file obref.c.

180 {
181  EX_FAST_REF OldValue;
182  PVOID OldObject;
183  ULONG Count;
184 
185  /* Check if we were given an object and reference it 7 times */
187 
188  /* Do the swap */
189  OldValue = ExSwapFastReference(FastRef, Object);
190  OldObject = ExGetObjectFastReference(OldValue);
191 
192  /* Check if we had an active object and dereference it */
193  Count = ExGetCountFastReference(OldValue);
194  if ((OldObject) && (Count)) ObDereferenceObjectEx(OldObject, Count);
195 
196  /* Return the old object */
197  return OldObject;
198 }
DWORD *typedef PVOID
Definition: winlogon.h:52
LONG FASTCALL ObReferenceObjectEx(IN PVOID Object, IN LONG Count)
Definition: obref.c:79
FORCEINLINE PVOID ExGetObjectFastReference(IN EX_FAST_REF FastRef)
Definition: ex.h:534
_Inout_ __drv_aliasesMem PSLIST_ENTRY _Inout_ PSLIST_ENTRY _In_ ULONG Count
Definition: exfuncs.h:1015
FORCEINLINE EX_FAST_REF ExSwapFastReference(IN PEX_FAST_REF FastRef, IN PVOID Object)
Definition: ex.h:674
LONG FASTCALL ObDereferenceObjectEx(IN PVOID Object, IN LONG Count)
Definition: obref.c:90
FORCEINLINE ULONG ExGetCountFastReference(IN EX_FAST_REF FastRef)
Definition: ex.h:542
static IUnknown Object
Definition: main.c:512
unsigned int ULONG
Definition: retypes.h:1
#define MAX_FAST_REFS
Definition: ex.h:128
LONG_PTR FASTCALL ObfDereferenceObject ( IN PVOID  Object)

Definition at line 320 of file obref.c.

Referenced by CreateClientPort(), DriverEntry(), FltpClientPortDelete(), FltpDetachFromFileSystemDevice(), FltpSetupCommunicationObjects(), FsRtlAcknowledgeOplockBreak(), ObDereferenceObject(), PopProcessShutDownLists(), RawCheckForDismount(), VfatCheckForDismount(), and WmipOpenGuidObject().

321 {
323  LONG_PTR OldCount;
324 
325  /* Extract the object header */
327 
328  if (Header->PointerCount < Header->HandleCount)
329  {
330  DPRINT1("Misbehaving object: %wZ\n", &Header->Type->Name);
331  return Header->PointerCount;
332  }
333 
334  /* Check whether the object can now be deleted. */
335  OldCount = InterlockedDecrement(&Header->PointerCount);
336  if (!OldCount)
337  {
338  /* Sanity check */
339  ASSERT(Header->HandleCount == 0);
340 
341  /* Check if APCs are still active */
342  if (!KeAreAllApcsDisabled())
343  {
344  /* Remove the object */
346  }
347  else
348  {
349  /* Add us to the deferred deletion list */
350  ObpDeferObjectDeletion(Header);
351  }
352  }
353 
354  /* Return the old count */
355  return OldCount;
356 }
LONG_PTR HandleCount
Definition: obtypes.h:490
BOOLEAN NTAPI KeAreAllApcsDisabled(VOID)
Definition: apc.c:985
ASSERT((InvokeOnSuccess||InvokeOnError||InvokeOnCancel)?(CompletionRoutine!=NULL):TRUE)
#define OBJECT_TO_OBJECT_HEADER(o)
Definition: obtypes.h:111
VOID NTAPI ObpDeferObjectDeletion(IN POBJECT_HEADER Header)
Definition: obref.c:55
#define FALSE
Definition: types.h:117
Definition: Header.h:8
VOID NTAPI ObpDeleteObject(IN PVOID Object, IN BOOLEAN CalledFromWorkerThread)
Definition: oblife.c:148
static IUnknown Object
Definition: main.c:512
#define InterlockedDecrement
Definition: armddk.h:52
__int3264 LONG_PTR
Definition: mstsclib_h.h:276
LONG_PTR PointerCount
Definition: obtypes.h:487
#define DPRINT1
Definition: precomp.h:8
UNICODE_STRING Name
Definition: obtypes.h:383
POBJECT_TYPE Type
Definition: obtypes.h:493
LONG_PTR FASTCALL ObfReferenceObject ( IN PVOID  Object)

Definition at line 310 of file obref.c.

311 {
312  ASSERT(Object);
313 
314  /* Get the header and increment the reference count */
315  return InterlockedIncrement(&OBJECT_TO_OBJECT_HEADER(Object)->PointerCount);
316 }
ASSERT((InvokeOnSuccess||InvokeOnError||InvokeOnCancel)?(CompletionRoutine!=NULL):TRUE)
#define OBJECT_TO_OBJECT_HEADER(o)
Definition: obtypes.h:111
static IUnknown Object
Definition: main.c:512
#define InterlockedIncrement
Definition: armddk.h:53
VOID FASTCALL ObInitializeFastReference ( IN PEX_FAST_REF  FastRef,
IN PVOID Object  OPTIONAL 
)

Definition at line 109 of file obref.c.

Referenced by PspInitializeProcessSecurity(), SeAssignPrimaryToken(), and SepInitializationPhase0().

111 {
112  /* Check if we were given an object and reference it 7 times */
114 
115  /* Setup the fast reference */
117 }
LONG FASTCALL ObReferenceObjectEx(IN PVOID Object, IN LONG Count)
Definition: obref.c:79
FORCEINLINE VOID ExInitializeFastReference(OUT PEX_FAST_REF FastRef, IN OPTIONAL PVOID Object)
Definition: ex.h:550
static IUnknown Object
Definition: main.c:512
#define MAX_FAST_REFS
Definition: ex.h:128
VOID NTAPI ObpDeferObjectDeletion ( IN POBJECT_HEADER  Header)

Definition at line 55 of file obref.c.

Referenced by ObDereferenceObjectDeferDelete(), ObDereferenceObjectEx(), and ObfDereferenceObject().

56 {
57  PVOID Entry;
58 
59  /* Loop while trying to update the list */
60  do
61  {
62  /* Get the current entry */
63  Entry = ObpReaperList;
64 
65  /* Link our object to the list */
66  Header->NextToFree = Entry;
67 
68  /* Update the list */
70  Header,
71  Entry) != Entry);
72 
73  /* Queue the work item if needed */
75 }
DWORD *typedef PVOID
Definition: winlogon.h:52
VOID NTAPI ExQueueWorkItem(IN PWORK_QUEUE_ITEM WorkItem, IN WORK_QUEUE_TYPE QueueType)
Definition: work.c:717
struct _Entry Entry
Definition: kefuncs.h:640
WORK_QUEUE_ITEM ObpReaperWorkItem
Definition: oblife.c:28
Definition: Header.h:8
#define InterlockedCompareExchangePointer
Definition: interlocked.h:129
volatile PVOID ObpReaperList
Definition: oblife.c:29
NTSTATUS NTAPI ObReferenceFileObjectForWrite ( IN HANDLE  Handle,
IN KPROCESSOR_MODE  AccessMode,
OUT PFILE_OBJECT FileObject,
OUT POBJECT_HANDLE_INFORMATION  HandleInformation 
)

Definition at line 202 of file obref.c.

Referenced by NtWriteFile().

206 {
209  POBJECT_HEADER ObjectHeader;
210  PHANDLE_TABLE_ENTRY HandleEntry;
212 
213  /* Assume failure */
214  *FileObject = NULL;
215 
216  /* Check if this is a special handle */
217  if (HandleToLong(Handle) < 0)
218  {
219  /* Make sure we have a valid kernel handle */
221  {
222  return STATUS_INVALID_HANDLE;
223  }
224 
225  /* Use the kernel handle table and get the actual handle value */
227  HandleTable = ObpKernelHandleTable;
228  }
229  else
230  {
231  /* Otherwise use this process's handle table */
232  HandleTable = PsGetCurrentProcess()->ObjectTable;
233  }
234 
235  ASSERT(HandleTable != NULL);
237 
238  /* Get the handle entry */
239  HandleEntry = ExMapHandleToPointer(HandleTable, Handle);
240  if (HandleEntry)
241  {
242  /* Get the object header and validate the type*/
243  ObjectHeader = ObpGetHandleObject(HandleEntry);
244 
245  /* Get the desired access from the file object */
247  &DesiredAccess)))
248  {
250  }
251  else
252  {
253  /* Extract the granted access from the handle entry */
255  {
256  /* FIXME: Translate granted access */
257  GrantedAccess = HandleEntry->GrantedAccess;
258  }
259  else
260  {
261  GrantedAccess = HandleEntry->GrantedAccess & ~ObpAccessProtectCloseBit;
262  }
263 
264  /* FIXME: Get handle information for audit */
265 
266  HandleInformation->GrantedAccess = GrantedAccess;
267 
268  /* FIXME: Get handle attributes */
269  HandleInformation->HandleAttributes = 0;
270 
271  /* Do granted and desired access match? */
272  if (GrantedAccess & DesiredAccess)
273  {
274  /* FIXME: Audit access if required */
275 
276  /* Reference the object directly since we have its header */
277  InterlockedIncrement(&ObjectHeader->PointerCount);
278 
279  /* Unlock the handle */
280  ExUnlockHandleTableEntry(HandleTable, HandleEntry);
282 
283  *FileObject = (PFILE_OBJECT)&ObjectHeader->Body;
284 
285  /* Return success */
286  ASSERT(*FileObject != NULL);
287  return STATUS_SUCCESS;
288  }
289 
290  /* No match, deny write access */
291  Status = STATUS_ACCESS_DENIED;
292 
293  ExUnlockHandleTableEntry(HandleTable, HandleEntry);
294  }
295  }
296  else
297  {
298  Status = STATUS_INVALID_HANDLE;
299  }
300 
301  /* Return failure status */
303  return Status;
304 }
ASSERT((InvokeOnSuccess||InvokeOnError||InvokeOnCancel)?(CompletionRoutine!=NULL):TRUE)
#define BooleanFlagOn(F, SF)
Definition: ext2fs.h:182
return STATUS_SUCCESS
Definition: btrfs.c:2690
PHANDLE_TABLE_ENTRY NTAPI ExMapHandleToPointer(IN PHANDLE_TABLE HandleTable, IN HANDLE Handle)
Definition: handle.c:1010
#define NtCurrentThread()
static XMS_HANDLE HandleTable[XMS_MAX_HANDLES]
Definition: himem.c:83
VOID NTAPI ExUnlockHandleTableEntry(IN PHANDLE_TABLE HandleTable, IN PHANDLE_TABLE_ENTRY HandleTableEntry)
Definition: handle.c:887
#define STATUS_INVALID_HANDLE
Definition: ntstatus.h:231
_In_ PEPROCESS _In_ KPROCESSOR_MODE AccessMode
Definition: mmfuncs.h:396
#define PsGetCurrentProcess
Definition: psfuncs.h:17
Definition: extypes.h:595
smooth NULL
Definition: ftsmooth.c:416
#define ObpGetHandleObject(x)
Definition: ob.h:81
PHANDLE_TABLE ObpKernelHandleTable
Definition: obhandle.c:20
_Inout_ PFILE_OBJECT FileObject
Definition: cdprocs.h:593
#define NtCurrentProcess()
Definition: nt_native.h:1657
_In_ HANDLE Handle
Definition: extypes.h:390
#define STATUS_OBJECT_TYPE_MISMATCH
Definition: ntstatus.h:259
LONG NTSTATUS
Definition: precomp.h:26
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:24
ULONG GrantedAccess
Definition: extypes.h:606
NTSTATUS NTAPI IoComputeDesiredAccessFileObject(IN PFILE_OBJECT FileObject, IN PACCESS_MASK DesiredAccess)
Definition: util.c:26
_In_ ACCESS_MASK _In_opt_ POBJECT_TYPE _In_ KPROCESSOR_MODE _Out_ PVOID _Out_opt_ POBJECT_HANDLE_INFORMATION HandleInformation
Definition: obfuncs.h:40
#define STATUS_ACCESS_DENIED
Definition: udferr_usr.h:145
* PFILE_OBJECT
Definition: iotypes.h:1949
#define KeEnterCriticalRegion()
Definition: ke_x.h:83
Status
Definition: gdiplustypes.h:24
#define KeLeaveCriticalRegion()
Definition: ke_x.h:114
#define InterlockedIncrement
Definition: armddk.h:53
_In_ PIO_STACK_LOCATION _Inout_ PFILE_OBJECT _Inout_ PVCB _Outptr_result_maybenull_ PDCB _In_ PDCB _In_ PDIRENT _In_ ULONG _In_ ULONG _In_ PUNICODE_STRING _In_ PACCESS_MASK DesiredAccess
Definition: create.c:4157
LONG_PTR PointerCount
Definition: obtypes.h:487
#define FLG_KERNEL_STACK_TRACE_DB
Definition: pstypes.h:69
#define ObKernelHandleToHandle(Handle)
Definition: ob.h:73
_In_ PSECURITY_SUBJECT_CONTEXT _In_ BOOLEAN _In_ ACCESS_MASK _In_ ACCESS_MASK _Outptr_opt_ PPRIVILEGE_SET _In_ PGENERIC_MAPPING _In_ KPROCESSOR_MODE _Out_ PACCESS_MASK GrantedAccess
Definition: sefuncs.h:13
ULONG ObpAccessProtectCloseBit
Definition: obhandle.c:21
ULONG NtGlobalFlag
Definition: init.c:51
ULONG ACCESS_MASK
Definition: nt_native.h:40
#define HandleToLong(h)
Definition: basetsd.h:80
NTSTATUS NTAPI ObReferenceObjectByHandle ( IN HANDLE  Handle,
IN ACCESS_MASK  DesiredAccess,
IN POBJECT_TYPE  ObjectType,
IN KPROCESSOR_MODE  AccessMode,
OUT PVOID Object,
OUT POBJECT_HANDLE_INFORMATION HandleInformation  OPTIONAL 
)

Definition at line 496 of file obref.c.

Referenced by _IRQL_requires_max_(), _Success_(), add_device(), AdvancedErrorChecks(), AfdAccept(), AfdEnumEvents(), AfdEventSelect(), BasicBehaviorChecks(), BehaviorChecks(), BroadcastOpen(), CmGetSystemDriverList(), CmpCreateEvent(), CmpCreateRegistryRoot(), CmpIsHiveAlreadyLoaded(), CmpLinkHiveToMaster(), CompBattGetDeviceObjectPointer(), Control(), create_snapshot(), CreateGreenFdo(), CreateMixerPinAndSetFormat(), DispTdiAssociateAddress(), DriverEntry(), duplicate_extents(), EngMapEvent(), ExCreateCallback(), ExpCreateWorkerThread(), ExpInitializeWorkerThreads(), ExpInitNls(), Ext2InvalidateVolumes(), FFSInvalidateVolumes(), FsRtlTest_OpenTestDirectory(), FsRtlTest_OpenTestFile(), GetObjectType(), IKsPin_PinMasterClock(), InitCsrApiPort(), InitThreadCallback(), IntValidateDesktopHandle(), IntValidateWindowStationHandle(), invalidate_volumes(), IopCreateDriver(), IopCreateEvent(), IopDeviceFsIoControl(), IopGetDeviceObjectPointer(), IopMarkBootPartition(), IopOpenLinkOrRenameTarget(), KdbpSymLoadModuleSymbols(), KernelModeTest(), KmtStartThread(), KspEnableEvent(), LockHandles(), LpcpCopyRequestData(), MiCreateMemoryEvent(), MiQueryMemoryBasicInformation(), MiQueryMemorySectionName(), MmCreateArm3Section(), MmCreateSection(), MmLoadSystemImage(), MountMgrVolumeMountPointChanged(), nfs41_DeleteConnection(), NtAccessCheck(), NtAdjustPrivilegesToken(), NtAlertResumeThread(), NtAlertThread(), NtAllocateVirtualMemory(), NtAssignProcessToJobObject(), NtCancelIoFile(), NtCancelTimer(), NtClearEvent(), NtCompareTokens(), NtCompleteConnectPort(), NtCreatePagingFile(), NtCreateProfile(), NtDebugActiveProcess(), NtDebugContinue(), NtDeleteKey(), NtDeleteValueKey(), NtDuplicateObject(), NtDuplicateToken(), NtEnumerateKey(), NtEnumerateValueKey(), NtExtendSection(), NtFlushBuffersFile(), NtFlushInstructionCache(), NtFlushKey(), NtFlushVirtualMemory(), NtFreeVirtualMemory(), NtGetContextThread(), NtGetWriteWatch(), NtImpersonateClientOfPort(), NtImpersonateThread(), NtIsProcessInJob(), NtLoadKeyEx(), NtLockFile(), NtLockVirtualMemory(), NtMakePermanentObject(), NtMakeTemporaryObject(), NtMapViewOfSection(), NtNotifyChangeDirectoryFile(), NtOpenObjectAuditAlarm(), NtOpenThreadTokenEx(), NtPrivilegeCheck(), NtPrivilegedServiceAuditAlarm(), NtProtectVirtualMemory(), NtPulseEvent(), NtQueryDirectoryFile(), NtQueryDirectoryObject(), NtQueryEvent(), NtQueryInformationFile(), NtQueryInformationProcess(), NtQueryInformationThread(), NtQueryInformationToken(), NtQueryIoCompletion(), NtQueryKey(), NtQueryMutant(), NtQueryObject(), NtQueryOpenSubKeys(), NtQuerySection(), NtQuerySecurityObject(), NtQuerySemaphore(), NtQuerySymbolicLinkObject(), NtQueryTimer(), NtQueryValueKey(), NtQueryVolumeInformationFile(), NtQueueApcThread(), NtReadFile(), NtReadVirtualMemory(), NtRegisterThreadTerminatePort(), NtReleaseMutant(), NtReleaseSemaphore(), NtRemoveIoCompletion(), NtRemoveProcessDebug(), NtReplyPort(), NtReplyWaitReceivePortEx(), NtRequestPort(), NtRequestWaitReplyPort(), NtResetEvent(), NtResetWriteWatch(), NtResumeProcess(), NtResumeThread(), NtSaveKeyEx(), NtSaveMergedKeys(), NtSecureConnectPort(), NtSetContextThread(), NtSetDefaultHardErrorPort(), NtSetEvent(), NtSetEventBoostPriority(), NtSetHighEventPair(), NtSetHighWaitLowEventPair(), NtSetInformationDebugObject(), NtSetInformationFile(), NtSetInformationObject(), NtSetInformationProcess(), NtSetInformationThread(), NtSetInformationToken(), NtSetIoCompletion(), NtSetLowEventPair(), NtSetLowWaitHighEventPair(), NtSetSecurityObject(), NtSetTimer(), NtSetValueKey(), NtSetVolumeInformationFile(), NtSignalAndWaitForSingleObject(), NtStartProfile(), NtStopProfile(), NtSuspendProcess(), NtSuspendThread(), NtTerminateJobObject(), NtTerminateProcess(), NtTerminateThread(), NtUnloadKey2(), NtUnlockFile(), NtUnlockVirtualMemory(), NtUnmapViewOfSection(), NtUserConsoleControl(), NtUserCreateDesktop(), NtUserGetGuiResources(), NtUserGetObjectInformation(), NtUserGetThreadDesktop(), NtUserProcessConnect(), NtUserQueryInformationThread(), NtUserResolveDesktop(), NtUserSetInformationThread(), NtUserWaitForInputIdle(), NtWaitForDebugEvent(), NtWaitForSingleObject(), NtWaitHighEventPair(), NtWaitLowEventPair(), NtWriteFile(), NtWriteVirtualMemory(), ObInitSystem(), ObpCreateDeviceMap(), ObpLookupObjectName(), ObtCreateObjectTypes(), OpenDevice(), OpenInputDevice(), PageFileBehaviorChecks(), Pin_fnDeviceIoControl(), Pin_fnWrite(), PopAddRemoveSysCapsCallback(), PsAssignImpersonationToken(), PsLocateSystemDll(), PsOpenTokenOfProcess(), PspAssignPrimaryToken(), PspCreateProcess(), PspCreateThread(), PspInitPhase0(), PspSetPrimaryToken(), RegisterUncProvider(), RfsdInvalidateVolumes(), send_subvol(), SepAccessCheckAndAuditAlarm(), START_TEST(), StartThread(), SystemProcessTest(), TdiOpenDevice(), TdiUnload(), TestEventConcurrent(), TestIoCreateFile(), TestObRootSecurity(), TestProviderInfo(), TestReference(), TestSharedCacheMap(), TestSymlinks(), TestTcpConnect(), UDFCommonDeviceControl(), UDFInvalidateVolumes(), VerifyEventWaitable(), VfatSetRenameInformation(), VfdCreateDevice(), VfdOpenImage(), ViMountImage(), WdmAudControlDeviceState(), WdmAudControlOpenMixer(), WdmAudFrameSize(), WdmAudOpenSysAudioDevices(), WdmAudReadWrite(), and WdmAudResetStream().

502 {
503  PHANDLE_TABLE_ENTRY HandleEntry;
504  POBJECT_HEADER ObjectHeader;
509  PETHREAD CurrentThread;
511  PAGED_CODE();
512 
513  /* Assume failure */
514  *Object = NULL;
515 
516  /* Check if this is a special handle */
517  if (HandleToLong(Handle) < 0)
518  {
519  /* Check if this is the current process */
520  if (Handle == NtCurrentProcess())
521  {
522  /* Check if this is the right object type */
523  if ((ObjectType == PsProcessType) || !(ObjectType))
524  {
525  /* Get the current process and granted access */
526  CurrentProcess = PsGetCurrentProcess();
527  GrantedAccess = CurrentProcess->GrantedAccess;
528 
529  /* Validate access */
530  /* ~GrantedAccess = RefusedAccess.*/
531  /* ~GrantedAccess & DesiredAccess = list of refused bits. */
532  /* !(~GrantedAccess & DesiredAccess) == TRUE means ALL requested rights are granted */
533  if ((AccessMode == KernelMode) ||
534  !(~GrantedAccess & DesiredAccess))
535  {
536  /* Check if the caller wanted handle information */
537  if (HandleInformation)
538  {
539  /* Return it */
540  HandleInformation->HandleAttributes = 0;
541  HandleInformation->GrantedAccess = GrantedAccess;
542  }
543 
544  /* Reference ourselves */
545  ObjectHeader = OBJECT_TO_OBJECT_HEADER(CurrentProcess);
546  InterlockedExchangeAdd(&ObjectHeader->PointerCount, 1);
547 
548  /* Return the pointer */
550  ASSERT(*Object != NULL);
551  Status = STATUS_SUCCESS;
552  }
553  else
554  {
555  /* Access denied */
556  Status = STATUS_ACCESS_DENIED;
557  }
558  }
559  else
560  {
561  /* The caller used this special handle value with a non-process type */
563  }
564 
565  /* Return the status */
566  return Status;
567  }
568  else if (Handle == NtCurrentThread())
569  {
570  /* Check if this is the right object type */
571  if ((ObjectType == PsThreadType) || !(ObjectType))
572  {
573  /* Get the current process and granted access */
574  CurrentThread = PsGetCurrentThread();
575  GrantedAccess = CurrentThread->GrantedAccess;
576 
577  /* Validate access */
578  /* ~GrantedAccess = RefusedAccess.*/
579  /* ~GrantedAccess & DesiredAccess = list of refused bits. */
580  /* !(~GrantedAccess & DesiredAccess) == TRUE means ALL requested rights are granted */
581  if ((AccessMode == KernelMode) ||
582  !(~GrantedAccess & DesiredAccess))
583  {
584  /* Check if the caller wanted handle information */
585  if (HandleInformation)
586  {
587  /* Return it */
588  HandleInformation->HandleAttributes = 0;
589  HandleInformation->GrantedAccess = GrantedAccess;
590  }
591 
592  /* Reference ourselves */
593  ObjectHeader = OBJECT_TO_OBJECT_HEADER(CurrentThread);
594  InterlockedExchangeAdd(&ObjectHeader->PointerCount, 1);
595 
596  /* Return the pointer */
597  *Object = CurrentThread;
598  ASSERT(*Object != NULL);
599  Status = STATUS_SUCCESS;
600  }
601  else
602  {
603  /* Access denied */
604  Status = STATUS_ACCESS_DENIED;
605  }
606  }
607  else
608  {
609  /* The caller used this special handle value with a non-process type */
611  }
612 
613  /* Return the status */
614  return Status;
615  }
616  else if (AccessMode == KernelMode)
617  {
618  /* Use the kernel handle table and get the actual handle value */
620  HandleTable = ObpKernelHandleTable;
621  }
622  else
623  {
624  /* Invalid access, fail */
625  return STATUS_INVALID_HANDLE;
626  }
627  }
628  else
629  {
630  /* Otherwise use this process's handle table */
631  HandleTable = PsGetCurrentProcess()->ObjectTable;
632  }
633 
634  /* Enter a critical region while we touch the handle table */
635  ASSERT(HandleTable != NULL);
637 
638  /* Get the handle entry */
639  HandleEntry = ExMapHandleToPointer(HandleTable, Handle);
640  if (HandleEntry)
641  {
642  /* Get the object header and validate the type*/
643  ObjectHeader = ObpGetHandleObject(HandleEntry);
644  if (!(ObjectType) || (ObjectType == ObjectHeader->Type))
645  {
646  /* Get the granted access and validate it */
647  GrantedAccess = HandleEntry->GrantedAccess;
648 
649  /* Validate access */
650  /* ~GrantedAccess = RefusedAccess.*/
651  /* ~GrantedAccess & DesiredAccess = list of refused bits. */
652  /* !(~GrantedAccess & DesiredAccess) == TRUE means ALL requested rights are granted */
653  if ((AccessMode == KernelMode) ||
654  !(~GrantedAccess & DesiredAccess))
655  {
656  /* Reference the object directly since we have its header */
657  InterlockedIncrement(&ObjectHeader->PointerCount);
658 
659  /* Mask out the internal attributes */
660  Attributes = HandleEntry->ObAttributes & OBJ_HANDLE_ATTRIBUTES;
661 
662  /* Check if the caller wants handle information */
663  if (HandleInformation)
664  {
665  /* Fill out the information */
666  HandleInformation->HandleAttributes = Attributes;
667  HandleInformation->GrantedAccess = GrantedAccess;
668  }
669 
670  /* Return the pointer */
671  *Object = &ObjectHeader->Body;
672 
673  /* Unlock the handle */
674  ExUnlockHandleTableEntry(HandleTable, HandleEntry);
676 
677  /* Return success */
678  ASSERT(*Object != NULL);
679  return STATUS_SUCCESS;
680  }
681  else
682  {
683  /* Requested access failed */
684  DPRINT("Rights not granted: %x\n", ~GrantedAccess & DesiredAccess);
685  Status = STATUS_ACCESS_DENIED;
686  }
687  }
688  else
689  {
690  /* Invalid object type */
692  }
693 
694  /* Unlock the entry */
695  ExUnlockHandleTableEntry(HandleTable, HandleEntry);
696  }
697  else
698  {
699  /* Invalid handle */
700  Status = STATUS_INVALID_HANDLE;
701  }
702 
703  /* Return failure status */
705  *Object = NULL;
706  return Status;
707 }
DWORD *typedef PVOID
Definition: winlogon.h:52
ObjectType
Definition: metafile.c:80
#define PsGetCurrentThread()
Definition: env_spec_w32.h:81
ULONG_PTR ObAttributes
Definition: extypes.h:600
ASSERT((InvokeOnSuccess||InvokeOnError||InvokeOnCancel)?(CompletionRoutine!=NULL):TRUE)
return STATUS_SUCCESS
Definition: btrfs.c:2690
PHANDLE_TABLE_ENTRY NTAPI ExMapHandleToPointer(IN PHANDLE_TABLE HandleTable, IN HANDLE Handle)
Definition: handle.c:1010
#define NtCurrentThread()
static XMS_HANDLE HandleTable[XMS_MAX_HANDLES]
Definition: himem.c:83
VOID NTAPI ExUnlockHandleTableEntry(IN PHANDLE_TABLE HandleTable, IN PHANDLE_TABLE_ENTRY HandleTableEntry)
Definition: handle.c:887
#define STATUS_INVALID_HANDLE
Definition: ntstatus.h:231
#define PAGED_CODE()
Definition: video.h:57
#define OBJECT_TO_OBJECT_HEADER(o)
Definition: obtypes.h:111
_In_ PEPROCESS _In_ KPROCESSOR_MODE AccessMode
Definition: mmfuncs.h:396
#define PsGetCurrentProcess
Definition: psfuncs.h:17
Definition: extypes.h:595
smooth NULL
Definition: ftsmooth.c:416
#define ObpGetHandleObject(x)
Definition: ob.h:81
void DPRINT(...)
Definition: polytest.cpp:61
PHANDLE_TABLE ObpKernelHandleTable
Definition: obhandle.c:20
#define InterlockedExchangeAdd
Definition: interlocked.h:181
#define NtCurrentProcess()
Definition: nt_native.h:1657
_In_ HANDLE Handle
Definition: extypes.h:390
#define STATUS_OBJECT_TYPE_MISMATCH
Definition: ntstatus.h:259
ULONG CurrentProcess
Definition: shell.c:125
LONG NTSTATUS
Definition: precomp.h:26
ULONG GrantedAccess
Definition: extypes.h:606
_In_ ACCESS_MASK _In_opt_ POBJECT_TYPE _In_ KPROCESSOR_MODE _Out_ PVOID _Out_opt_ POBJECT_HANDLE_INFORMATION HandleInformation
Definition: obfuncs.h:40
#define STATUS_ACCESS_DENIED
Definition: udferr_usr.h:145
static IUnknown Object
Definition: main.c:512
POBJECT_TYPE PsThreadType
Definition: thread.c:20
#define KeEnterCriticalRegion()
Definition: ke_x.h:83
Status
Definition: gdiplustypes.h:24
#define KeLeaveCriticalRegion()
Definition: ke_x.h:114
#define InterlockedIncrement
Definition: armddk.h:53
_In_ PIO_STACK_LOCATION _Inout_ PFILE_OBJECT _Inout_ PVCB _Outptr_result_maybenull_ PDCB _In_ PDCB _In_ PDIRENT _In_ ULONG _In_ ULONG _In_ PUNICODE_STRING _In_ PACCESS_MASK DesiredAccess
Definition: create.c:4157
LONG_PTR PointerCount
Definition: obtypes.h:487
unsigned int ULONG
Definition: retypes.h:1
#define ObKernelHandleToHandle(Handle)
Definition: ob.h:73
POBJECT_TYPE Type
Definition: obtypes.h:493
#define OBJ_HANDLE_ATTRIBUTES
Definition: ob.h:52
_In_ PSECURITY_SUBJECT_CONTEXT _In_ BOOLEAN _In_ ACCESS_MASK _In_ ACCESS_MASK _Outptr_opt_ PPRIVILEGE_SET _In_ PGENERIC_MAPPING _In_ KPROCESSOR_MODE _Out_ PACCESS_MASK GrantedAccess
Definition: sefuncs.h:13
POBJECT_TYPE PsProcessType
Definition: process.c:20
ULONG ACCESS_MASK
Definition: nt_native.h:40
struct _ACPI_EFI_FILE_HANDLE CHAR16 UINT64 UINT64 Attributes
Definition: acefiex.h:335
#define HandleToLong(h)
Definition: basetsd.h:80
NTSTATUS NTAPI ObReferenceObjectByName ( IN PUNICODE_STRING  ObjectPath,
IN ULONG  Attributes,
IN PACCESS_STATE  PassedAccessState,
IN ACCESS_MASK  DesiredAccess,
IN POBJECT_TYPE  ObjectType,
IN KPROCESSOR_MODE  AccessMode,
IN OUT PVOID  ParseContext,
OUT PVOID ObjectPtr 
)

Definition at line 411 of file obref.c.

Referenced by CreateClientPort(), IopGetDriverObject(), IopUnloadDriver(), NtSecureConnectPort(), ObtClose(), and TestReference().

419 {
420  PVOID Object = NULL;
424  AUX_ACCESS_DATA AuxData;
426  PAGED_CODE();
427 
428  /* Fail quickly */
429  if (!ObjectPath) return STATUS_OBJECT_NAME_INVALID;
430 
431  /* Capture the name */
432  Status = ObpCaptureObjectName(&ObjectName, ObjectPath, AccessMode, TRUE);
433  if (!NT_SUCCESS(Status)) return Status;
434 
435  /* We also need a valid name after capture */
436  if (!ObjectName.Length) return STATUS_OBJECT_NAME_INVALID;
437 
438  /* Check if we didn't get an access state */
439  if (!PassedAccessState)
440  {
441  /* Use our built-in access state */
443  Status = SeCreateAccessState(&AccessState,
444  &AuxData,
446  &ObjectType->TypeInfo.GenericMapping);
447  if (!NT_SUCCESS(Status)) goto Quickie;
448  }
449 
450  /* Find the object */
451  *ObjectPtr = NULL;
452  Status = ObpLookupObjectName(NULL,
453  &ObjectName,
454  Attributes,
455  ObjectType,
456  AccessMode,
457  ParseContext,
458  NULL,
459  NULL,
461  &Context,
462  &Object);
463 
464  /* Cleanup after lookup */
465  ObpReleaseLookupContext(&Context);
466 
467  /* Check if the lookup succeeded */
468  if (NT_SUCCESS(Status))
469  {
470  /* Check if access is allowed */
471  if (ObpCheckObjectReference(Object,
473  FALSE,
474  AccessMode,
475  &Status))
476  {
477  /* Return the object */
478  *ObjectPtr = Object;
479  }
480  }
481 
482  /* Free the access state */
483  if (PassedAccessState == &AccessState)
484  {
486  }
487 
488 Quickie:
489  /* Free the captured name if we had one, and return status */
490  ObpFreeObjectNameBuffer(&ObjectName);
491  return Status;
492 }
DWORD *typedef PVOID
Definition: winlogon.h:52
ObjectType
Definition: metafile.c:80
BOOLEAN NTAPI ObpCheckObjectReference(IN PVOID Object, IN OUT PACCESS_STATE AccessState, IN BOOLEAN LockHeld, IN KPROCESSOR_MODE AccessMode, OUT PNTSTATUS AccessStatus)
Definition: obsecure.c:340
#define TRUE
Definition: types.h:120
NTSTATUS NTAPI SeCreateAccessState(IN OUT PACCESS_STATE AccessState, IN PAUX_ACCESS_DATA AuxData, IN ACCESS_MASK Access, IN PGENERIC_MAPPING GenericMapping)
Definition: access.c:435
VOID NTAPI ObpFreeObjectNameBuffer(IN PUNICODE_STRING Name)
Definition: oblife.c:347
_Inout_opt_ PACCESS_STATE PassedAccessState
Definition: obfuncs.h:71
_In_ PVOID _Out_opt_ PULONG_PTR _Outptr_opt_ PCUNICODE_STRING * ObjectName
Definition: cmfuncs.h:62
#define PAGED_CODE()
Definition: video.h:57
#define FALSE
Definition: types.h:117
_In_ PEPROCESS _In_ KPROCESSOR_MODE AccessMode
Definition: mmfuncs.h:396
smooth NULL
Definition: ftsmooth.c:416
LONG NTSTATUS
Definition: precomp.h:26
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:24
static IUnknown Object
Definition: main.c:512
_In_opt_ PVOID _In_opt_ PUNICODE_STRING _In_ PSECURITY_DESCRIPTOR _In_ PACCESS_STATE AccessState
Definition: sefuncs.h:414
Status
Definition: gdiplustypes.h:24
FORCEINLINE VOID ObpReleaseLookupContext(IN POBP_LOOKUP_CONTEXT Context)
Definition: ob_x.h:255
_In_ PIO_STACK_LOCATION _Inout_ PFILE_OBJECT _Inout_ PVCB _Outptr_result_maybenull_ PDCB _In_ PDCB _In_ PDIRENT _In_ ULONG _In_ ULONG _In_ PUNICODE_STRING _In_ PACCESS_MASK DesiredAccess
Definition: create.c:4157
#define STATUS_OBJECT_NAME_INVALID
Definition: udferr_usr.h:148
VOID NTAPI SeDeleteAccessState(IN PACCESS_STATE AccessState)
Definition: access.c:456
struct tagContext Context
Definition: acpixf.h:1014
NTSTATUS NTAPI ObpCaptureObjectName(IN PUNICODE_STRING CapturedName, IN PUNICODE_STRING ObjectName, IN KPROCESSOR_MODE AccessMode, IN BOOLEAN AllocateFromLookaside)
struct _ACPI_EFI_FILE_HANDLE CHAR16 UINT64 UINT64 Attributes
Definition: acefiex.h:335
NTSTATUS NTAPI ObpLookupObjectName(IN HANDLE RootHandle OPTIONAL, IN OUT PUNICODE_STRING ObjectName, IN ULONG Attributes, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, IN OUT PVOID ParseContext, IN PSECURITY_QUALITY_OF_SERVICE SecurityQos OPTIONAL, IN PVOID InsertObject OPTIONAL, IN OUT PACCESS_STATE AccessState, OUT POBP_LOOKUP_CONTEXT LookupContext, OUT PVOID *FoundObject)
Definition: obname.c:358
NTSTATUS NTAPI ObReferenceObjectByPointer ( IN PVOID  Object,
IN ACCESS_MASK  DesiredAccess,
IN POBJECT_TYPE  ObjectType,
IN KPROCESSOR_MODE  AccessMode 
)

Definition at line 383 of file obref.c.

Referenced by CcRosInitializeFileCache(), ClassRetrieveDeviceRelations(), co_UserCreateWindowEx(), DriverEntry(), HalpDmaAllocateChildAdapter(), IoWMIQueryAllData(), MmPageOutPhysicalAddress(), ObOpenObjectByPointer(), ObpLookupObjectName(), ObpParseSymbolicLink(), RxpWorkerThreadDispatcher(), RxSpinUpRequestsDispatcher(), ScsiClassClaimDevice(), and TestReference().

387 {
389 
390  /* Get the header */
392 
393  /*
394  * Validate object type if the call is for UserMode.
395  * NOTE: Unless it's a symbolic link (Caz Yokoyama [MSFT])
396  */
397  if ((Header->Type != ObjectType) && ((AccessMode != KernelMode) ||
399  {
400  /* Invalid type */
402  }
403 
404  /* Increment the reference count and return success */
406  return STATUS_SUCCESS;
407 }
ObjectType
Definition: metafile.c:80
return STATUS_SUCCESS
Definition: btrfs.c:2690
#define OBJECT_TO_OBJECT_HEADER(o)
Definition: obtypes.h:111
Definition: Header.h:8
_In_ PEPROCESS _In_ KPROCESSOR_MODE AccessMode
Definition: mmfuncs.h:396
#define STATUS_OBJECT_TYPE_MISMATCH
Definition: ntstatus.h:259
static IUnknown Object
Definition: main.c:512
#define InterlockedIncrement
Definition: armddk.h:53
LONG_PTR PointerCount
Definition: obtypes.h:487
POBJECT_TYPE ObSymbolicLinkType
Definition: oblink.c:18
POBJECT_TYPE Type
Definition: obtypes.h:493
LONG FASTCALL ObReferenceObjectEx ( IN PVOID  Object,
IN LONG  Count 
)

Definition at line 79 of file obref.c.

Referenced by ObFastReferenceObject(), ObFastReplaceObject(), ObInitializeFastReference(), and PspCreateThread().

81 {
82  /* Increment the reference count and return the count now */
84  PointerCount,
85  Count) + Count;
86 }
_Inout_ __drv_aliasesMem PSLIST_ENTRY _Inout_ PSLIST_ENTRY _In_ ULONG Count
Definition: exfuncs.h:1015
#define OBJECT_TO_OBJECT_HEADER(o)
Definition: obtypes.h:111
#define InterlockedExchangeAdd
Definition: interlocked.h:181
static IUnknown Object
Definition: main.c:512
BOOLEAN FASTCALL ObReferenceObjectSafe ( IN PVOID  Object)

Definition at line 24 of file obref.c.

Referenced by _Function_class_(), CmpFlushNotifiesOnKeyBodyList(), NtImpersonateClientOfPort(), NtRequestPort(), PsGetNextProcess(), PsGetNextProcessThread(), PsLookupProcessByProcessId(), PsLookupProcessThreadByCid(), PsLookupThreadByThreadId(), and PspExitThread().

25 {
26  POBJECT_HEADER ObjectHeader;
27  LONG OldValue, NewValue;
28 
29  /* Get the object header */
30  ObjectHeader = OBJECT_TO_OBJECT_HEADER(Object);
31 
32  /* Get the current reference count and fail if it's zero */
33  OldValue = ObjectHeader->PointerCount;
34  if (!OldValue) return FALSE;
35 
36  /* Start reference loop */
37  do
38  {
39  /* Increase the reference count */
40  NewValue = InterlockedCompareExchange(&ObjectHeader->PointerCount,
41  OldValue + 1,
42  OldValue);
43  if (OldValue == NewValue) return TRUE;
44 
45  /* Keep looping */
46  OldValue = NewValue;
47  } while (OldValue);
48 
49  /* If we got here, then the reference count is now 0 */
50  return FALSE;
51 }
#define TRUE
Definition: types.h:120
#define InterlockedCompareExchange
Definition: interlocked.h:104
#define OBJECT_TO_OBJECT_HEADER(o)
Definition: obtypes.h:111
#define FALSE
Definition: types.h:117
long LONG
Definition: pedump.c:60
static IUnknown Object
Definition: main.c:512
LONG_PTR PointerCount
Definition: obtypes.h:487

Variable Documentation

ULONG ObpAccessProtectCloseBit

Definition at line 21 of file obhandle.c.

Referenced by ObpSetHandleAttributes(), and ObReferenceFileObjectForWrite().