[ros-diffs] [cgutman] 48546: [NTOSKRNL] - Move to the next entry in the thread IRP list before calling IoCancelIrp because if everything works as expected and IoCompleteRequest is called, we could end up with the IRP ripped out from under us before can move to the next element - See issue #5550 for details.

[cgutman at svn.reactos.org]

Author: cgutman
Date: Sat Aug 14 14:55:12 2010
New Revision: 48546

URL: http://svn.reactos.org/svn/reactos?rev=48546&view=rev
Log:
[NTOSKRNL]
- Move to the next entry in the thread IRP list before calling IoCancelIrp because if everything works as expected and IoCompleteRequest is called, we could end up with the IRP ripped out from under us before can move to the next element
- See issue #5550 for details.

Modified:
    trunk/reactos/ntoskrnl/io/iomgr/irp.c

Modified: trunk/reactos/ntoskrnl/io/iomgr/irp.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/io/iomgr/irp.c?rev=48546&r1=48545&r2=48546&view=diff
==============================================================================
--- trunk/reactos/ntoskrnl/io/iomgr/irp.c [iso-8859-1] (original)
+++ trunk/reactos/ntoskrnl/io/iomgr/irp.c [iso-8859-1] Sat Aug 14 14:55:12 2010
@@ -1047,14 +1047,12 @@
     NextEntry = ListHead->Flink;
     while (ListHead != NextEntry)
     {
-        /* Get the IRP */
+        /* Get the IRP and move to the next entry */
         Irp = CONTAINING_RECORD(NextEntry, IRP, ThreadListEntry);
+        NextEntry = NextEntry->Flink;
 
         /* Cancel it */
         IoCancelIrp(Irp);
-
-        /* Move to the next entry */
-        NextEntry = NextEntry->Flink;
     }
 
      /* Wait 100 milliseconds */