reactos/ntoskrnl/ob/object.c

   1 /* $Id$
   2  *
   3  * COPYRIGHT:       See COPYING in the top level directory
   4  * PROJECT:         ReactOS kernel
   5  * FILE:            ntoskrnl/ob/object.c
   6  * PURPOSE:         Implements generic object managment functions
   7  *
   8  * PROGRAMMERS:     David Welch (welch@cwcom.net)
   9  *                  Skywing (skywing@valhallalegends.com)
  10  */
  11
  12 /* INCLUDES *****************************************************************/
  13
  14 #include <ntoskrnl.h>
  15 #define NDEBUG
  16 #include <internal/debug.h>
  17
  18
  19 typedef struct _RETENTION_CHECK_PARAMS
  20 {
  21   WORK_QUEUE_ITEM WorkItem;
  22   POBJECT_HEADER ObjectHeader;
  23 } RETENTION_CHECK_PARAMS, *PRETENTION_CHECK_PARAMS;
  24
  25 /* TEMPORARY HACK. DO NOT REMOVE -- Alex */
  26 NTSTATUS
  27 STDCALL
  28 ExpDesktopCreate(PVOID ObjectBody,
  29                  PVOID Parent,
  30                  PWSTR RemainingPath,
  31                  struct _OBJECT_ATTRIBUTES* ObjectAttributes);
  32 /* FUNCTIONS ************************************************************/
  33
  34 NTSTATUS
  35 ObpCaptureObjectAttributes(IN POBJECT_ATTRIBUTES ObjectAttributes  OPTIONAL,
  36                            IN KPROCESSOR_MODE AccessMode,
  37                            IN POOL_TYPE PoolType,
  38                            IN BOOLEAN CaptureIfKernel,
  39                            OUT PCAPTURED_OBJECT_ATTRIBUTES CapturedObjectAttributes  OPTIONAL,
  40                            OUT PUNICODE_STRING ObjectName  OPTIONAL)
  41 {
  42   OBJECT_ATTRIBUTES AttributesCopy;
  43   NTSTATUS Status = STATUS_SUCCESS;
  44
  45   /* at least one output parameter must be != NULL! */
  46   ASSERT(CapturedObjectAttributes != NULL || ObjectName != NULL);
  47
  48   if(ObjectAttributes == NULL)
  49   {
  50     /* we're going to return STATUS_SUCCESS! */
  51     goto failbasiccleanup;
  52   }
  53
  54   if(AccessMode != KernelMode)
  55   {
  56     RtlZeroMemory(&AttributesCopy, sizeof(AttributesCopy));
  57
  58     _SEH_TRY
  59     {
  60       ProbeForRead(ObjectAttributes,
  61                    sizeof(ObjectAttributes),
  62                    sizeof(ULONG));
  63       /* make a copy on the stack */
  64       AttributesCopy = *ObjectAttributes;
  65     }
  66     _SEH_HANDLE
  67     {
  68       Status = _SEH_GetExceptionCode();
  69     }
  70     _SEH_END;
  71
  72     if(!NT_SUCCESS(Status))
  73     {
  74       DPRINT1("ObpCaptureObjectAttributes failed to probe object attributes\n");
  75       goto failbasiccleanup;
  76     }
  77   }
  78   else if(!CaptureIfKernel)
  79   {
  80     if(ObjectAttributes->Length == sizeof(OBJECT_ATTRIBUTES))
  81     {
  82       if(ObjectName != NULL)
  83       {
  84         /* we don't have to capture any memory, the caller considers the passed data
  85            as valid */
  86         if(ObjectAttributes->ObjectName != NULL)
  87         {
  88           *ObjectName = *ObjectAttributes->ObjectName;
  89         }
  90         else
  91         {
  92           ObjectName->Length = ObjectName->MaximumLength = 0;
  93           ObjectName->Buffer = NULL;
  94         }
  95       }
  96       if(CapturedObjectAttributes != NULL)
  97       {
  98         CapturedObjectAttributes->RootDirectory = ObjectAttributes->RootDirectory;
  99         CapturedObjectAttributes->Attributes = ObjectAttributes->Attributes;
 100         CapturedObjectAttributes->SecurityDescriptor = ObjectAttributes->SecurityDescriptor;
 101         CapturedObjectAttributes->SecurityQualityOfService = ObjectAttributes->SecurityQualityOfService;
 102       }
 103
 104       return STATUS_SUCCESS;
 105     }
 106     else
 107     {
 108       Status = STATUS_INVALID_PARAMETER;
 109       goto failbasiccleanup;
 110     }
 111   }
 112   else
 113   {
 114     AttributesCopy = *ObjectAttributes;
 115   }
 116
 117   /* if Length isn't as expected, bail with an invalid parameter status code so
 118      the caller knows he passed garbage... */
 119   if(AttributesCopy.Length != sizeof(OBJECT_ATTRIBUTES))
 120   {
 121     Status = STATUS_INVALID_PARAMETER;
 122     goto failbasiccleanup;
 123   }
 124
 125   if(CapturedObjectAttributes != NULL)
 126   {
 127     CapturedObjectAttributes->RootDirectory = AttributesCopy.RootDirectory;
 128     CapturedObjectAttributes->Attributes = AttributesCopy.Attributes;
 129
 130     if(AttributesCopy.SecurityDescriptor != NULL)
 131     {
 132       Status = SeCaptureSecurityDescriptor(AttributesCopy.SecurityDescriptor,
 133                                            AccessMode,
 134                                            PoolType,
 135                                            TRUE,
 136                                            &CapturedObjectAttributes->SecurityDescriptor);
 137       if(!NT_SUCCESS(Status))
 138       {
 139         DPRINT1("Unable to capture the security descriptor!!!\n");
 140         goto failbasiccleanup;
 141       }
 142     }
 143     else
 144     {
 145       CapturedObjectAttributes->SecurityDescriptor = NULL;
 146     }
 147
 148     if(AttributesCopy.SecurityQualityOfService != NULL)
 149     {
 150       SECURITY_QUALITY_OF_SERVICE SafeQoS;
 151
 152       RtlZeroMemory(&SafeQoS, sizeof(SafeQoS));
 153
 154       _SEH_TRY
 155       {
 156         ProbeForRead(AttributesCopy.SecurityQualityOfService,
 157                      sizeof(SECURITY_QUALITY_OF_SERVICE),
 158                      sizeof(ULONG));
 159         SafeQoS = *(PSECURITY_QUALITY_OF_SERVICE)AttributesCopy.SecurityQualityOfService;
 160       }
 161       _SEH_HANDLE
 162       {
 163         Status = _SEH_GetExceptionCode();
 164       }
 165       _SEH_END;
 166
 167       if(!NT_SUCCESS(Status))
 168       {
 169         DPRINT1("Unable to capture QoS!!!\n");
 170         goto failcleanupsdescriptor;
 171       }
 172
 173       if(SafeQoS.Length != sizeof(SECURITY_QUALITY_OF_SERVICE))
 174       {
 175         DPRINT1("Unable to capture QoS, wrong size!!!\n");
 176         Status = STATUS_INVALID_PARAMETER;
 177         goto failcleanupsdescriptor;
 178       }
 179
 180       CapturedObjectAttributes->SecurityQualityOfService = ExAllocatePool(PoolType,
 181                                                                           sizeof(SECURITY_QUALITY_OF_SERVICE));
 182       if(CapturedObjectAttributes->SecurityQualityOfService != NULL)
 183       {
 184         *CapturedObjectAttributes->SecurityQualityOfService = SafeQoS;
 185       }
 186       else
 187       {
 188         Status = STATUS_INSUFFICIENT_RESOURCES;
 189         goto failcleanupsdescriptor;
 190       }
 191     }
 192     else
 193     {
 194       CapturedObjectAttributes->SecurityQualityOfService = NULL;
 195     }
 196   }
 197
 198   if(ObjectName != NULL)
 199   {
 200     if(AttributesCopy.ObjectName != NULL)
 201     {
 202       UNICODE_STRING OriginalCopy;
 203
 204       if(AccessMode != KernelMode)
 205       {
 206         RtlZeroMemory(&OriginalCopy, sizeof(OriginalCopy));
 207
 208         _SEH_TRY
 209         {
 210           /* probe the ObjectName structure and make a local stack copy of it */
 211           ProbeForRead(AttributesCopy.ObjectName,
 212                        sizeof(UNICODE_STRING),
 213                        sizeof(ULONG));
 214           OriginalCopy = *AttributesCopy.ObjectName;
 215           if(OriginalCopy.Length > 0)
 216           {
 217             ProbeForRead(OriginalCopy.Buffer,
 218                          OriginalCopy.Length,
 219                          sizeof(WCHAR));
 220           }
 221         }
 222         _SEH_HANDLE
 223         {
 224           Status = _SEH_GetExceptionCode();
 225         }
 226         _SEH_END;
 227
 228         if(NT_SUCCESS(Status))
 229         {
 230           if(OriginalCopy.Length > 0)
 231           {
 232             ObjectName->MaximumLength = OriginalCopy.Length + sizeof(WCHAR);
 233             ObjectName->Buffer = ExAllocatePool(PoolType,
 234                                                 ObjectName->MaximumLength);
 235             if(ObjectName->Buffer != NULL)
 236             {
 237               _SEH_TRY
 238               {
 239                 /* no need to probe OriginalCopy.Buffer again, we already did that
 240                    when capturing the UNICODE_STRING structure itself */
 241                 RtlCopyMemory(ObjectName->Buffer, OriginalCopy.Buffer, OriginalCopy.Length);
 242                 ObjectName->Buffer[OriginalCopy.Length / sizeof(WCHAR)] = L'\0';
 243               }
 244               _SEH_HANDLE
 245               {
 246                 Status = _SEH_GetExceptionCode();
 247               }
 248               _SEH_END;
 249
 250               if(!NT_SUCCESS(Status))
 251               {
 252                 DPRINT1("ObpCaptureObjectAttributes failed to copy the unicode string!\n");
 253               }
 254             }
 255             else
 256             {
 257               Status = STATUS_INSUFFICIENT_RESOURCES;
 258             }
 259           }
 260           else if(AttributesCopy.RootDirectory != NULL /* && OriginalCopy.Length == 0 */)
 261           {
 262             /* if the caller specified a root directory, there must be an object name! */
 263             Status = STATUS_OBJECT_NAME_INVALID;
 264           }
 265         }
 266         else
 267         {
 268           DPRINT1("ObpCaptureObjectAttributes failed to probe the object name UNICODE_STRING structure!\n");
 269         }
 270       }
 271       else /* AccessMode == KernelMode */
 272       {
 273         OriginalCopy = *AttributesCopy.ObjectName;
 274
 275         if(OriginalCopy.Length > 0)
 276         {
 277           ObjectName->MaximumLength = OriginalCopy.Length + sizeof(WCHAR);
 278           ObjectName->Buffer = ExAllocatePool(PoolType,
 279                                               ObjectName->MaximumLength);
 280           if(ObjectName->Buffer != NULL)
 281           {
 282             RtlCopyMemory(ObjectName->Buffer, OriginalCopy.Buffer, OriginalCopy.Length);
 283             ObjectName->Buffer[OriginalCopy.Length / sizeof(WCHAR)] = L'\0';
 284           }
 285           else
 286           {
 287             Status = STATUS_INSUFFICIENT_RESOURCES;
 288           }
 289         }
 290         else if(AttributesCopy.RootDirectory != NULL /* && OriginalCopy.Length == 0 */)
 291         {
 292           /* if the caller specified a root directory, there must be an object name! */
 293           Status = STATUS_OBJECT_NAME_INVALID;
 294         }
 295       }
 296     }
 297     else
 298     {
 299       ObjectName->Length = ObjectName->MaximumLength = 0;
 300       ObjectName->Buffer = NULL;
 301     }
 302   }
 303
 304   if(!NT_SUCCESS(Status))
 305   {
 306     if(ObjectName->Buffer)
 307     {
 308       ExFreePool(ObjectName->Buffer);
 309     }
 310
 311 failcleanupsdescriptor:
 312     if(CapturedObjectAttributes != NULL)
 313     {
 314       /* cleanup allocated resources */
 315       SeReleaseSecurityDescriptor(CapturedObjectAttributes->SecurityDescriptor,
 316                                   AccessMode,
 317                                   TRUE);
 318     }
 319
 320 failbasiccleanup:
 321     if(ObjectName != NULL)
 322     {
 323       ObjectName->Length = ObjectName->MaximumLength = 0;
 324       ObjectName->Buffer = NULL;
 325     }
 326     if(CapturedObjectAttributes != NULL)
 327     {
 328       RtlZeroMemory(CapturedObjectAttributes, sizeof(CAPTURED_OBJECT_ATTRIBUTES));
 329     }
 330   }
 331
 332   return Status;
 333 }
 334
 335
 336 VOID
 337 ObpReleaseObjectAttributes(IN PCAPTURED_OBJECT_ATTRIBUTES CapturedObjectAttributes  OPTIONAL,
 338                            IN PUNICODE_STRING ObjectName  OPTIONAL,
 339                            IN KPROCESSOR_MODE AccessMode,
 340                            IN BOOLEAN CaptureIfKernel)
 341 {
 342   /* WARNING - You need to pass the same parameters to this function as you passed
 343                to ObpCaptureObjectAttributes() to avoid memory leaks */
 344   if(AccessMode != KernelMode || CaptureIfKernel)
 345   {
 346     if(CapturedObjectAttributes != NULL)
 347     {
 348       if(CapturedObjectAttributes->SecurityDescriptor != NULL)
 349       {
 350         ExFreePool(CapturedObjectAttributes->SecurityDescriptor);
 351         CapturedObjectAttributes->SecurityDescriptor = NULL;
 352       }
 353       if(CapturedObjectAttributes->SecurityQualityOfService != NULL)
 354       {
 355         ExFreePool(CapturedObjectAttributes->SecurityQualityOfService);
 356         CapturedObjectAttributes->SecurityQualityOfService = NULL;
 357       }
 358     }
 359     if(ObjectName != NULL &&
 360        ObjectName->Length > 0)
 361     {
 362       ExFreePool(ObjectName->Buffer);
 363     }
 364   }
 365 }
 366
 367
 368 /**********************************************************************
 369  * NAME                                                 PRIVATE
 370  *      ObFindObject@16
 371  *
 372  * DESCRIPTION
 373  *
 374  * ARGUMENTS
 375  *      ObjectAttributes
 376  *
 377  *      ReturnedObject
 378  *
 379  *      RemainigPath
 380  *              Pointer to a unicode string that will contain the
 381  *              remaining path if the function returns successfully.
 382  *              The caller must free the buffer after use by calling
 383  *              RtlFreeUnicodeString ().
 384  *
 385  *      ObjectType
 386  *              Optional pointer to an object type. This is used to
 387  *              descide if a symbolic link object will be parsed or not.
 388  *
 389  * RETURN VALUE
 390  */
 391 NTSTATUS
 392 ObFindObject(POBJECT_ATTRIBUTES ObjectAttributes,
 393              PVOID* ReturnedObject,
 394              PUNICODE_STRING RemainingPath,
 395              POBJECT_TYPE ObjectType)
 396 {
 397   PVOID NextObject;
 398   PVOID CurrentObject;
 399   PVOID RootObject;
 400   POBJECT_HEADER CurrentHeader;
 401   NTSTATUS Status;
 402   PWSTR current;
 403   UNICODE_STRING PathString;
 404   ULONG Attributes;
 405   PUNICODE_STRING ObjectName;
 406
 407   PAGED_CODE();
 408
 409   DPRINT("ObFindObject(ObjectAttributes %x, ReturnedObject %x, "
 410          "RemainingPath %x)\n",ObjectAttributes,ReturnedObject,RemainingPath);
 411   DPRINT("ObjectAttributes->ObjectName %wZ\n",
 412          ObjectAttributes->ObjectName);
 413
 414   RtlInitUnicodeString (RemainingPath, NULL);
 415
 416   if (ObjectAttributes->RootDirectory == NULL)
 417     {
 418       ObReferenceObjectByPointer(NameSpaceRoot,
 419                                  DIRECTORY_TRAVERSE,
 420                                  NULL,
 421                                  UserMode);
 422       CurrentObject = NameSpaceRoot;
 423     }
 424   else
 425     {
 426       Status = ObReferenceObjectByHandle(ObjectAttributes->RootDirectory,
 427                                          0,
 428                                          NULL,
 429                                          UserMode,
 430                                          &CurrentObject,
 431                                          NULL);
 432       if (!NT_SUCCESS(Status))
 433         {
 434           return Status;
 435         }
 436     }
 437
 438   ObjectName = ObjectAttributes->ObjectName;
 439   if (ObjectName->Length == 0 ||
 440       ObjectName->Buffer[0] == UNICODE_NULL)
 441     {
 442       *ReturnedObject = CurrentObject;
 443       return STATUS_SUCCESS;
 444     }
 445
 446   if (ObjectAttributes->RootDirectory == NULL &&
 447       ObjectName->Buffer[0] != L'\\')
 448     {
 449       ObDereferenceObject (CurrentObject);
 450       return STATUS_UNSUCCESSFUL;
 451     }
 452
 453   /* Create a zero-terminated copy of the object name */
 454   PathString.Length = ObjectName->Length;
 455   PathString.MaximumLength = ObjectName->Length + sizeof(WCHAR);
 456   PathString.Buffer = ExAllocatePool (NonPagedPool,
 457                                       PathString.MaximumLength);
 458   if (PathString.Buffer == NULL)
 459     {
 460       ObDereferenceObject (CurrentObject);
 461       return STATUS_INSUFFICIENT_RESOURCES;
 462     }
 463
 464   RtlCopyMemory (PathString.Buffer,
 465                  ObjectName->Buffer,
 466                  ObjectName->Length);
 467   PathString.Buffer[PathString.Length / sizeof(WCHAR)] = UNICODE_NULL;
 468
 469   current = PathString.Buffer;
 470
 471   RootObject = CurrentObject;
 472   Attributes = ObjectAttributes->Attributes;
 473   if (ObjectType == ObSymbolicLinkType)
 474     Attributes |= OBJ_OPENLINK;
 475
 476   while (TRUE)
 477     {
 478         DPRINT("current %S\n",current);
 479         CurrentHeader = BODY_TO_HEADER(CurrentObject);
 480
 481         DPRINT("Current ObjectType %wZ\n",
 482                &CurrentHeader->ObjectType->TypeName);
 483
 484         if (CurrentHeader->ObjectType->TypeInfo.ParseProcedure == NULL)
 485           {
 486              DPRINT("Current object can't parse\n");
 487              break;
 488           }
 489         Status = CurrentHeader->ObjectType->TypeInfo.ParseProcedure(CurrentObject,
 490                                                   &NextObject,
 491                                                   &PathString,
 492                                                   &current,
 493                                                   Attributes);
 494         if (Status == STATUS_REPARSE)
 495           {
 496              /* reparse the object path */
 497              NextObject = NameSpaceRoot;
 498              current = PathString.Buffer;
 499
 500              ObReferenceObjectByPointer(NextObject,
 501                                         DIRECTORY_TRAVERSE,
 502                                         NULL,
 503                                         UserMode);
 504           }
 505
 506         if (NextObject == NULL)
 507           {
 508              break;
 509           }
 510         ObDereferenceObject(CurrentObject);
 511         CurrentObject = NextObject;
 512     }
 513
 514   if (current)
 515      RtlpCreateUnicodeString (RemainingPath, current, NonPagedPool);
 516   RtlFreeUnicodeString (&PathString);
 517   *ReturnedObject = CurrentObject;
 518
 519   return STATUS_SUCCESS;
 520 }
 521
 522
 523 /**********************************************************************
 524  * NAME                                                 EXPORTED
 525  *      ObQueryNameString@16
 526  *
 527  * DESCRIPTION
 528  *
 529  * ARGUMENTS
 530  *
 531  * RETURN VALUE
 532  *
 533  * @implemented
 534  */
 535 NTSTATUS STDCALL
 536 ObQueryNameString (IN PVOID Object,
 537                    OUT POBJECT_NAME_INFORMATION ObjectNameInfo,
 538                    IN ULONG Length,
 539                    OUT PULONG ReturnLength)
 540 {
 541   POBJECT_NAME_INFORMATION LocalInfo;
 542   POBJECT_HEADER ObjectHeader;
 543   ULONG LocalReturnLength;
 544   NTSTATUS Status;
 545
 546   PAGED_CODE();
 547
 548   *ReturnLength = 0;
 549
 550   if (Length < sizeof(OBJECT_NAME_INFORMATION) + sizeof(WCHAR))
 551     return STATUS_INVALID_BUFFER_SIZE;
 552
 553   ObjectNameInfo->Name.MaximumLength = (USHORT)(Length - sizeof(OBJECT_NAME_INFORMATION));
 554   ObjectNameInfo->Name.Length = 0;
 555   ObjectNameInfo->Name.Buffer =
 556     (PWCHAR)((ULONG_PTR)ObjectNameInfo + sizeof(OBJECT_NAME_INFORMATION));
 557   ObjectNameInfo->Name.Buffer[0] = 0;
 558
 559   ObjectHeader = BODY_TO_HEADER(Object);
 560
 561   if (ObjectHeader->ObjectType != NULL &&
 562       ObjectHeader->ObjectType->TypeInfo.QueryNameProcedure != NULL)
 563     {
 564       DPRINT ("Calling %x\n", ObjectHeader->ObjectType->TypeInfo.QueryNameProcedure);
 565       Status = ObjectHeader->ObjectType->TypeInfo.QueryNameProcedure (Object,
 566                                                     ObjectNameInfo,
 567                                                     Length,
 568                                                     ReturnLength);
 569     }
 570   else if (ObjectHeader->Name.Length > 0 && ObjectHeader->Name.Buffer != NULL)
 571     {
 572       DPRINT ("Object does not have a 'QueryName' function\n");
 573
 574       if (ObjectHeader->Parent == NameSpaceRoot)
 575         {
 576           DPRINT ("Reached the root directory\n");
 577           ObjectNameInfo->Name.Length = 0;
 578           ObjectNameInfo->Name.Buffer[0] = 0;
 579           Status = STATUS_SUCCESS;
 580         }
 581       else if (ObjectHeader->Parent != NULL)
 582         {
 583           LocalInfo = ExAllocatePool (NonPagedPool,
 584                                       sizeof(OBJECT_NAME_INFORMATION) +
 585                                       MAX_PATH * sizeof(WCHAR));
 586           if (LocalInfo == NULL)
 587             return STATUS_INSUFFICIENT_RESOURCES;
 588
 589           Status = ObQueryNameString (ObjectHeader->Parent,
 590                                       LocalInfo,
 591                                       MAX_PATH * sizeof(WCHAR),
 592                                       &LocalReturnLength);
 593           if (!NT_SUCCESS (Status))
 594             {
 595               ExFreePool (LocalInfo);
 596               return Status;
 597             }
 598
 599           Status = RtlAppendUnicodeStringToString (&ObjectNameInfo->Name,
 600                                                    &LocalInfo->Name);
 601
 602           ExFreePool (LocalInfo);
 603
 604           if (!NT_SUCCESS (Status))
 605             return Status;
 606         }
 607
 608       DPRINT ("Object path %wZ\n", &ObjectHeader->Name);
 609       Status = RtlAppendUnicodeToString (&ObjectNameInfo->Name,
 610                                          L"\\");
 611       if (!NT_SUCCESS (Status))
 612         return Status;
 613
 614       Status = RtlAppendUnicodeStringToString (&ObjectNameInfo->Name,
 615                                                &ObjectHeader->Name);
 616     }
 617   else
 618     {
 619       DPRINT ("Object is unnamed\n");
 620
 621       ObjectNameInfo->Name.MaximumLength = 0;
 622       ObjectNameInfo->Name.Length = 0;
 623       ObjectNameInfo->Name.Buffer = NULL;
 624
 625       Status = STATUS_SUCCESS;
 626     }
 627
 628   if (NT_SUCCESS (Status))
 629     {
 630       ObjectNameInfo->Name.MaximumLength =
 631         (ObjectNameInfo->Name.Length) ? ObjectNameInfo->Name.Length + sizeof(WCHAR) : 0;
 632       *ReturnLength =
 633         sizeof(OBJECT_NAME_INFORMATION) + ObjectNameInfo->Name.MaximumLength;
 634       DPRINT ("Returned object path: %wZ\n", &ObjectNameInfo->Name);
 635     }
 636
 637   return Status;
 638 }
 639
 640
 641 /**********************************************************************
 642  * NAME                                                 EXPORTED
 643  *      ObCreateObject@36
 644  *
 645  * DESCRIPTION
 646  *
 647  * ARGUMENTS
 648  *
 649  * RETURN VALUE
 650  *      Status
 651  *
 652  * @implemented
 653  */
 654 NTSTATUS STDCALL
 655 ObCreateObject (IN KPROCESSOR_MODE ObjectAttributesAccessMode OPTIONAL,
 656                 IN POBJECT_TYPE Type,
 657                 IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
 658                 IN KPROCESSOR_MODE AccessMode,
 659                 IN OUT PVOID ParseContext OPTIONAL,
 660                 IN ULONG ObjectSize,
 661                 IN ULONG PagedPoolCharge OPTIONAL,
 662                 IN ULONG NonPagedPoolCharge OPTIONAL,
 663                 OUT PVOID *Object)
 664 {
 665   PVOID Parent = NULL;
 666   UNICODE_STRING RemainingPath;
 667   POBJECT_HEADER Header;
 668   POBJECT_HEADER ParentHeader = NULL;
 669   NTSTATUS Status = 0;
 670   BOOLEAN ObjectAttached = FALSE;
 671   PWCHAR NamePtr;
 672   PSECURITY_DESCRIPTOR NewSecurityDescriptor = NULL;
 673   SECURITY_SUBJECT_CONTEXT SubjectContext;
 674
 675   PAGED_CODE();
 676
 677   if(ObjectAttributesAccessMode == UserMode && ObjectAttributes != NULL)
 678   {
 679     Status = STATUS_SUCCESS;
 680     _SEH_TRY
 681     {
 682       ProbeForRead(ObjectAttributes,
 683                    sizeof(OBJECT_ATTRIBUTES),
 684                    sizeof(ULONG));
 685     }
 686     _SEH_HANDLE
 687     {
 688       Status = _SEH_GetExceptionCode();
 689     }
 690     _SEH_END;
 691
 692     if(!NT_SUCCESS(Status))
 693     {
 694       return Status;
 695     }
 696   }
 697
 698   DPRINT("ObCreateObject(Type %p ObjectAttributes %p, Object %p)\n",
 699          Type, ObjectAttributes, Object);
 700
 701   if (Type == NULL)
 702     {
 703       DPRINT1("Invalid object type!\n");
 704       return STATUS_INVALID_PARAMETER;
 705     }
 706
 707   if (ObjectAttributes != NULL &&
 708       ObjectAttributes->ObjectName != NULL &&
 709       ObjectAttributes->ObjectName->Buffer != NULL)
 710     {
 711       Status = ObFindObject(ObjectAttributes,
 712                             &Parent,
 713                             &RemainingPath,
 714                             NULL);
 715       if (!NT_SUCCESS(Status))
 716         {
 717           DPRINT1("ObFindObject() failed! (Status 0x%x)\n", Status);
 718           return Status;
 719         }
 720       if (Parent != NULL)
 721         {
 722           ParentHeader = BODY_TO_HEADER(Parent);
 723         }
 724       if (ParentHeader &&
 725           RemainingPath.Buffer == NULL)
 726         {
 727           if (ParentHeader->ObjectType != Type
 728                 || !(ObjectAttributes->Attributes & OBJ_OPENIF))
 729             {
 730               ObDereferenceObject(Parent);
 731               return STATUS_OBJECT_NAME_COLLISION;
 732             }
 733           *Object = Parent;
 734           return STATUS_OBJECT_EXISTS;
 735         }
 736     }
 737   else
 738     {
 739       RtlInitUnicodeString(&RemainingPath, NULL);
 740     }
 741
 742     DPRINT("Allocating memory\n");
 743   Header = (POBJECT_HEADER)ExAllocatePoolWithTag(NonPagedPool,
 744                                                  OBJECT_ALLOC_SIZE(ObjectSize),
 745                                                  Type->Key);
 746   if (Header == NULL) {
 747         DPRINT1("Not enough memory!\n");
 748         return STATUS_INSUFFICIENT_RESOURCES;
 749   }
 750
 751   RtlZeroMemory(Header, OBJECT_ALLOC_SIZE(ObjectSize));
 752
 753   /* Initialize the object header */
 754   DPRINT("Initalizing header 0x%x (%wZ)\n", Header, &Type->TypeName);
 755   Header->HandleCount = 0;
 756   Header->RefCount = 1;
 757   Header->ObjectType = Type;
 758   if (ObjectAttributes != NULL &&
 759       ObjectAttributes->Attributes & OBJ_PERMANENT)
 760     {
 761       Header->Permanent = TRUE;
 762     }
 763   else
 764     {
 765       Header->Permanent = FALSE;
 766     }
 767
 768   if (ObjectAttributes != NULL &&
 769       ObjectAttributes->Attributes & OBJ_INHERIT)
 770     {
 771       Header->Inherit = TRUE;
 772     }
 773   else
 774     {
 775       Header->Inherit = FALSE;
 776     }
 777
 778   RtlInitUnicodeString(&(Header->Name),NULL);
 779
 780   DPRINT("Getting Parent and adding entry\n");
 781   if (ParentHeader != NULL &&
 782       ParentHeader->ObjectType == ObDirectoryType &&
 783       RemainingPath.Buffer != NULL)
 784     {
 785       NamePtr = RemainingPath.Buffer;
 786       if (*NamePtr == L'\\')
 787         NamePtr++;
 788
 789       ObpAddEntryDirectory(Parent,
 790                            Header,
 791                            NamePtr);
 792
 793       ObjectAttached = TRUE;
 794     }
 795
 796     if ((Header->ObjectType == IoFileObjectType) ||
 797         (Header->ObjectType == ExDesktopObjectType) ||
 798         (Header->ObjectType->TypeInfo.OpenProcedure != NULL))
 799     {
 800      DPRINT("About to call Open Routine\n");
 801      if (Header->ObjectType == IoFileObjectType)
 802      {
 803          /* TEMPORARY HACK. DO NOT TOUCH -- Alex */
 804          DPRINT("Calling IopCreateFile\n");
 805          Status = IopCreateFile(HEADER_TO_BODY(Header),
 806                                 Parent,
 807                                 RemainingPath.Buffer,
 808                                 ObjectAttributes);
 809      }
 810      else if (Header->ObjectType == ExDesktopObjectType)
 811      {
 812          /* TEMPORARY HACK. DO NOT TOUCH -- Alex */
 813          DPRINT("Calling ExpDesktopCreate\n");
 814          Status = ExpDesktopCreate(HEADER_TO_BODY(Header),
 815                                    Parent,
 816                                    RemainingPath.Buffer,
 817                                    ObjectAttributes);
 818      }
 819      else if (Header->ObjectType->TypeInfo.OpenProcedure != NULL)
 820      {
 821       DPRINT("Calling %x\n", Header->ObjectType->TypeInfo.OpenProcedure);
 822       Status = Header->ObjectType->TypeInfo.OpenProcedure(ObCreateHandle,
 823                                         HEADER_TO_BODY(Header),
 824                                         NULL,
 825                                         0,
 826                                         0);
 827      }
 828
 829       if (!NT_SUCCESS(Status))
 830         {
 831           if (ObjectAttached == TRUE)
 832             {
 833               ObpRemoveEntryDirectory(Header);
 834             }
 835           if (Parent)
 836             {
 837               ObDereferenceObject(Parent);
 838             }
 839           RtlFreeUnicodeString(&Header->Name);
 840           RtlFreeUnicodeString(&RemainingPath);
 841           ExFreePool(Header);
 842           DPRINT("Create Failed\n");
 843           return Status;
 844         }
 845   }
 846
 847   RtlFreeUnicodeString(&RemainingPath);
 848
 849   SeCaptureSubjectContext(&SubjectContext);
 850
 851   DPRINT("Security Assignment in progress\n");
 852   /* Build the new security descriptor */
 853   Status = SeAssignSecurity((ParentHeader != NULL) ? ParentHeader->SecurityDescriptor : NULL,
 854                             (ObjectAttributes != NULL) ? ObjectAttributes->SecurityDescriptor : NULL,
 855                             &NewSecurityDescriptor,
 856                             (Header->ObjectType == ObDirectoryType),
 857                             &SubjectContext,
 858                             &Header->ObjectType->TypeInfo.GenericMapping,
 859                             PagedPool);
 860   if (NT_SUCCESS(Status))
 861     {
 862       DPRINT("NewSecurityDescriptor %p\n", NewSecurityDescriptor);
 863
 864       if (Header->ObjectType->TypeInfo.SecurityProcedure != NULL)
 865         {
 866           /* Call the security method */
 867           Status = Header->ObjectType->TypeInfo.SecurityProcedure(HEADER_TO_BODY(Header),
 868                                                 AssignSecurityDescriptor,
 869                                                 0,
 870                                                 NewSecurityDescriptor,
 871                                                 NULL);
 872         }
 873       else
 874         {
 875           /* Assign the security descriptor to the object header */
 876           Status = ObpAddSecurityDescriptor(NewSecurityDescriptor,
 877                                             &Header->SecurityDescriptor);
 878           DPRINT("Object security descriptor %p\n", Header->SecurityDescriptor);
 879         }
 880
 881       /* Release the new security descriptor */
 882       SeDeassignSecurity(&NewSecurityDescriptor);
 883     }
 884
 885   DPRINT("Security Complete\n");
 886   SeReleaseSubjectContext(&SubjectContext);
 887
 888   if (Object != NULL)
 889     {
 890       *Object = HEADER_TO_BODY(Header);
 891     }
 892
 893   DPRINT("Sucess!\n");
 894   return STATUS_SUCCESS;
 895 }
 896
 897
 898 /*
 899  * FUNCTION: Increments the pointer reference count for a given object
 900  * ARGUMENTS:
 901  *         ObjectBody = Object's body
 902  *         DesiredAccess = Desired access to the object
 903  *         ObjectType = Points to the object type structure
 904  *         AccessMode = Type of access check to perform
 905  * RETURNS: Status
 906  *
 907  * @implemented
 908  */
 909 NTSTATUS STDCALL
 910 ObReferenceObjectByPointer(IN PVOID Object,
 911                            IN ACCESS_MASK DesiredAccess,
 912                            IN POBJECT_TYPE ObjectType,
 913                            IN KPROCESSOR_MODE AccessMode)
 914 {
 915    POBJECT_HEADER Header;
 916
 917    /* NOTE: should be possible to reference an object above APC_LEVEL! */
 918
 919    DPRINT("ObReferenceObjectByPointer(Object %x, ObjectType %x)\n",
 920           Object,ObjectType);
 921
 922    Header = BODY_TO_HEADER(Object);
 923
 924    if (ObjectType != NULL && Header->ObjectType != ObjectType)
 925      {
 926         DPRINT("Failed %x (type was %x %S) should be %x %S\n",
 927                 Header,
 928                 Header->ObjectType,
 929                 Header->ObjectType->TypeName.Buffer,
 930                 ObjectType,
 931                 ObjectType->TypeName.Buffer);
 932         return(STATUS_UNSUCCESSFUL);
 933      }
 934    if (Header->ObjectType == PsProcessType)
 935      {
 936         DPRINT("Ref p 0x%x refcount %d type %x ",
 937                 Object, Header->RefCount, PsProcessType);
 938         DPRINT("eip %x\n", ((PULONG)&Object)[-1]);
 939      }
 940    if (Header->ObjectType == PsThreadType)
 941      {
 942         DPRINT("Deref t 0x%x with refcount %d type %x ",
 943                 Object, Header->RefCount, PsThreadType);
 944         DPRINT("eip %x\n", ((PULONG)&Object)[-1]);
 945      }
 946
 947    if (Header->RefCount == 0 && !Header->Permanent)
 948    {
 949       if (Header->ObjectType == PsProcessType)
 950         {
 951           return STATUS_PROCESS_IS_TERMINATING;
 952         }
 953       if (Header->ObjectType == PsThreadType)
 954         {
 955           return STATUS_THREAD_IS_TERMINATING;
 956         }
 957       return(STATUS_UNSUCCESSFUL);
 958    }
 959
 960    if (1 == InterlockedIncrement(&Header->RefCount) && !Header->Permanent)
 961    {
 962       KEBUGCHECK(0);
 963    }
 964
 965    return(STATUS_SUCCESS);
 966 }
 967
 968
 969 /*
 970  * @implemented
 971  */
 972 NTSTATUS STDCALL
 973 ObOpenObjectByPointer(IN POBJECT Object,
 974                       IN ULONG HandleAttributes,
 975                       IN PACCESS_STATE PassedAccessState,
 976                       IN ACCESS_MASK DesiredAccess,
 977                       IN POBJECT_TYPE ObjectType,
 978                       IN KPROCESSOR_MODE AccessMode,
 979                       OUT PHANDLE Handle)
 980 {
 981    NTSTATUS Status;
 982
 983    PAGED_CODE();
 984
 985    DPRINT("ObOpenObjectByPointer()\n");
 986
 987    Status = ObReferenceObjectByPointer(Object,
 988                                        0,
 989                                        ObjectType,
 990                                        AccessMode);
 991    if (!NT_SUCCESS(Status))
 992      {
 993         return Status;
 994      }
 995
 996    Status = ObpCreateHandle(PsGetCurrentProcess(),
 997                            Object,
 998                            DesiredAccess,
 999                            (BOOLEAN)(HandleAttributes & OBJ_INHERIT),
1000                            Handle);
1001
1002    ObDereferenceObject(Object);
1003
1004    return STATUS_SUCCESS;
1005 }
1006
1007
1008 static NTSTATUS
1009 ObpDeleteObject(POBJECT_HEADER Header)
1010 {
1011   DPRINT("ObpDeleteObject(Header %p)\n", Header);
1012   if (KeGetCurrentIrql() != PASSIVE_LEVEL)
1013     {
1014       DPRINT("ObpDeleteObject called at an unsupported IRQL.  Use ObpDeleteObjectDpcLevel instead.\n");
1015       KEBUGCHECK(0);
1016     }
1017
1018   if (Header->SecurityDescriptor != NULL)
1019     {
1020       ObpRemoveSecurityDescriptor(Header->SecurityDescriptor);
1021     }
1022
1023   if (Header->ObjectType != NULL &&
1024       Header->ObjectType->TypeInfo.DeleteProcedure != NULL)
1025     {
1026       Header->ObjectType->TypeInfo.DeleteProcedure(HEADER_TO_BODY(Header));
1027     }
1028
1029   if (Header->Name.Buffer != NULL)
1030     {
1031       ObpRemoveEntryDirectory(Header);
1032       RtlFreeUnicodeString(&Header->Name);
1033     }
1034
1035   DPRINT("ObPerformRetentionChecks() = Freeing object\n");
1036   ExFreePool(Header);
1037
1038   return(STATUS_SUCCESS);
1039 }
1040
1041
1042 VOID STDCALL
1043 ObpDeleteObjectWorkRoutine (IN PVOID Parameter)
1044 {
1045   PRETENTION_CHECK_PARAMS Params = (PRETENTION_CHECK_PARAMS)Parameter;
1046   /* ULONG Tag; */ /* See below */
1047
1048   ASSERT(Params);
1049   ASSERT(KeGetCurrentIrql() == PASSIVE_LEVEL); /* We need PAGED_CODE somewhere... */
1050
1051   /* Turn this on when we have ExFreePoolWithTag
1052   Tag = Params->ObjectHeader->ObjectType->Tag; */
1053   ObpDeleteObject(Params->ObjectHeader);
1054   ExFreePool(Params);
1055   /* ExFreePoolWithTag(Params, Tag); */
1056 }
1057
1058
1059 STATIC NTSTATUS
1060 ObpDeleteObjectDpcLevel(IN POBJECT_HEADER ObjectHeader,
1061                         IN LONG OldRefCount)
1062 {
1063 #if 0
1064   if (ObjectHeader->RefCount < 0)
1065     {
1066       CPRINT("Object %p/%p has invalid reference count (%d)\n",
1067              ObjectHeader, HEADER_TO_BODY(ObjectHeader),
1068              ObjectHeader->RefCount);
1069       KEBUGCHECK(0);
1070     }
1071
1072   if (ObjectHeader->HandleCount < 0)
1073     {
1074       CPRINT("Object %p/%p has invalid handle count (%d)\n",
1075              ObjectHeader, HEADER_TO_BODY(ObjectHeader),
1076              ObjectHeader->HandleCount);
1077       KEBUGCHECK(0);
1078     }
1079 #endif
1080
1081
1082   switch (KeGetCurrentIrql ())
1083     {
1084     case PASSIVE_LEVEL:
1085       return ObpDeleteObject (ObjectHeader);
1086
1087     case APC_LEVEL:
1088     case DISPATCH_LEVEL:
1089       {
1090         PRETENTION_CHECK_PARAMS Params;
1091
1092         /*
1093           We use must succeed pool here because if the allocation fails
1094           then we leak memory.
1095         */
1096         Params = (PRETENTION_CHECK_PARAMS)
1097           ExAllocatePoolWithTag(NonPagedPoolMustSucceed,
1098                                 sizeof(RETENTION_CHECK_PARAMS),
1099                                 ObjectHeader->ObjectType->Key);
1100         Params->ObjectHeader = ObjectHeader;
1101         ExInitializeWorkItem(&Params->WorkItem,
1102                              ObpDeleteObjectWorkRoutine,
1103                              (PVOID)Params);
1104         ExQueueWorkItem(&Params->WorkItem,
1105                         CriticalWorkQueue);
1106       }
1107       return STATUS_PENDING;
1108
1109     default:
1110       DPRINT("ObpDeleteObjectDpcLevel called at unsupported "
1111              "IRQL %u!\n", KeGetCurrentIrql());
1112       KEBUGCHECK(0);
1113       return STATUS_UNSUCCESSFUL;
1114     }
1115
1116   return STATUS_SUCCESS;
1117 }
1118
1119
1120 /**********************************************************************
1121  * NAME                                                 EXPORTED
1122  *      ObfReferenceObject@4
1123  *
1124  * DESCRIPTION
1125  *      Increments a given object's reference count and performs
1126  *      retention checks.
1127  *
1128  * ARGUMENTS
1129  *  ObjectBody = Body of the object.
1130  *
1131  * RETURN VALUE
1132  *      None.
1133  *
1134  * @implemented
1135  */
1136 VOID FASTCALL
1137 ObfReferenceObject(IN PVOID Object)
1138 {
1139   POBJECT_HEADER Header;
1140
1141   ASSERT(Object);
1142
1143   Header = BODY_TO_HEADER(Object);
1144
1145   /* No one should be referencing an object once we are deleting it. */
1146   if (InterlockedIncrement(&Header->RefCount) == 1 && !Header->Permanent)
1147   {
1148      KEBUGCHECK(0);
1149   }
1150
1151 }
1152
1153 /**********************************************************************
1154  * NAME                                                 EXPORTED
1155  *      ObfDereferenceObject@4
1156  *
1157  * DESCRIPTION
1158  *      Decrements a given object's reference count and performs
1159  *      retention checks.
1160  *
1161  * ARGUMENTS
1162  *      ObjectBody = Body of the object.
1163  *
1164  * RETURN VALUE
1165  *      None.
1166  *
1167  * @implemented
1168  */
1169 VOID FASTCALL
1170 ObfDereferenceObject(IN PVOID Object)
1171 {
1172   POBJECT_HEADER Header;
1173   LONG NewRefCount;
1174   BOOL Permanent;
1175
1176   ASSERT(Object);
1177
1178   /* Extract the object header. */
1179   Header = BODY_TO_HEADER(Object);
1180   Permanent = Header->Permanent;
1181
1182   /*
1183      Drop our reference and get the new count so we can tell if this was the
1184      last reference.
1185   */
1186   NewRefCount = InterlockedDecrement(&Header->RefCount);
1187   DPRINT("ObfDereferenceObject(0x%x)==%d (%wZ)\n", Object, NewRefCount, &Header->ObjectType->TypeName);
1188   ASSERT(NewRefCount >= 0);
1189
1190   /* Check whether the object can now be deleted. */
1191   if (NewRefCount == 0 &&
1192       !Permanent)
1193     {
1194       ObpDeleteObjectDpcLevel(Header, NewRefCount);
1195     }
1196 }
1197
1198 VOID
1199 FASTCALL
1200 ObInitializeFastReference(IN PEX_FAST_REF FastRef,
1201                           PVOID Object)
1202 {
1203     /* FIXME: Fast Referencing is Unimplemented */
1204     FastRef->Object = Object;
1205 }
1206
1207
1208 PVOID
1209 FASTCALL
1210 ObFastReferenceObject(IN PEX_FAST_REF FastRef)
1211 {
1212     /* FIXME: Fast Referencing is Unimplemented */
1213
1214     /* Do a normal Reference */
1215     ObReferenceObject(FastRef->Object);
1216
1217     /* Return the Object */
1218     return FastRef->Object;
1219 }
1220
1221 VOID
1222 FASTCALL
1223 ObFastDereferenceObject(IN PEX_FAST_REF FastRef,
1224                         PVOID Object)
1225 {
1226     /* FIXME: Fast Referencing is Unimplemented */
1227
1228     /* Do a normal Dereference */
1229     ObDereferenceObject(FastRef->Object);
1230 }
1231
1232 PVOID
1233 FASTCALL
1234 ObFastReplaceObject(IN PEX_FAST_REF FastRef,
1235                     PVOID Object)
1236 {
1237     PVOID OldObject = FastRef->Object;
1238
1239     /* FIXME: Fast Referencing is Unimplemented */
1240     FastRef->Object = Object;
1241
1242     /* Do a normal Dereference */
1243     ObDereferenceObject(OldObject);
1244
1245     /* Return old Object*/
1246     return OldObject;
1247 }
1248
1249 /**********************************************************************
1250  * NAME                                                 EXPORTED
1251  *      ObGetObjectPointerCount@4
1252  *
1253  * DESCRIPTION
1254  *      Retrieves the pointer(reference) count of the given object.
1255  *
1256  * ARGUMENTS
1257  *      ObjectBody = Body of the object.
1258  *
1259  * RETURN VALUE
1260  *      Reference count.
1261  *
1262  * @implemented
1263  */
1264 ULONG STDCALL
1265 ObGetObjectPointerCount(PVOID Object)
1266 {
1267   POBJECT_HEADER Header;
1268
1269   PAGED_CODE();
1270
1271   ASSERT(Object);
1272   Header = BODY_TO_HEADER(Object);
1273
1274   return Header->RefCount;
1275 }
1276
1277
1278 /**********************************************************************
1279  * NAME                                                 INTERNAL
1280  *      ObGetObjectHandleCount@4
1281  *
1282  * DESCRIPTION
1283  *      Retrieves the handle count of the given object.
1284  *
1285  * ARGUMENTS
1286  *      ObjectBody = Body of the object.
1287  *
1288  * RETURN VALUE
1289  *      Reference count.
1290  */
1291 ULONG
1292 ObGetObjectHandleCount(PVOID Object)
1293 {
1294   POBJECT_HEADER Header;
1295
1296   PAGED_CODE();
1297
1298   ASSERT(Object);
1299   Header = BODY_TO_HEADER(Object);
1300
1301   return Header->HandleCount;
1302 }
1303
1304
1305 /**********************************************************************
1306  * NAME                                                 EXPORTED
1307  *      ObDereferenceObject@4
1308  *
1309  * DESCRIPTION
1310  *      Decrements a given object's reference count and performs
1311  *      retention checks.
1312  *
1313  * ARGUMENTS
1314  *      ObjectBody = Body of the object.
1315  *
1316  * RETURN VALUE
1317  *      None.
1318  *
1319  * @implemented
1320  */
1321
1322 #ifdef ObDereferenceObject
1323 #undef ObDereferenceObject
1324 #endif
1325
1326 VOID STDCALL
1327 ObDereferenceObject(IN PVOID Object)
1328 {
1329   ObfDereferenceObject(Object);
1330 }
1331
1332 /* EOF */