From c73c1825e23b97c77dbb8f2163dcc8b6d5558e05 Mon Sep 17 00:00:00 2001 From: Ged Murphy Date: Mon, 29 Oct 2018 11:28:10 +0000 Subject: [PATCH] [FLTMGR] Callers must have registered an unload routine to be allowed to unload --- drivers/filters/fltmgr/Filter.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/filters/fltmgr/Filter.c b/drivers/filters/fltmgr/Filter.c index 92a824c0d32..1c50f14738f 100644 --- a/drivers/filters/fltmgr/Filter.c +++ b/drivers/filters/fltmgr/Filter.c @@ -250,7 +250,7 @@ FltRegisterFilter(_In_ PDRIVER_OBJECT DriverObject, Filter->OldDriverUnload = (PFLT_FILTER_UNLOAD_CALLBACK)DriverObject->DriverUnload; /* Check we opted not to have an unload routine, or if we want to stop the driver from being unloaded */ - if (!FlagOn(Filter->Flags, FLTFL_REGISTRATION_DO_NOT_SUPPORT_SERVICE_STOP)) + if (Registration->FilterUnloadCallback && !FlagOn(Filter->Flags, FLTFL_REGISTRATION_DO_NOT_SUPPORT_SERVICE_STOP)) { DriverObject->DriverUnload = (PDRIVER_UNLOAD)FltpMiniFilterDriverUnload; } -- 2.17.1