Fix potential deadlock due to unregistering callouts during a PowerState callback (#408)79745

Moves the unregister of callouts into a workitem routine. Additionally fixed an issue which could potentially leak an IOWorkItem

1 files changed, 17 insertions, 2 deletions

diff --git a/network/trans/WFPSampler/sys/Framework_Events.cpp b/network/trans/WFPSampler/sys/Framework_Events.cpp
index cd2290f6..baf59cc8 100644
--- a/network/trans/WFPSampler/sys/Framework_Events.cpp
+++ b/network/trans/WFPSampler/sys/Framework_Events.cpp
@@ -104,6 +104,7 @@ VOID EventCleanupDriverObject(_In_ WDFOBJECT driverObject)
    Notes:                                                                                       <br>
                                                                                                 <br>
    MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF540840.aspx             <br>
+             HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF549133.aspx             <br>
 */
 _IRQL_requires_min_(PASSIVE_LEVEL)
 _IRQL_requires_max_(PASSIVE_LEVEL)
@@ -159,11 +160,25 @@ VOID EventCleanupDeviceObject(_In_ WDFOBJECT deviceObject)
 
    FwpmBfeStateUnsubscribeChanges(g_bfeSubscriptionHandle);
 
-   UnregisterPowerStateChangeCallback(&g_deviceExtension);
-
    if(g_pNDISPoolData)
       KrnlHlprNDISPoolDataDestroy(&g_pNDISPoolData);
 
+   UnregisterPowerStateChangeCallback(&g_deviceExtension);
+
+   if(g_pPowerStateExitIOWorkItem)
+   {
+      IoFreeWorkItem(g_pPowerStateExitIOWorkItem);
+
+      g_pPowerStateExitIOWorkItem = 0;
+   }
+
+   if(g_pPowerStateEnterIOWorkItem)
+   {
+      IoFreeWorkItem(g_pPowerStateEnterIOWorkItem);
+
+      g_pPowerStateEnterIOWorkItem = 0;
+   }
+
 #if DBG
    
    DbgPrintEx(DPFLTR_IHVNETWORK_ID,