From 65f366820a29a85bfc076e30daa7888011394cf2 Mon Sep 17 00:00:00 2001
From: basil00 <basil@reqrypt.org>
Date: Sat, 21 Oct 2017 17:53:15 +0800
Subject: [PATCH] Fix context access without lock.

---
 sys/windivert.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/sys/windivert.c b/sys/windivert.c
index 35d9155..6c45b9d 100644
--- a/sys/windivert.c
+++ b/sys/windivert.c
@@ -1419,13 +1419,21 @@ extern VOID windivert_destroy(IN WDFOBJECT object)
  */
 static NTSTATUS windivert_read(context_t context, WDFREQUEST request)
 {
+    KLOCK_QUEUE_HANDLE lock_handle;
     NTSTATUS status = STATUS_SUCCESS;
 
     DEBUG("READ: reading diverted packet (context=%p, request=%p)", context,
         request);
 
     // Forward the request to the pending read queue:
+    KeAcquireInStackQueuedSpinLock(&context->lock, &lock_handle);
+    if (context->state != WINDIVERT_CONTEXT_STATE_OPEN)
+    {
+        KeReleaseInStackQueuedSpinLock(&lock_handle);
+        return STATUS_INVALID_DEVICE_STATE;
+    }
     status = WdfRequestForwardToIoQueue(request, context->read_queue);
+    KeReleaseInStackQueuedSpinLock(&lock_handle);
     if (!NT_SUCCESS(status))
     {
         DEBUG_ERROR("failed to forward I/O request to read queue", status);