diff --git a/reactos/ntoskrnl/io/iomgr/driver.c b/reactos/ntoskrnl/io/iomgr/driver.c index d4fe8ab6b6c..363f17bc54e 100644 --- a/reactos/ntoskrnl/io/iomgr/driver.c +++ b/reactos/ntoskrnl/io/iomgr/driver.c @@ -1010,9 +1010,19 @@ IopUnloadDriver(PUNICODE_STRING DriverServiceName, BOOLEAN UnloadPnpDrivers) /* * Find the driver object */ + Status = ObReferenceObjectByName(&ObjectName, + 0, + 0, + 0, + IoDriverObjectType, + KernelMode, + 0, + (PVOID*)&DriverObject); - Status = ObReferenceObjectByName(&ObjectName, 0, 0, 0, IoDriverObjectType, - KernelMode, 0, (PVOID*)&DriverObject); + /* + * Free the buffer for driver object name + */ + ExFreePool(ObjectName.Buffer); if (!NT_SUCCESS(Status)) { @@ -1020,12 +1030,6 @@ IopUnloadDriver(PUNICODE_STRING DriverServiceName, BOOLEAN UnloadPnpDrivers) return Status; } - /* - * Free the buffer for driver object name - */ - - ExFreePool(ObjectName.Buffer); - /* * Get path of service... */ @@ -1097,9 +1101,14 @@ IopUnloadDriver(PUNICODE_STRING DriverServiceName, BOOLEAN UnloadPnpDrivers) FALSE, NULL); } + /* Mark the driver object temporary, so it could be deleted later */ + ObMakeTemporaryObject(DriverObject); + + /* Dereference it 2 times */ + ObDereferenceObject(DriverObject); + ObDereferenceObject(DriverObject); + /* Unload the driver */ - ObDereferenceObject(DriverObject); - ObDereferenceObject(DriverObject); MmUnloadSystemImage(DriverObject->DriverSection); return STATUS_SUCCESS;