From 5c52ded05fceddb392ed33eecc8ad693a96332f9 Mon Sep 17 00:00:00 2001
From: Thomas Faber <thomas.faber@reactos.org>
Date: Fri, 26 Jan 2018 13:45:53 +0100
Subject: [PATCH] [NTOS:PS] Check for rundown success in
 PsReferenceProcessFilePointer. CID 514553

---
 ntoskrnl/ps/query.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/ntoskrnl/ps/query.c b/ntoskrnl/ps/query.c
index 2c492b654a6..ad281e63c00 100644
--- a/ntoskrnl/ps/query.c
+++ b/ntoskrnl/ps/query.c
@@ -28,7 +28,10 @@ PsReferenceProcessFilePointer(IN PEPROCESS Process,
     PAGED_CODE();
 
     /* Lock the process */
-    ExAcquireRundownProtection(&Process->RundownProtect);
+    if (!ExAcquireRundownProtection(&Process->RundownProtect))
+    {
+        return STATUS_PROCESS_IS_TERMINATING;
+    }
 
     /* Get the section */
     Section = Process->SectionObject;