Re: [PATCH 0/3] MR1559: ntoskrnl.exe: Prevent blocking if kernel timer is reset in DPC.

[Ivo Ivanov (＠logos128)]

On Mon Nov 28 21:57:01 2022 +0000, Zebediah Figura wrote:
> Note that 1/3 won't actually help you, because we could already be in
> ke_timer_complete_proc() but not executing the callback yet.

Yes, that won't be enough to stop the pending callbacks. The change in TpSetTimer handles this on thread pool level. If there is ke_timer_complete_proc() running at this time, it will complete in parallel. I have to dig the MS documentation again, but I'm pretty sure they don't guarantee immediate cancellation of pending DPCs after canceling an object. Since the DPCs are queued and run on another IRQ level, I assume they can't be dequeued and stopped easily in time.