Calling WdfWorkItemFlush after WdfObjectDelete on it

NTDEV
1

I'm working with a driver that was written by someone else. And I can see the following sequence (error checks are omitted.)

I'm also putting it all together in a simplified linear fashion. In the actual driver, some of these calls (at the end) are made from different threads:

WDF_WORKITEM_CONFIG config;
WDF_WORKITEM_CONFIG_INIT(&config, WorkItemCallback);

WDF_OBJECT_ATTRIBUTES attrib;
WDF_OBJECT_ATTRIBUTES_INIT(&attrib);
attrib.ParentObject = device;

WDFWORKITEM work_item;
WdfWorkItemCreate(&config, &attrib, &work_item);

WdfWorkItemEnqueue(work_item);

WdfObjectDelete(work_item);

WdfWorkItemFlush(work_item);

I'm wondering, if WdfWorkItemFlush can be called after WdfObjectDelete?

2

It cannot be called after delete. Delete is stateful. The only call allowed after delete is object dereference.

3

OK, thanks.

The funny thing is that when I tried it (like I showed above), the call to WdfWorkItemFlush doesn't cause any issues. Even if I put a large artificial delay between WdfObjectDelete and it. My guess though, is that it creates some "use after free" condition internally though.