Can MmFlushImageSection be safely called by a non-isolation filter? I know you can’t mess with Cc related things from a non-isolation filter but curious about Mm.
It should be safe as access to SECTION_OBJECT_POINTERS.ImageSectionObject is synchronized inside MmFlushImageSection. There can’t be multiple threads trying to delete the same ImageSectionObject ( i.e. a CONTROL_AREA ), only one thread enters a protected region others wait for deletion completion.
I don’t think there is need to acquire any FSD resources before calling MmFlushImageSection as it calls the same functions the Memory Manager uses to delete unused image segments and the Memory Manager does this without calling FSD for synchronisation.