[NTOS:IO]

- Do not crash if an invalid PDO is given to IopEditDeviceList
- Always dereference device object when removing it (should be the last reference)
CORE-8294

svn path=/trunk/; revision=63917

diff --git a/reactos/ntoskrnl/io/iomgr/device.c b/reactos/ntoskrnl/io/iomgr/device.c
index a0e1961..c68d830 100644 (file)
--- a/reactos/ntoskrnl/io/iomgr/device.c
+++ b/reactos/ntoskrnl/io/iomgr/device.c
@@ -351,6 +351,11 @@ IopEditDeviceList(IN PDRIVER_OBJECT DriverObject,
             while (Previous->NextDevice != DeviceObject)
             {
                 /* Not this one, keep moving */
+                if (!Previous->NextDevice)
+                {
+                    DPRINT1("Failed to remove PDO %p on driver %wZ (not found)\n", DeviceObject, &DeviceObject->DriverObject->DriverName);
+                    return;
+                }
                 Previous = Previous->NextDevice;
             }
 

diff --git a/reactos/ntoskrnl/io/pnpmgr/pnpmgr.c b/reactos/ntoskrnl/io/pnpmgr/pnpmgr.c
index ee036a7..cf84e79 100644 (file)
--- a/reactos/ntoskrnl/io/pnpmgr/pnpmgr.c
+++ b/reactos/ntoskrnl/io/pnpmgr/pnpmgr.c
@@ -597,6 +597,7 @@ IopSendRemoveDevice(IN PDEVICE_OBJECT DeviceObject)
                                   &GUID_TARGET_DEVICE_REMOVE_COMPLETE,
                                   NULL,
                                   NULL);
+    ObDereferenceObject(DeviceObject);
 }
 
 static
@@ -4431,7 +4432,6 @@ IopSendRemoveDeviceRelations(PDEVICE_RELATIONS DeviceRelations)
     for (i = 0; i < DeviceRelations->Count; i++)
     {
         IopSendRemoveDevice(DeviceRelations->Objects[i]);
-        ObDereferenceObject(DeviceRelations->Objects[i]);
         DeviceRelations->Objects[i] = NULL;
     }