From: Hervé Poussineau <hpoussin@reactos.org>
Date: Fri, 22 Aug 2014 19:14:31 +0000 (+0000)
Subject: [NTOS:IO]
X-Git-Tag: backups/0.3.17@66124~774
X-Git-Url: https://git.reactos.org/?p=reactos.git;a=commitdiff_plain;h=e3ab3c712a6e80b59a3fc66e6406494ac8ae15dc

[NTOS:IO]
- Do not crash if an invalid PDO is given to IopEditDeviceList
- Always dereference device object when removing it (should be the last reference)
CORE-8294

svn path=/trunk/; revision=63917
---

diff --git a/reactos/ntoskrnl/io/iomgr/device.c b/reactos/ntoskrnl/io/iomgr/device.c
index a0e19615056..c68d8306dbd 100644
--- a/reactos/ntoskrnl/io/iomgr/device.c
+++ b/reactos/ntoskrnl/io/iomgr/device.c
@@ -351,6 +351,11 @@ IopEditDeviceList(IN PDRIVER_OBJECT DriverObject,
             while (Previous->NextDevice != DeviceObject)
             {
                 /* Not this one, keep moving */
+                if (!Previous->NextDevice)
+                {
+                    DPRINT1("Failed to remove PDO %p on driver %wZ (not found)\n", DeviceObject, &DeviceObject->DriverObject->DriverName);
+                    return;
+                }
                 Previous = Previous->NextDevice;
             }
 
diff --git a/reactos/ntoskrnl/io/pnpmgr/pnpmgr.c b/reactos/ntoskrnl/io/pnpmgr/pnpmgr.c
index ee036a78770..cf84e79e8a5 100644
--- a/reactos/ntoskrnl/io/pnpmgr/pnpmgr.c
+++ b/reactos/ntoskrnl/io/pnpmgr/pnpmgr.c
@@ -597,6 +597,7 @@ IopSendRemoveDevice(IN PDEVICE_OBJECT DeviceObject)
                                   &GUID_TARGET_DEVICE_REMOVE_COMPLETE,
                                   NULL,
                                   NULL);
+    ObDereferenceObject(DeviceObject);
 }
 
 static
@@ -4431,7 +4432,6 @@ IopSendRemoveDeviceRelations(PDEVICE_RELATIONS DeviceRelations)
     for (i = 0; i < DeviceRelations->Count; i++)
     {
         IopSendRemoveDevice(DeviceRelations->Objects[i]);
-        ObDereferenceObject(DeviceRelations->Objects[i]);
         DeviceRelations->Objects[i] = NULL;
     }