[ros-diffs] [dchapyshev] 42997: - Handle memory allocation failures. Found by Amine Khaldi

Author: dchapyshev
Date: Sat Sep  5 17:07:13 2009
New Revision: 42997

URL: http://svn.reactos.org/svn/reactos?rev=42997&view=rev
Log:
- Handle memory allocation failures. Found by Amine Khaldi

Modified:
    trunk/reactos/drivers/usb/nt4compat/usbdriver/bulkonly.c
    trunk/reactos/drivers/usb/nt4compat/usbdriver/cbi.c
    trunk/reactos/drivers/usb/nt4compat/usbdriver/devmgr.c
    trunk/reactos/drivers/usb/nt4compat/usbdriver/ehci.c
    trunk/reactos/drivers/usb/nt4compat/usbdriver/gendrv.c
    trunk/reactos/drivers/usb/nt4compat/usbdriver/hub.c
    trunk/reactos/drivers/usb/nt4compat/usbdriver/keyboard.c
    trunk/reactos/drivers/usb/nt4compat/usbdriver/mouse.c
    trunk/reactos/drivers/usb/nt4compat/usbdriver/ohci.c
    trunk/reactos/drivers/usb/nt4compat/usbdriver/td.c
    trunk/reactos/drivers/usb/nt4compat/usbdriver/uhci.c
    trunk/reactos/drivers/usb/nt4compat/usbdriver/umss.c

Modified: trunk/reactos/drivers/usb/nt4compat/usbdriver/bulkonly.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/drivers/usb/nt4compat/usbd…
==============================================================================
--- trunk/reactos/drivers/usb/nt4compat/usbdriver/bulkonly.c [iso-8859-1] (original)
+++ trunk/reactos/drivers/usb/nt4compat/usbdriver/bulkonly.c [iso-8859-1] Sat Sep  5
17:07:13 2009
@@ -386,6 +386,8 @@
         {
             PULONG buf;
             buf = usb_alloc_mem(NonPagedPool, 32);
+            if (!buf) return;
+
             buf[0] = (ULONG) pdev_ext;
             buf[1] = (ULONG) purb->endp_handle;
 
@@ -548,6 +550,8 @@
         pdev_ext->retry = FALSE;
 
         buf = usb_alloc_mem(NonPagedPool, 32);
+        if (!buf) return;
+
         buf[0] = (ULONG) pdev_ext;
         buf[1] = (ULONG) purb->endp_handle;
 
@@ -714,6 +718,8 @@
     pdev_ext->retry = TRUE;
 
     cbw = usb_alloc_mem(NonPagedPool, sizeof(COMMAND_BLOCK_WRAPPER));
+    if (!cbw) return STATUS_NO_MEMORY;
+
     RtlZeroMemory(cbw, sizeof(COMMAND_BLOCK_WRAPPER));
     pdev_ext->io_packet.flags &= ~IOP_FLAG_STAGE_MASK;
     pdev_ext->io_packet.flags |= IOP_FLAG_STAGE_SENSE;

Modified: trunk/reactos/drivers/usb/nt4compat/usbdriver/cbi.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/drivers/usb/nt4compat/usbd…
==============================================================================
--- trunk/reactos/drivers/usb/nt4compat/usbdriver/cbi.c [iso-8859-1] (original)
+++ trunk/reactos/drivers/usb/nt4compat/usbdriver/cbi.c [iso-8859-1] Sat Sep  5 17:07:13
2009
@@ -41,6 +41,8 @@
     UNREFERENCED_PARAMETER(dir);
 
     purb = usb_alloc_mem(NonPagedPool, sizeof(URB));
+    if (!purb) return STATUS_NO_MEMORY;
+
     // Build URB for the ADSC command
     UsbBuildVendorRequest(purb,
                           pdev_ext->dev_handle | 0xffff,

Modified: trunk/reactos/drivers/usb/nt4compat/usbdriver/devmgr.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/drivers/usb/nt4compat/usbd…
==============================================================================
--- trunk/reactos/drivers/usb/nt4compat/usbdriver/devmgr.c [iso-8859-1] (original)
+++ trunk/reactos/drivers/usb/nt4compat/usbdriver/devmgr.c [iso-8859-1] Sat Sep  5
17:07:13 2009
@@ -26,6 +26,10 @@
 	PBYTE data_buf;\
 	int i;\
 	data_buf = usb_alloc_mem( NonPagedPool, ( pdEV )->desc_buf_size += 1024 );\
+	if (!data_buf)\
+	{\
+		goto LBL_OUT;\
+	}\
 	RtlZeroMemory( data_buf, ( pdEV )->desc_buf_size );\
 	for( i = 0; i < ( LONG )( puRB )->context; i++ )\
 	{\
@@ -798,7 +802,7 @@
     //first, get device descriptor
     purb = usb_alloc_mem(NonPagedPool, sizeof(URB));
     data_buf = usb_alloc_mem(NonPagedPool, 512);
-    if (purb == NULL)
+    if (purb == NULL || data_buf == NULL)
     {
         unlock_dev(pdev, TRUE);
         return FALSE;
@@ -1011,8 +1015,11 @@
     }
 
 LBL_OUT:
-    usb_free_mem(purb);
-    purb = NULL;
+    if (purb)
+    {
+        usb_free_mem(purb);
+        purb = NULL;
+    }
 
     lock_dev(pdev, TRUE);
     if (dev_state(pdev) != USB_DEV_STATE_ZOMB)
@@ -1245,6 +1252,8 @@
 
         pif->altif_count++;
         paltif = usb_alloc_mem(NonPagedPool, sizeof(USB_INTERFACE));
+        if (!paltif) return FALSE;
+
         RtlZeroMemory(paltif, sizeof(USB_INTERFACE));
         InsertTailList(&pif->altif_list, &paltif->altif_list);
         paltif->pif_drv = NULL;

Modified: trunk/reactos/drivers/usb/nt4compat/usbdriver/ehci.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/drivers/usb/nt4compat/usbd…
==============================================================================
--- trunk/reactos/drivers/usb/nt4compat/usbdriver/ehci.c [iso-8859-1] (original)
+++ trunk/reactos/drivers/usb/nt4compat/usbdriver/ehci.c [iso-8859-1] Sat Sep  5 17:07:13
2009
@@ -1202,6 +1202,12 @@
         }
 
         pending_endp = alloc_pending_endp(&ehci->pending_endp_pool, 1);
+        if (!pending_endp)
+        {
+            unlock_dev(pdev, TRUE);
+            KeReleaseSpinLockFromDpcLevel(&ehci->pending_endp_list_lock);
+            return;
+        }
         pending_endp->pendp = pendp;
         InsertTailList(&ehci->pending_endp_list,
&pending_endp->endp_link);
 
@@ -3113,6 +3119,12 @@
                 i = EHCI_PORTSC + 4 * (psetup->wIndex - 1);     // USBPORTSC1;
 
                 ptimer = alloc_timer_svc(&dev_mgr->timer_svc_pool, 1);
+                if (!ptimer)
+                {
+                    purb->status = STATUS_NO_MEMORY;
+                    break;
+                }
+
                 ptimer->threshold = 0;  // within [ 50ms, 60ms ], one tick is 10 ms
                 ptimer->context = (ULONG) purb;
                 ptimer->pdev = pdev;
@@ -3136,6 +3148,11 @@
         case USB_ENDPOINT_XFER_INT:
         {
             ptimer = alloc_timer_svc(&dev_mgr->timer_svc_pool, 1);
+            if (!ptimer)
+            {
+                purb->status = STATUS_NO_MEMORY;
+                break;
+            }
             ptimer->threshold = RH_INTERVAL;
             ptimer->context = (ULONG) purb;
             ptimer->pdev = pdev;

Modified: trunk/reactos/drivers/usb/nt4compat/usbdriver/gendrv.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/drivers/usb/nt4compat/usbd…
==============================================================================
--- trunk/reactos/drivers/usb/nt4compat/usbdriver/gendrv.c [iso-8859-1] (original)
+++ trunk/reactos/drivers/usb/nt4compat/usbdriver/gendrv.c [iso-8859-1] Sat Sep  5
17:07:13 2009
@@ -142,6 +142,12 @@
     pdriver->driver_desc.dev_protocol = 0;      // Protocol Info.
 
     pdriver->driver_ext = usb_alloc_mem(NonPagedPool, sizeof(GENDRV_DRVR_EXTENSION));
+    if (!pdriver->driver_ext)
+    {
+        usb_dbg_print(DBGLVL_MAXIMUM, ("gendrv_driver_init(): memory allocation
failed!\n"));
+        return FALSE;
+    }
+
     pdriver->driver_ext_size = sizeof(GENDRV_DRVR_EXTENSION);
 
     RtlZeroMemory(pdriver->driver_ext, pdriver->driver_ext_size);
@@ -345,6 +351,12 @@
 
     pdev_ext = (PGENDRV_DEVICE_EXTENSION) pdev_obj->DeviceExtension;
     pdev_ext->desc_buf = usb_alloc_mem(NonPagedPool, 512);
+    if (!pdev_ext->desc_buf)
+    {
+        usb_dbg_print(DBGLVL_MAXIMUM, ("gendrv_event_select_driver(): memory
allocation failed!\n"));
+        goto ERROR_OUT;
+    }
+
     RtlCopyMemory(pdev_ext->desc_buf, pconfig_desc, 512);
 
     // insert the device to the dev_list
@@ -440,6 +452,7 @@
     {
         unlock_dev(pdev, TRUE);
         KeReleaseSpinLockFromDpcLevel(&dev_mgr->event_list_lock);
+        return;
     }
 
     pevent->flags = USB_EVENT_FLAG_ACTIVE;
@@ -815,6 +828,12 @@
 
     pdev_ext = (PGENDRV_DEVICE_EXTENSION) pdev_obj->DeviceExtension;
     pdev_ext->desc_buf = usb_alloc_mem(NonPagedPool, 512);
+    if (!pdev_ext->desc_buf)
+    {
+        usb_dbg_print(DBGLVL_MAXIMUM, ("gendrv_if_connect(): memory allocation
failed!\n"));
+        goto ERROR_OUT;
+    }
+
     RtlCopyMemory(pdev_ext->desc_buf, pconfig_desc, 512);
     pdev_ext->if_ctx.pif_desc =
         (PUSB_INTERFACE_DESC) & pdev_ext->desc_buf[(PBYTE) pif_desc - (PBYTE)
pconfig_desc];
@@ -988,6 +1007,8 @@
     pdriver->disp_tbl.dev_reserved = NULL;
 
     pdriver->driver_ext = usb_alloc_mem(NonPagedPool, sizeof(GENDRV_DRVR_EXTENSION));
+    if (!pdriver->driver_ext) return FALSE;
+
     pdriver->driver_ext_size = sizeof(GENDRV_DRVR_EXTENSION);
 
     RtlZeroMemory(pdriver->driver_ext, pdriver->driver_ext_size);

Modified: trunk/reactos/drivers/usb/nt4compat/usbdriver/hub.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/drivers/usb/nt4compat/usbd…
==============================================================================
--- trunk/reactos/drivers/usb/nt4compat/usbdriver/hub.c [iso-8859-1] (original)
+++ trunk/reactos/drivers/usb/nt4compat/usbdriver/hub.c [iso-8859-1] Sat Sep  5 17:07:13
2009
@@ -432,13 +432,14 @@
         return STATUS_DEVICE_DOES_NOT_EXIST;
     }
     purb = usb_alloc_mem(NonPagedPool, sizeof(URB));
-    RtlZeroMemory(purb, sizeof(URB));
 
     if (purb == NULL)
     {
         unlock_dev(pdev, FALSE);
         return STATUS_NO_MEMORY;
     }
+
+    RtlZeroMemory(purb, sizeof(URB));
 
     purb->flags = 0;
     purb->status = STATUS_SUCCESS;
@@ -1242,6 +1243,7 @@
         //Let's start a reset port request
         InsertHeadList(&dev_mgr->event_list, &pevent->event_link);
         purb = usb_alloc_mem(NonPagedPool, sizeof(URB));
+        if (!purb) goto LBL_OUT;
         RtlZeroMemory(purb, sizeof(URB));
 
         purb->data_buffer = NULL;
@@ -1632,6 +1634,15 @@
             }
 
             purb = usb_alloc_mem(NonPagedPool, sizeof(URB));
+            if (!purb)
+            {
+                if (from_dpc)
+                    KeReleaseSpinLockFromDpcLevel(&dev_mgr->event_list_lock);
+                else
+                    KeReleaseSpinLock(&dev_mgr->event_list_lock, old_irql);
+                return FALSE;
+            }
+
             RtlZeroMemory(purb, sizeof(URB));
 
             purb->data_buffer = NULL;
@@ -1707,6 +1718,7 @@
     dev_mgr = dev_mgr_from_dev(pdev);
 
     pevent = alloc_event(&dev_mgr->event_pool, 1);
+    if (!pevent) return;
     pevent->event = USB_EVENT_DEFAULT;
     pevent->process_queue = event_list_default_process_queue;
     pevent->process_event = pe;
@@ -2507,13 +2519,14 @@
         return FALSE;
     }
     purb = usb_alloc_mem(NonPagedPool, sizeof(URB));
-    RtlZeroMemory(purb, sizeof(URB));
 
     if (purb == NULL)
     {
         unlock_dev(pdev, FALSE);
         return FALSE;
     }
+
+    RtlZeroMemory(purb, sizeof(URB));
 
     purb->flags = 0;
     purb->status = STATUS_SUCCESS;

Modified: trunk/reactos/drivers/usb/nt4compat/usbdriver/keyboard.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/drivers/usb/nt4compat/usbd…
==============================================================================
--- trunk/reactos/drivers/usb/nt4compat/usbdriver/keyboard.c [iso-8859-1] (original)
+++ trunk/reactos/drivers/usb/nt4compat/usbdriver/keyboard.c [iso-8859-1] Sat Sep  5
17:07:13 2009
@@ -79,6 +79,7 @@
     pdriver->driver_desc.dev_protocol = 1;          // Protocol Info.
 
     pdriver->driver_ext = usb_alloc_mem(NonPagedPool,
sizeof(KEYBOARD_DRVR_EXTENSION));
+    if (!pdriver->driver_ext) return FALSE;
     pdriver->driver_ext_size = sizeof(KEYBOARD_DRVR_EXTENSION);
 
     RtlZeroMemory(pdriver->driver_ext, sizeof(KEYBOARD_DRVR_EXTENSION));

Modified: trunk/reactos/drivers/usb/nt4compat/usbdriver/mouse.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/drivers/usb/nt4compat/usbd…
==============================================================================
--- trunk/reactos/drivers/usb/nt4compat/usbdriver/mouse.c [iso-8859-1] (original)
+++ trunk/reactos/drivers/usb/nt4compat/usbdriver/mouse.c [iso-8859-1] Sat Sep  5 17:07:13
2009
@@ -40,11 +40,7 @@
     pdriver->driver_desc.dev_protocol = 2;          // Protocol Info.
 
     pdriver->driver_ext = usb_alloc_mem(NonPagedPool, sizeof(MOUSE_DRVR_EXTENSION));
-    if (!pdriver->driver_ext)
-    {
-        usb_dbg_print(DBGLVL_MAXIMUM, ("mouse_driver_init(): memory allocation
failed!\n"));
-        return FALSE;
-    }
+    if (!pdriver->driver_ext) return FALSE;
 
     pdriver->driver_ext_size = sizeof(MOUSE_DRVR_EXTENSION);
 

Modified: trunk/reactos/drivers/usb/nt4compat/usbdriver/ohci.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/drivers/usb/nt4compat/usbd…
==============================================================================
--- trunk/reactos/drivers/usb/nt4compat/usbdriver/ohci.c [iso-8859-1] (original)
+++ trunk/reactos/drivers/usb/nt4compat/usbdriver/ohci.c [iso-8859-1] Sat Sep  5 17:07:13
2009
@@ -1177,6 +1177,12 @@
                 }
 
                 ptimer = alloc_timer_svc(&dev_mgr->timer_svc_pool, 1);
+                if (!ptimer)
+                {
+                    purb->status = STATUS_NO_MEMORY;
+                    break;
+                }
+
                 ptimer->threshold = 0;  // within [ 50ms, 60ms ], one tick is 10 ms
                 ptimer->context = (ULONG) purb;
                 ptimer->pdev = pdev;
@@ -1202,6 +1208,12 @@
         case USB_ENDPOINT_XFER_INT:
         {
             ptimer = alloc_timer_svc(&dev_mgr->timer_svc_pool, 1);
+            if (!ptimer)
+            {
+                purb->status = STATUS_NO_MEMORY;
+                break;
+            }
+
             ptimer->threshold = RH_INTERVAL;
             ptimer->context = (ULONG) purb;
             ptimer->pdev = pdev;

Modified: trunk/reactos/drivers/usb/nt4compat/usbdriver/td.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/drivers/usb/nt4compat/usbd…
==============================================================================
--- trunk/reactos/drivers/usb/nt4compat/usbdriver/td.c [iso-8859-1] (original)
+++ trunk/reactos/drivers/usb/nt4compat/usbdriver/td.c [iso-8859-1] Sat Sep  5 17:07:13
2009
@@ -400,6 +400,7 @@
         return NULL;
 
     ptd = alloc_td(pool_list);
+    if (!ptd) return NULL;
 
     for(i = 1; i < count; i++)
     {

Modified: trunk/reactos/drivers/usb/nt4compat/usbdriver/uhci.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/drivers/usb/nt4compat/usbd…
==============================================================================
--- trunk/reactos/drivers/usb/nt4compat/usbdriver/uhci.c [iso-8859-1] (original)
+++ trunk/reactos/drivers/usb/nt4compat/usbdriver/uhci.c [iso-8859-1] Sat Sep  5 17:07:13
2009
@@ -1747,6 +1747,13 @@
         }
 
         pending_endp = alloc_pending_endp(&uhci->pending_endp_pool, 1);
+        if (!pending_endp)
+        {
+            unlock_dev(pdev, TRUE);
+            KeReleaseSpinLockFromDpcLevel(&uhci->pending_endp_list_lock);
+            return;
+        }
+
         pending_endp->pendp = pendp;
         InsertTailList(&uhci->pending_endp_list,
&pending_endp->endp_link);
 
@@ -3400,6 +3407,12 @@
                 }
 
                 ptimer = alloc_timer_svc(&dev_mgr->timer_svc_pool, 1);
+                if (!ptimer)
+                {
+                    purb->status = STATUS_NO_MEMORY;
+                    break;
+                }
+
                 ptimer->threshold = 0;  // within [ 50ms, 60ms ], one tick is 10 ms
                 ptimer->context = (ULONG) purb;
                 ptimer->pdev = pdev;
@@ -3423,6 +3436,12 @@
         case USB_ENDPOINT_XFER_INT:
         {
             ptimer = alloc_timer_svc(&dev_mgr->timer_svc_pool, 1);
+            if (!ptimer)
+            {
+                purb->status = STATUS_NO_MEMORY;
+                break;
+            }
+
             ptimer->threshold = RH_INTERVAL;
             ptimer->context = (ULONG) purb;
             ptimer->pdev = pdev;

Modified: trunk/reactos/drivers/usb/nt4compat/usbdriver/umss.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/drivers/usb/nt4compat/usbd…
==============================================================================
--- trunk/reactos/drivers/usb/nt4compat/usbdriver/umss.c [iso-8859-1] (original)
+++ trunk/reactos/drivers/usb/nt4compat/usbdriver/umss.c [iso-8859-1] Sat Sep  5 17:07:13
2009
@@ -250,6 +250,7 @@
     pdriver->driver_desc.dev_protocol = 0;      // Protocol Info.
 
     pdriver->driver_ext = usb_alloc_mem(NonPagedPool, sizeof(UMSS_DRVR_EXTENSION));
+    if (!pdriver->driver_ext) return FALSE;
     pdriver->driver_ext_size = sizeof(UMSS_DRVR_EXTENSION);
 
     RtlZeroMemory(pdriver->driver_ext, sizeof(UMSS_DRVR_EXTENSION));
@@ -1815,6 +1816,8 @@
     pdriver->driver_desc.dev_protocol = 0;      // Protocol Info.
 
     pdriver->driver_ext = usb_alloc_mem(NonPagedPool, sizeof(UMSS_DRVR_EXTENSION));
+    if (!pdriver->driver_ext) return FALSE;
+
     pdriver->driver_ext_size = sizeof(UMSS_DRVR_EXTENSION);
 
     RtlZeroMemory(pdriver->driver_ext, sizeof(UMSS_DRVR_EXTENSION));
@@ -1946,10 +1949,11 @@
     PUMSS_WORKER_PACKET worker_packet;
 
     worker_packet = usb_alloc_mem(NonPagedPool, sizeof(WORK_QUEUE_ITEM) +
sizeof(UMSS_WORKER_PACKET));
-    RtlZeroMemory(worker_packet, sizeof(WORK_QUEUE_ITEM) + sizeof(UMSS_WORKER_PACKET));
 
     if (worker_packet)
     {
+        RtlZeroMemory(worker_packet, sizeof(WORK_QUEUE_ITEM) +
sizeof(UMSS_WORKER_PACKET));
+
         workitem = (PWORK_QUEUE_ITEM) & worker_packet[1];
         worker_packet->completion = completion;
         worker_packet->context = context;