[hpoussin] 63917: [NTOS:IO] - Do not crash if an invalid PDO is given to IopEditDeviceList - Always dereference device object when removing it (should be the last reference) CORE-8294

Author: hpoussin
Date: Fri Aug 22 19:14:31 2014
New Revision: 63917

URL: http://svn.reactos.org/svn/reactos?rev=63917&view=rev
Log:
[NTOS:IO]
- Do not crash if an invalid PDO is given to IopEditDeviceList
- Always dereference device object when removing it (should be the last reference)
CORE-8294

Modified:
    trunk/reactos/ntoskrnl/io/iomgr/device.c
    trunk/reactos/ntoskrnl/io/pnpmgr/pnpmgr.c

Modified: trunk/reactos/ntoskrnl/io/iomgr/device.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/io/iomgr/device.c?...
==============================================================================
--- trunk/reactos/ntoskrnl/io/iomgr/device.c	[iso-8859-1] (original)
+++ trunk/reactos/ntoskrnl/io/iomgr/device.c	[iso-8859-1] Fri Aug 22 19:14:31 2014
@@ -351,6 +351,11 @@
             while (Previous->NextDevice != DeviceObject)
             {
                 /* Not this one, keep moving */
+                if (!Previous->NextDevice)
+                {
+                    DPRINT1("Failed to remove PDO %p on driver %wZ (not found)\n", DeviceObject, &DeviceObject->DriverObject->DriverName);
+                    return;
+                }
                 Previous = Previous->NextDevice;
             }

Modified: trunk/reactos/ntoskrnl/io/pnpmgr/pnpmgr.c
URL: http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/io/pnpmgr/pnpmgr.c...
==============================================================================
--- trunk/reactos/ntoskrnl/io/pnpmgr/pnpmgr.c	[iso-8859-1] (original)
+++ trunk/reactos/ntoskrnl/io/pnpmgr/pnpmgr.c	[iso-8859-1] Fri Aug 22 19:14:31 2014
@@ -597,6 +597,7 @@
                                   &GUID_TARGET_DEVICE_REMOVE_COMPLETE,
                                   NULL,
                                   NULL);
+    ObDereferenceObject(DeviceObject);
 }

static
@@ -4431,7 +4432,6 @@
     for (i = 0; i < DeviceRelations->Count; i++)
     {
         IopSendRemoveDevice(DeviceRelations->Objects[i]);
-        ObDereferenceObject(DeviceRelations->Objects[i]);
         DeviceRelations->Objects[i] = NULL;
     }