Module: wine
Branch: master
Commit: 0bd7da4290ea32da0dba92c0190e2fb839580c3d
URL: https://source.winehq.org/git/wine.git/?a=commit;h=0bd7da4290ea32da0dba92c0…
Author: Zebediah Figura <z.figura12(a)gmail.com>
Date: Fri Feb 14 12:10:20 2020 -0600
server: Hold a reference to the device on behalf of the device manager.
Otherwise, the only thing holding a reference to a device may be a
device_file. If this is released in delete_device(), the subsequent call to
unlink_named_object() will crash. This can occur if a device driver crashes
with pending IRPs outstanding.
Signed-off-by: Zebediah Figura <z.figura12(a)gmail.com>
Signed-off-by: Alexandre Julliard <julliard(a)winehq.org>
---
server/device.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/server/device.c b/server/device.c
index d3e2a84c1e..b02d965e33 100644
--- a/server/device.c
+++ b/server/device.c
@@ -700,6 +700,7 @@ static struct device *create_device( struct object *root, const struct unicode_s
{
device->unix_path = NULL;
device->manager = manager;
+ grab_object( device );
list_add_tail( &manager->devices, &device->entry );
list_init( &device->kernel_object );
list_init( &device->files );
@@ -748,6 +749,7 @@ static void delete_device( struct device *device )
unlink_named_object( &device->obj );
list_remove( &device->entry );
device->manager = NULL;
+ release_object( device );
}