server: Hold a reference to the device on behalf of the device manager.

Otherwise, the only thing holding a reference to a device may be a device_file. If this is released in delete_device(), the subsequent call to unlink_named_object() will crash. This can occur if a device driver crashes with pending IRPs outstanding. Signed-off-by: Zebediah Figura <z.figura12@gmail.com> Signed-off-by: Alexandre Julliard <julliard@winehq.org>

server: Hold a reference to the device on behalf of the device manager.
0bd7da42 · Zebediah Figura · Alexandre Julliard · 2b9c7f8b · 0bd7da42
Commit 0bd7da42 authored Feb 14, 2020 by Zebediah Figura Committed by Alexandre Julliard Mar 03, 2020
Hide whitespace changes
Inline Side-by-side

Showing with 2 additions and 0 deletions

device.c server/device.c +2 -0

No files found.
--- a/server/device.c
+++ b/server/device.c
@@ -700,6 +700,7 @@ static struct device *create_device( struct object *root, const struct unicode_s
    {
        device->unix_path = NULL;
        device->manager = manager;
+        grab_object( device );
        list_add_tail( &manager->devices, &device->entry );
        list_init( &device->kernel_object );
        list_init( &device->files );
@@ -748,6 +749,7 @@ static void delete_device( struct device *device )
    unlink_named_object( &device->obj );
    list_remove( &device->entry );
    device->manager = NULL;
+    release_object( device );
 }