mirror of
https://github.com/ApfelTeeSaft/reactos.git
synced 2026-08-26 19:33:31 +00:00
[FLOPPY] Fix double-free of the interrupt object on init failure (#9225)
AddControllers already disconnects the controller interrupt on its error paths but left InterruptObject pointing at the freed object. Now that DriverEntry runs Cleanup on failure (and Unload() routes through it too), that stale pointer is handed to IoDisconnectInterrupt a second time, bugchecking with BAD_POOL_HEADER. Clear InterruptObject right after disconnecting so Cleanup() skips it. CORE-20669
This commit is contained in:
@@ -1019,6 +1019,7 @@ AddControllers(PDRIVER_OBJECT DriverObject)
|
||||
{
|
||||
WARN_(FLOPPY, "AddControllers: unable to allocate an adapter object\n");
|
||||
IoDisconnectInterrupt(gControllerInfo[i].InterruptObject);
|
||||
gControllerInfo[i].InterruptObject = NULL;
|
||||
continue;
|
||||
}
|
||||
|
||||
@@ -1027,6 +1028,7 @@ AddControllers(PDRIVER_OBJECT DriverObject)
|
||||
{
|
||||
WARN_(FLOPPY, "AddControllers(): Unable to set up controller %d - initialization failed\n", i);
|
||||
IoDisconnectInterrupt(gControllerInfo[i].InterruptObject);
|
||||
gControllerInfo[i].InterruptObject = NULL;
|
||||
continue;
|
||||
}
|
||||
|
||||
@@ -1067,6 +1069,7 @@ AddControllers(PDRIVER_OBJECT DriverObject)
|
||||
{
|
||||
WARN_(FLOPPY, "AddControllers: unable to register a Device object\n");
|
||||
IoDisconnectInterrupt(gControllerInfo[i].InterruptObject);
|
||||
gControllerInfo[i].InterruptObject = NULL;
|
||||
continue; /* continue on to next drive */
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user