[FLOPPY] Fix double-free of the interrupt object on init failure (#9225)

AddControllers already disconnects the controller interrupt on its error paths but left InterruptObject pointing at the freed object.

Now that DriverEntry runs Cleanup on failure (and Unload() routes through it too), that stale pointer is handed to IoDisconnectInterrupt a second time, bugchecking with BAD_POOL_HEADER.

Clear InterruptObject right after disconnecting so Cleanup() skips it.

CORE-20669
This commit is contained in:
Ahmed Arif
2026-06-28 10:23:39 -05:00
committed by GitHub
parent c0f18d059a
commit 1b91127bbe
+3
View File
@@ -1019,6 +1019,7 @@ AddControllers(PDRIVER_OBJECT DriverObject)
{
WARN_(FLOPPY, "AddControllers: unable to allocate an adapter object\n");
IoDisconnectInterrupt(gControllerInfo[i].InterruptObject);
gControllerInfo[i].InterruptObject = NULL;
continue;
}
@@ -1027,6 +1028,7 @@ AddControllers(PDRIVER_OBJECT DriverObject)
{
WARN_(FLOPPY, "AddControllers(): Unable to set up controller %d - initialization failed\n", i);
IoDisconnectInterrupt(gControllerInfo[i].InterruptObject);
gControllerInfo[i].InterruptObject = NULL;
continue;
}
@@ -1067,6 +1069,7 @@ AddControllers(PDRIVER_OBJECT DriverObject)
{
WARN_(FLOPPY, "AddControllers: unable to register a Device object\n");
IoDisconnectInterrupt(gControllerInfo[i].InterruptObject);
gControllerInfo[i].InterruptObject = NULL;
continue; /* continue on to next drive */
}