From 1b91127bbebb9bd052294ee8d093309fcd059a96 Mon Sep 17 00:00:00 2001 From: Ahmed Arif Date: Sun, 28 Jun 2026 17:23:39 +0200 Subject: [PATCH] [FLOPPY] Fix double-free of the interrupt object on init failure (#9225) AddControllers already disconnects the controller interrupt on its error paths but left InterruptObject pointing at the freed object. Now that DriverEntry runs Cleanup on failure (and Unload() routes through it too), that stale pointer is handed to IoDisconnectInterrupt a second time, bugchecking with BAD_POOL_HEADER. Clear InterruptObject right after disconnecting so Cleanup() skips it. CORE-20669 --- drivers/storage/floppy/floppy/floppy.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/storage/floppy/floppy/floppy.c b/drivers/storage/floppy/floppy/floppy.c index 5cee2a94486..bcb3a49691d 100644 --- a/drivers/storage/floppy/floppy/floppy.c +++ b/drivers/storage/floppy/floppy/floppy.c @@ -1019,6 +1019,7 @@ AddControllers(PDRIVER_OBJECT DriverObject) { WARN_(FLOPPY, "AddControllers: unable to allocate an adapter object\n"); IoDisconnectInterrupt(gControllerInfo[i].InterruptObject); + gControllerInfo[i].InterruptObject = NULL; continue; } @@ -1027,6 +1028,7 @@ AddControllers(PDRIVER_OBJECT DriverObject) { WARN_(FLOPPY, "AddControllers(): Unable to set up controller %d - initialization failed\n", i); IoDisconnectInterrupt(gControllerInfo[i].InterruptObject); + gControllerInfo[i].InterruptObject = NULL; continue; } @@ -1067,6 +1069,7 @@ AddControllers(PDRIVER_OBJECT DriverObject) { WARN_(FLOPPY, "AddControllers: unable to register a Device object\n"); IoDisconnectInterrupt(gControllerInfo[i].InterruptObject); + gControllerInfo[i].InterruptObject = NULL; continue; /* continue on to next drive */ }