diff --git a/reactos/drivers/usb/nt4compat/usbdriver/bulkonly.c b/reactos/drivers/usb/nt4compat/usbdriver/bulkonly.c index 6356ac92bd2..7a0cc124689 100644 --- a/reactos/drivers/usb/nt4compat/usbdriver/bulkonly.c +++ b/reactos/drivers/usb/nt4compat/usbdriver/bulkonly.c @@ -386,6 +386,8 @@ umss_bulkonly_transfer_data_complete(PURB purb, PVOID reference) { PULONG buf; buf = usb_alloc_mem(NonPagedPool, 32); + if (!buf) return; + buf[0] = (ULONG) pdev_ext; buf[1] = (ULONG) purb->endp_handle; @@ -548,6 +550,8 @@ umss_bulkonly_get_status_complete(IN PURB purb, IN PVOID context) pdev_ext->retry = FALSE; buf = usb_alloc_mem(NonPagedPool, 32); + if (!buf) return; + buf[0] = (ULONG) pdev_ext; buf[1] = (ULONG) purb->endp_handle; @@ -714,6 +718,8 @@ umss_bulkonly_send_sense_req(PUMSS_DEVICE_EXTENSION pdev_ext) pdev_ext->retry = TRUE; cbw = usb_alloc_mem(NonPagedPool, sizeof(COMMAND_BLOCK_WRAPPER)); + if (!cbw) return STATUS_NO_MEMORY; + RtlZeroMemory(cbw, sizeof(COMMAND_BLOCK_WRAPPER)); pdev_ext->io_packet.flags &= ~IOP_FLAG_STAGE_MASK; pdev_ext->io_packet.flags |= IOP_FLAG_STAGE_SENSE; diff --git a/reactos/drivers/usb/nt4compat/usbdriver/cbi.c b/reactos/drivers/usb/nt4compat/usbdriver/cbi.c index 0737b3b2ec6..f90383cd3da 100644 --- a/reactos/drivers/usb/nt4compat/usbdriver/cbi.c +++ b/reactos/drivers/usb/nt4compat/usbdriver/cbi.c @@ -41,6 +41,8 @@ umss_class_specific_request(IN PUMSS_DEVICE_EXTENSION pdev_ext, UNREFERENCED_PARAMETER(dir); purb = usb_alloc_mem(NonPagedPool, sizeof(URB)); + if (!purb) return STATUS_NO_MEMORY; + // Build URB for the ADSC command UsbBuildVendorRequest(purb, pdev_ext->dev_handle | 0xffff, diff --git a/reactos/drivers/usb/nt4compat/usbdriver/devmgr.c b/reactos/drivers/usb/nt4compat/usbdriver/devmgr.c index ec5cc940f10..46c12a07fc1 100644 --- a/reactos/drivers/usb/nt4compat/usbdriver/devmgr.c +++ b/reactos/drivers/usb/nt4compat/usbdriver/devmgr.c @@ -26,6 +26,10 @@ PBYTE data_buf;\ int i;\ data_buf = usb_alloc_mem( NonPagedPool, ( pdEV )->desc_buf_size += 1024 );\ + if (!data_buf)\ + {\ + goto LBL_OUT;\ + }\ RtlZeroMemory( data_buf, ( pdEV )->desc_buf_size );\ for( i = 0; i < ( LONG )( puRB )->context; i++ )\ {\ @@ -798,7 +802,7 @@ dev_mgr_start_config_dev(PUSB_DEV pdev) //first, get device descriptor purb = usb_alloc_mem(NonPagedPool, sizeof(URB)); data_buf = usb_alloc_mem(NonPagedPool, 512); - if (purb == NULL) + if (purb == NULL || data_buf == NULL) { unlock_dev(pdev, TRUE); return FALSE; @@ -1011,8 +1015,11 @@ dev_mgr_get_desc_completion(PURB purb, PVOID context) } LBL_OUT: - usb_free_mem(purb); - purb = NULL; + if (purb) + { + usb_free_mem(purb); + purb = NULL; + } lock_dev(pdev, TRUE); if (dev_state(pdev) != USB_DEV_STATE_ZOMB) @@ -1245,6 +1252,8 @@ dev_mgr_build_usb_if(PUSB_CONFIGURATION pcfg, PUSB_INTERFACE pif, PUSB_INTERFACE pif->altif_count++; paltif = usb_alloc_mem(NonPagedPool, sizeof(USB_INTERFACE)); + if (!paltif) return FALSE; + RtlZeroMemory(paltif, sizeof(USB_INTERFACE)); InsertTailList(&pif->altif_list, &paltif->altif_list); paltif->pif_drv = NULL; diff --git a/reactos/drivers/usb/nt4compat/usbdriver/ehci.c b/reactos/drivers/usb/nt4compat/usbdriver/ehci.c index 54018ffdea3..bb807b22b81 100644 --- a/reactos/drivers/usb/nt4compat/usbdriver/ehci.c +++ b/reactos/drivers/usb/nt4compat/usbdriver/ehci.c @@ -1202,6 +1202,12 @@ ehci_dpc_callback(PKDPC dpc, PVOID context, PVOID sysarg1, PVOID sysarg2) } pending_endp = alloc_pending_endp(&ehci->pending_endp_pool, 1); + if (!pending_endp) + { + unlock_dev(pdev, TRUE); + KeReleaseSpinLockFromDpcLevel(&ehci->pending_endp_list_lock); + return; + } pending_endp->pendp = pendp; InsertTailList(&ehci->pending_endp_list, &pending_endp->endp_link); @@ -3113,6 +3119,12 @@ ehci_rh_submit_urb(PUSB_DEV pdev, PURB purb) i = EHCI_PORTSC + 4 * (psetup->wIndex - 1); // USBPORTSC1; ptimer = alloc_timer_svc(&dev_mgr->timer_svc_pool, 1); + if (!ptimer) + { + purb->status = STATUS_NO_MEMORY; + break; + } + ptimer->threshold = 0; // within [ 50ms, 60ms ], one tick is 10 ms ptimer->context = (ULONG) purb; ptimer->pdev = pdev; @@ -3136,6 +3148,11 @@ ehci_rh_submit_urb(PUSB_DEV pdev, PURB purb) case USB_ENDPOINT_XFER_INT: { ptimer = alloc_timer_svc(&dev_mgr->timer_svc_pool, 1); + if (!ptimer) + { + purb->status = STATUS_NO_MEMORY; + break; + } ptimer->threshold = RH_INTERVAL; ptimer->context = (ULONG) purb; ptimer->pdev = pdev; diff --git a/reactos/drivers/usb/nt4compat/usbdriver/gendrv.c b/reactos/drivers/usb/nt4compat/usbdriver/gendrv.c index 3df843b93b7..b9b4231ddb2 100644 --- a/reactos/drivers/usb/nt4compat/usbdriver/gendrv.c +++ b/reactos/drivers/usb/nt4compat/usbdriver/gendrv.c @@ -142,6 +142,12 @@ gendrv_driver_init(PUSB_DEV_MANAGER dev_mgr, PUSB_DRIVER pdriver) pdriver->driver_desc.dev_protocol = 0; // Protocol Info. pdriver->driver_ext = usb_alloc_mem(NonPagedPool, sizeof(GENDRV_DRVR_EXTENSION)); + if (!pdriver->driver_ext) + { + usb_dbg_print(DBGLVL_MAXIMUM, ("gendrv_driver_init(): memory allocation failed!\n")); + return FALSE; + } + pdriver->driver_ext_size = sizeof(GENDRV_DRVR_EXTENSION); RtlZeroMemory(pdriver->driver_ext, pdriver->driver_ext_size); @@ -345,6 +351,12 @@ gendrv_event_select_driver(PUSB_DEV pdev, //always null. we do not use thi pdev_ext = (PGENDRV_DEVICE_EXTENSION) pdev_obj->DeviceExtension; pdev_ext->desc_buf = usb_alloc_mem(NonPagedPool, 512); + if (!pdev_ext->desc_buf) + { + usb_dbg_print(DBGLVL_MAXIMUM, ("gendrv_event_select_driver(): memory allocation failed!\n")); + goto ERROR_OUT; + } + RtlCopyMemory(pdev_ext->desc_buf, pconfig_desc, 512); // insert the device to the dev_list @@ -440,6 +452,7 @@ gendrv_set_cfg_completion(PURB purb, PVOID context) { unlock_dev(pdev, TRUE); KeReleaseSpinLockFromDpcLevel(&dev_mgr->event_list_lock); + return; } pevent->flags = USB_EVENT_FLAG_ACTIVE; @@ -815,6 +828,12 @@ gendrv_if_connect(PDEV_CONNECT_DATA params, DEV_HANDLE if_handle) pdev_ext = (PGENDRV_DEVICE_EXTENSION) pdev_obj->DeviceExtension; pdev_ext->desc_buf = usb_alloc_mem(NonPagedPool, 512); + if (!pdev_ext->desc_buf) + { + usb_dbg_print(DBGLVL_MAXIMUM, ("gendrv_if_connect(): memory allocation failed!\n")); + goto ERROR_OUT; + } + RtlCopyMemory(pdev_ext->desc_buf, pconfig_desc, 512); pdev_ext->if_ctx.pif_desc = (PUSB_INTERFACE_DESC) & pdev_ext->desc_buf[(PBYTE) pif_desc - (PBYTE) pconfig_desc]; @@ -988,6 +1007,8 @@ gendrv_if_driver_init(PUSB_DEV_MANAGER dev_mgr, PUSB_DRIVER pdriver) pdriver->disp_tbl.dev_reserved = NULL; pdriver->driver_ext = usb_alloc_mem(NonPagedPool, sizeof(GENDRV_DRVR_EXTENSION)); + if (!pdriver->driver_ext) return FALSE; + pdriver->driver_ext_size = sizeof(GENDRV_DRVR_EXTENSION); RtlZeroMemory(pdriver->driver_ext, pdriver->driver_ext_size); diff --git a/reactos/drivers/usb/nt4compat/usbdriver/hub.c b/reactos/drivers/usb/nt4compat/usbdriver/hub.c index ce5f2050ffe..5a36821a96b 100644 --- a/reactos/drivers/usb/nt4compat/usbdriver/hub.c +++ b/reactos/drivers/usb/nt4compat/usbdriver/hub.c @@ -432,7 +432,6 @@ hub_start_int_request(PUSB_DEV pdev) return STATUS_DEVICE_DOES_NOT_EXIST; } purb = usb_alloc_mem(NonPagedPool, sizeof(URB)); - RtlZeroMemory(purb, sizeof(URB)); if (purb == NULL) { @@ -440,6 +439,8 @@ hub_start_int_request(PUSB_DEV pdev) return STATUS_NO_MEMORY; } + RtlZeroMemory(purb, sizeof(URB)); + purb->flags = 0; purb->status = STATUS_SUCCESS; hub_ext = hub_ext_from_dev(pdev); @@ -1242,6 +1243,7 @@ hub_event_dev_stable(PUSB_DEV pdev, //Let's start a reset port request InsertHeadList(&dev_mgr->event_list, &pevent->event_link); purb = usb_alloc_mem(NonPagedPool, sizeof(URB)); + if (!purb) goto LBL_OUT; RtlZeroMemory(purb, sizeof(URB)); purb->data_buffer = NULL; @@ -1632,6 +1634,15 @@ hub_start_next_reset_port(PUSB_DEV_MANAGER dev_mgr, BOOLEAN from_dpc) } purb = usb_alloc_mem(NonPagedPool, sizeof(URB)); + if (!purb) + { + if (from_dpc) + KeReleaseSpinLockFromDpcLevel(&dev_mgr->event_list_lock); + else + KeReleaseSpinLock(&dev_mgr->event_list_lock, old_irql); + return FALSE; + } + RtlZeroMemory(purb, sizeof(URB)); purb->data_buffer = NULL; @@ -1707,6 +1718,7 @@ hub_post_esq_event(PUSB_DEV pdev, BYTE port_idx, PROCESS_EVENT pe) dev_mgr = dev_mgr_from_dev(pdev); pevent = alloc_event(&dev_mgr->event_pool, 1); + if (!pevent) return; pevent->event = USB_EVENT_DEFAULT; pevent->process_queue = event_list_default_process_queue; pevent->process_event = pe; @@ -2507,7 +2519,6 @@ hub_clear_tt_buffer(PUSB_DEV pdev, URB_HS_PIPE_CONTENT pipe_content, UCHAR port_ return FALSE; } purb = usb_alloc_mem(NonPagedPool, sizeof(URB)); - RtlZeroMemory(purb, sizeof(URB)); if (purb == NULL) { @@ -2515,6 +2526,8 @@ hub_clear_tt_buffer(PUSB_DEV pdev, URB_HS_PIPE_CONTENT pipe_content, UCHAR port_ return FALSE; } + RtlZeroMemory(purb, sizeof(URB)); + purb->flags = 0; purb->status = STATUS_SUCCESS; purb->data_buffer = NULL; diff --git a/reactos/drivers/usb/nt4compat/usbdriver/keyboard.c b/reactos/drivers/usb/nt4compat/usbdriver/keyboard.c index 9bd151369d2..3e7102cc41f 100644 --- a/reactos/drivers/usb/nt4compat/usbdriver/keyboard.c +++ b/reactos/drivers/usb/nt4compat/usbdriver/keyboard.c @@ -79,6 +79,7 @@ kbd_driver_init(PUSB_DEV_MANAGER dev_mgr, PUSB_DRIVER pdriver) pdriver->driver_desc.dev_protocol = 1; // Protocol Info. pdriver->driver_ext = usb_alloc_mem(NonPagedPool, sizeof(KEYBOARD_DRVR_EXTENSION)); + if (!pdriver->driver_ext) return FALSE; pdriver->driver_ext_size = sizeof(KEYBOARD_DRVR_EXTENSION); RtlZeroMemory(pdriver->driver_ext, sizeof(KEYBOARD_DRVR_EXTENSION)); diff --git a/reactos/drivers/usb/nt4compat/usbdriver/mouse.c b/reactos/drivers/usb/nt4compat/usbdriver/mouse.c index 713148cac09..1dc7442dc33 100644 --- a/reactos/drivers/usb/nt4compat/usbdriver/mouse.c +++ b/reactos/drivers/usb/nt4compat/usbdriver/mouse.c @@ -40,11 +40,7 @@ mouse_driver_init(PUSB_DEV_MANAGER dev_mgr, PUSB_DRIVER pdriver) pdriver->driver_desc.dev_protocol = 2; // Protocol Info. pdriver->driver_ext = usb_alloc_mem(NonPagedPool, sizeof(MOUSE_DRVR_EXTENSION)); - if (!pdriver->driver_ext) - { - usb_dbg_print(DBGLVL_MAXIMUM, ("mouse_driver_init(): memory allocation failed!\n")); - return FALSE; - } + if (!pdriver->driver_ext) return FALSE; pdriver->driver_ext_size = sizeof(MOUSE_DRVR_EXTENSION); diff --git a/reactos/drivers/usb/nt4compat/usbdriver/ohci.c b/reactos/drivers/usb/nt4compat/usbdriver/ohci.c index 00e66222b0a..4ae033752fa 100644 --- a/reactos/drivers/usb/nt4compat/usbdriver/ohci.c +++ b/reactos/drivers/usb/nt4compat/usbdriver/ohci.c @@ -1177,6 +1177,12 @@ ohci_rh_submit_urb(PUSB_DEV pdev, PURB purb) } ptimer = alloc_timer_svc(&dev_mgr->timer_svc_pool, 1); + if (!ptimer) + { + purb->status = STATUS_NO_MEMORY; + break; + } + ptimer->threshold = 0; // within [ 50ms, 60ms ], one tick is 10 ms ptimer->context = (ULONG) purb; ptimer->pdev = pdev; @@ -1202,6 +1208,12 @@ ohci_rh_submit_urb(PUSB_DEV pdev, PURB purb) case USB_ENDPOINT_XFER_INT: { ptimer = alloc_timer_svc(&dev_mgr->timer_svc_pool, 1); + if (!ptimer) + { + purb->status = STATUS_NO_MEMORY; + break; + } + ptimer->threshold = RH_INTERVAL; ptimer->context = (ULONG) purb; ptimer->pdev = pdev; diff --git a/reactos/drivers/usb/nt4compat/usbdriver/td.c b/reactos/drivers/usb/nt4compat/usbdriver/td.c index 39cc8b589d8..1f1bfe00e28 100644 --- a/reactos/drivers/usb/nt4compat/usbdriver/td.c +++ b/reactos/drivers/usb/nt4compat/usbdriver/td.c @@ -400,6 +400,7 @@ alloc_tds(PUHCI_TD_POOL_LIST pool_list, LONG count) return NULL; ptd = alloc_td(pool_list); + if (!ptd) return NULL; for(i = 1; i < count; i++) { diff --git a/reactos/drivers/usb/nt4compat/usbdriver/uhci.c b/reactos/drivers/usb/nt4compat/usbdriver/uhci.c index fa239ae8e1f..9d54e6f777f 100644 --- a/reactos/drivers/usb/nt4compat/usbdriver/uhci.c +++ b/reactos/drivers/usb/nt4compat/usbdriver/uhci.c @@ -1747,6 +1747,13 @@ uhci_dpc_callback(PKDPC dpc, PVOID context, PVOID sysarg1, PVOID sysarg2) } pending_endp = alloc_pending_endp(&uhci->pending_endp_pool, 1); + if (!pending_endp) + { + unlock_dev(pdev, TRUE); + KeReleaseSpinLockFromDpcLevel(&uhci->pending_endp_list_lock); + return; + } + pending_endp->pendp = pendp; InsertTailList(&uhci->pending_endp_list, &pending_endp->endp_link); @@ -3400,6 +3407,12 @@ uhci_rh_submit_urb(PUSB_DEV pdev, PURB purb) } ptimer = alloc_timer_svc(&dev_mgr->timer_svc_pool, 1); + if (!ptimer) + { + purb->status = STATUS_NO_MEMORY; + break; + } + ptimer->threshold = 0; // within [ 50ms, 60ms ], one tick is 10 ms ptimer->context = (ULONG) purb; ptimer->pdev = pdev; @@ -3423,6 +3436,12 @@ uhci_rh_submit_urb(PUSB_DEV pdev, PURB purb) case USB_ENDPOINT_XFER_INT: { ptimer = alloc_timer_svc(&dev_mgr->timer_svc_pool, 1); + if (!ptimer) + { + purb->status = STATUS_NO_MEMORY; + break; + } + ptimer->threshold = RH_INTERVAL; ptimer->context = (ULONG) purb; ptimer->pdev = pdev; diff --git a/reactos/drivers/usb/nt4compat/usbdriver/umss.c b/reactos/drivers/usb/nt4compat/usbdriver/umss.c index 2c8632039eb..4690fa97ef8 100644 --- a/reactos/drivers/usb/nt4compat/usbdriver/umss.c +++ b/reactos/drivers/usb/nt4compat/usbdriver/umss.c @@ -250,6 +250,7 @@ umss_driver_init(PUSB_DEV_MANAGER dev_mgr, PUSB_DRIVER pdriver) pdriver->driver_desc.dev_protocol = 0; // Protocol Info. pdriver->driver_ext = usb_alloc_mem(NonPagedPool, sizeof(UMSS_DRVR_EXTENSION)); + if (!pdriver->driver_ext) return FALSE; pdriver->driver_ext_size = sizeof(UMSS_DRVR_EXTENSION); RtlZeroMemory(pdriver->driver_ext, sizeof(UMSS_DRVR_EXTENSION)); @@ -1815,6 +1816,8 @@ umss_if_driver_init(PUSB_DEV_MANAGER dev_mgr, PUSB_DRIVER pdriver) pdriver->driver_desc.dev_protocol = 0; // Protocol Info. pdriver->driver_ext = usb_alloc_mem(NonPagedPool, sizeof(UMSS_DRVR_EXTENSION)); + if (!pdriver->driver_ext) return FALSE; + pdriver->driver_ext_size = sizeof(UMSS_DRVR_EXTENSION); RtlZeroMemory(pdriver->driver_ext, sizeof(UMSS_DRVR_EXTENSION)); @@ -1946,10 +1949,11 @@ umss_schedule_workitem(PVOID context, PUMSS_WORKER_PACKET worker_packet; worker_packet = usb_alloc_mem(NonPagedPool, sizeof(WORK_QUEUE_ITEM) + sizeof(UMSS_WORKER_PACKET)); - RtlZeroMemory(worker_packet, sizeof(WORK_QUEUE_ITEM) + sizeof(UMSS_WORKER_PACKET)); if (worker_packet) { + RtlZeroMemory(worker_packet, sizeof(WORK_QUEUE_ITEM) + sizeof(UMSS_WORKER_PACKET)); + workitem = (PWORK_QUEUE_ITEM) & worker_packet[1]; worker_packet->completion = completion; worker_packet->context = context;