From 504cf18e19535759e75ce81db0909ba3136c9bfe Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michael=20M=C3=BCller?= Date: Fri, 14 Feb 2020 12:10:21 -0600 Subject: [PATCH] server: Hold a reference to the file in delete_file(). Otherwise, we may attempt to access freed memory trawling the device list. This can occur if a device driver crashes during an IRP_CALL_CLOSE request. Signed-off-by: Zebediah Figura Signed-off-by: Alexandre Julliard --- server/device.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/server/device.c b/server/device.c index b02d965e33b..01e08f295f7 100644 --- a/server/device.c +++ b/server/device.c @@ -729,12 +729,17 @@ static void delete_file( struct device_file *file ) { struct irp_call *irp, *next; + /* the pending requests may be the only thing holding a reference to the file */ + grab_object( file ); + /* terminate all pending requests */ LIST_FOR_EACH_ENTRY_SAFE( irp, next, &file->requests, struct irp_call, dev_entry ) { list_remove( &irp->mgr_entry ); set_irp_result( irp, STATUS_FILE_DELETED, NULL, 0, 0 ); } + + release_object( file ); } static void delete_device( struct device *device )