driver: prevent access to already deleted object

daynix#81 If during redirection the redirection object is deleted we may try accessing the deleted object in the loop of attempts to create the redirection handle. To avoid this we reference the redirection object until the redirection request completely satisfied or failed. Signed-off-by: Yuri Benditovich <[email protected]>
netusb · Jan 2, 2020 · 65f7251 · 65f7251
1 parent 7c93e05
commit 65f7251
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/UsbDk/ControlDevice.cpp b/UsbDk/ControlDevice.cpp
@@ -731,6 +731,8 @@ NTSTATUS CUsbDkControlDevice::AddRedirect(const USB_DK_DEVICE_ID &DeviceId, HAND
     {
         return addRes;
     }
+    Redirection->AddRef();
+    CObjHolder<CUsbDkRedirection, CRefCountingDeleter> dereferencer(Redirection);
 
     TraceEvents(TRACE_LEVEL_INFORMATION, TRACE_CONTROLDEVICE, "%!FUNC! Success. New redirections list:");
     m_Redirections.Dump();
@@ -1198,6 +1200,12 @@ NTSTATUS CUsbDkRedirection::CreateRedirectorHandle(HANDLE RequestorProcess, PHAN
 
     do
     {
+        if (IsPreparedForRemove())
+        {
+            TraceEvents(TRACE_LEVEL_INFORMATION, TRACE_WDFDEVICE, "%!FUNC!: device already marked for removal");
+            status = STATUS_DEVICE_REMOVED;
+            break;
+        }
         status = m_RedirectorDevice->CreateUserModeHandle(RequestorProcess, ObjectHandle);
         if (NT_SUCCESS(status))
         {