Zebediah Figura : server: Hold a reference to the device on behalf of the device manager.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 0bd7da4290ea32da0dba92c0190e2fb839580c3d
URL:    https://source.winehq.org/git/wine.git/?a=commit;h=0bd7da4290ea32da0dba92c0190e2fb839580c3d

Author: Zebediah Figura <z.figura12 at gmail.com>
Date:   Fri Feb 14 12:10:20 2020 -0600

server: Hold a reference to the device on behalf of the device manager.

Otherwise, the only thing holding a reference to a device may be a
device_file. If this is released in delete_device(), the subsequent call to
unlink_named_object() will crash. This can occur if a device driver crashes
with pending IRPs outstanding.

Signed-off-by: Zebediah Figura <z.figura12 at gmail.com>
Signed-off-by: Alexandre Julliard <julliard at winehq.org>

---

 server/device.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/server/device.c b/server/device.c
index d3e2a84c1e..b02d965e33 100644
--- a/server/device.c
+++ b/server/device.c
@@ -700,6 +700,7 @@ static struct device *create_device( struct object *root, const struct unicode_s
     {
         device->unix_path = NULL;
         device->manager = manager;
+        grab_object( device );
         list_add_tail( &manager->devices, &device->entry );
         list_init( &device->kernel_object );
         list_init( &device->files );
@@ -748,6 +749,7 @@ static void delete_device( struct device *device )
     unlink_named_object( &device->obj );
     list_remove( &device->entry );
     device->manager = NULL;
+    release_object( device );
 }