I have written a mini filter driver that sends messages via FltSendMessage to client code in a user program or a service. All works well. If a switch between user sessions (i.e. Logoff - > Switch User), I get the BSOD on the next FilterGetMessage from the client/FltSendMessage from the driver. This happens when the client is in a console app or a service. The problem, I presume, must be happening when the data from the driver’s buffer in FltSendMessage is copied to the client’s buffer in FilterGetMessage (not async). I have tried pinning the receive buffer address in the client (using fixed, Marshal.GlobalHAlloc, etc.), but the problem persists. Again, if I do not switch between users all is well. I cannot see how a switch between users should affect the state of memory in a service? Any ideas?
Are you assuming that a pointer in that buffer is valid in the current
process context? Is it possible that you “luck out” in most cases by
being in the right process context, but after a switch of this type your
luck runs out and you are in the WRONG process context?
Of course, it might be easier to suggest more if you were to set up
symbols properly and type “!analyze -v” and send that along to the
group.
Tony
OSR
I found the error. I was using a spin lock to synchronize the sending of messages from the driver. I changed the spin lock to a fast mutex and the BSOD problem is gone!