Regards,
tried to debug on my own but got little lost in assembly
Trying to implement in VDM driver model mount manager and as soon as I send
irp = IoBuildDeviceIoControlRequest( IOCTL_MOUNTMGR_VOLUME_ARRIVAL_NOTIFICATION, mountMgrDeviceObject, mntName, mntNameLength, NULL, 0, FALSE, &event, &statusBlock);
I got BSOD BAD_POOL_HEADER (19)
pool with “MntA” in mountmgr!QueryDeviceInformation+0x415
fffff880`045ec5e8 fffff800`02bf6cae : 00000000`00000019 00000000`00000020 fffff8a0`01fc4440 fffff8a0`01fc4460 : nt!KeBugCheckEx
fffff880`045ec5f0 fffff880`00e06c79 : fffff880`045ec798 fffff8a0`01fc4450 00000000`41746e4d 00000000`000007ff : nt!ExDeferredFreePool+0x12da
fffff880`045ec6a0 fffff880`00e0dd83 : fffff8a0`02eeee30 00000000`000000a0 fffff880`045ec8f0 00000000`006d402c : mountmgr!QueryDeviceInformation+0x415
fffff880`045ec720 fffff880`00e127f7 : 00000000`00000000 fffff880`04d97310 fffffa80`0a216690 fffff880`00e15b00 : mountmgr!MountMgrMountedDeviceArrival+0x1fb
fffff880`045ec8d0 fffff880`00e14ba2 : fffffa80`0b6ec040 fffffa80`0a216690 fffffa80`0b47bbc0 00000000`00000000 : mountmgr!MountMgrVolumeArrivalNotification+0x107
fffff880`045ec910 fffff880`04d90aa9 : fffffa80`0b6ec040 fffffa80`0b6ec040 00000000`00000080 00000000`0000002a : mountmgr!MountMgrDeviceControl+0x21a
fffff880`045ec9e0 fffff880`04d9928e : fffffa80`0bc621c0 fffffa80`0bc621c0 00000000`00000065 00000000`00000003 : VDDriver!vdVolume_RegisterMM+0x259 [d:\myprojectsdrv\vddriver\sys\src\vdd_volume.c @ 203]
fffff880`045ecad0 fffff880`04d97a70 : fffffa80`0bc621c0 fffffa80`0bb3bc20 00000000`00000000 fffff880`02f83700 : VDDriver!vdIOOpenFile+0xd5e [d:\myprojectsdrv\vddriver\sys\src\vdd_device_thread.c @ 808]
fffff880`045ecc60 fffff800`02d69cce : fffffa80`0bc621c0 fffff800`02c3ee80 fffff880`045ecdb0 fffffa80`0b6ec040 : VDDriver!vdDeviceThread+0x760 [d:\myprojectsdrv\vddriver\sys\src\vdd_device_thread.c @ 232]
fffff880`045ecd40 fffff800`02abdfe6 : fffff800`02c3ee80 fffffa80`0b6ec040 fffffa80`0b496660 fffff880`0124bcb0 : nt!PspSystemThreadStartup+0x5a
fffff880`045ecd80 00000000`00000000 : fffff880`045ed000 fffff880`045e7000 fffff880`045ebfa0 00000000`00000000 : nt!KiStartSystemThread+0x16
kd> !pool fffff8a0`01fc4440
Pool page fffff8a001fc4440 region is Paged pool
fffff8a001fc4000 size: 1b0 previous size: 0 (Allocated) CIcr
fffff8a001fc41b0 size: 30 previous size: 1b0 (Allocated) CIcr
fffff8a001fc41e0 size: 50 previous size: 30 (Allocated) CIcr
fffff8a001fc4230 size: 90 previous size: 50 (Allocated) FSim
fffff8a001fc42c0 size: 10 previous size: 90 (Free) CIcr
fffff8a001fc42d0 size: 40 previous size: 10 (Allocated) MmSm
fffff8a001fc4310 size: 20 previous size: 40 (Allocated) CMIn (Protected)
fffff8a001fc4330 size: 30 previous size: 20 (Allocated) PfFK
fffff8a001fc4360 size: 20 previous size: 30 (Allocated) CMIn (Protected)
fffff8a001fc4380 size: 50 previous size: 20 (Allocated) CIcr
fffff8a001fc43d0 size: 40 previous size: 50 (Allocated) NtFs
fffff8a001fc4410 size: 30 previous size: 40 (Allocated) PfFK
*fffff8a001fc4440 size: 20 previous size: 30 (Free ) *MntA
Owning component : Unknown (update pooltag.txt)
fffff880`00e06c73 ff15c7c3ffff call qword ptr [mountmgr!_imp_ExFreePoolWithTag (fffff880`00e03040)]
fffff880`00e06c79 8bd3 mov edx,ebx
noticed that no where in QueryDeviceInformation “MntA” is allocated (or at least I do not see it in assembly),
going trough code noticed previous two IOCTL were IOCTL_MOUNTMGR_CREATE_POINT and one before that one was IOCTL_MOUNTDEV_QUERY_DEVICE_NAME.
So I am little lost here, how to determine who or what have allocated MntA pool ?
full WinDbg analysis info along with dumped kd> u mountmgr!QueryDeviceInformation mountmgr!QueryDeviceInformation+0x41 is in attachment.
any help would be appreciated
thank you