Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Sept/Oct 2019 Issue of The NT Insider available


Download PDF here: http://insider.osr.com/2019/ntinsider_2019_01.pdf

It’s a particularly BIG issue, too: 40 pages of technical goodness, ranging from WDF to Minifilters. Check it out.
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

Does WFP classifyFn, notifyFn, flowDeleteFn thread-safe ?

iFengHuangiFengHuang Member Posts: 62

I just google seach "WFP thread safe" "WFP sync" no result.
The official document also did not mention.

Comments

  • Tim_RobertsTim_Roberts Member - All Emails Posts: 13,066

    Since those are functions YOU supply, it's up to you to make sure they are "thread safe". Are you asking if these are automatically serialized? I'm pretty sure the answer to that is "no".

    Tim Roberts, [email protected]
    Providenza & Boekelheide, Inc.

  • iFengHuangiFengHuang Member Posts: 62
    edited August 31

    @Tim_Roberts said:
    Since those are functions YOU supply, it's up to you to make sure they are "thread safe". Are you asking if these are automatically serialized? I'm pretty sure the answer to that is "no".

    Because my driver has a BSOD due to KERNEL_SECURITY_CHECK_FAILURE (139) A LIST_ENTRY has been corrupted, but it happens randomly, from a few minutes to a few hours.

    Then I add KdPrint("%s begin/end", __FUNCTION__) to those functions, I saw the logs like this:
    // -------------------------------------------------
    xxx begin
    xxx other logs...
    xxx end

    yyy begin
    yyy other logs...
    yyy end

    zzz begin
    zzz other logs...
    zzz end
    // -------------------------------------------------

    I never see yyy between xxx begin and xxx end. So, can I assume those functions are thread-safe ?

  • Tim_RobertsTim_Roberts Member - All Emails Posts: 13,066

    Just because something happens often does not mean it is guaranteed.

    And your terminology is wrong. "Thread safe" refers to the behavior of the function. If you had written them to be thread-safe, then it wouldn't matter how they were called. What you're asking is if those callbacks are serialized or synchronized.

    Tim Roberts, [email protected]m
    Providenza & Boekelheide, Inc.

  • iFengHuangiFengHuang Member Posts: 62
    > @Tim_Roberts said:
    > Just because something happens often does not mean it is guaranteed.
    >
    > And your terminology is wrong. "Thread safe" refers to the behavior of the function. If you had written them to be thread-safe, then it wouldn't matter how they were called. What you're asking is if those callbacks are serialized or synchronized.

    I know what is “synchronized”, but what is “serialized” in this scenario?
  • Tim_RobertsTim_Roberts Member - All Emails Posts: 13,066

    In this context, two words for the same thing. If the requests are serialized, then you won't get #2 until #1 has completed. They would be issues serially (as opposed to "in parallel").

    Tim Roberts, [email protected]
    Providenza & Boekelheide, Inc.

  • iFengHuangiFengHuang Member Posts: 62

    @Tim_Roberts said:
    In this context, two words for the same thing. If the requests are serialized, then you won't get #2 until #1 has completed. They would be issues serially (as opposed to "in parallel").

    Thank you for your guide. I will try to use lock to solve this issue.

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
Writing WDF Drivers 21 Oct 2019 OSR Seminar Space & ONLINE
Internals & Software Drivers 18 Nov 2019 Dulles, VA
Kernel Debugging 30 Mar 2020 OSR Seminar Space
Developing Minifilters 27 Apr 2020 OSR Seminar Space & ONLINE