Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTDEV

Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


How to access the 'AttachedDevice' member of _DEVICE_OBJECT

Andrey_KhramovAndrey_Khramov Member Posts: 4

Hello,

I've run the code analysis on the usbip-win project.
I get the following warnings:

driver\stub\stub_dev.c(128): warning C28175: The 'AttachedDevice' member of _DEVICE_OBJECT should not be accessed by a driver:  Access to this member may be permitted for certain classes of drivers. See the documentation for this warning for more information.
driver\stub\stub_dev.c(138): warning C28175: The 'AttachedDevice' member of _DEVICE_OBJECT should not be accessed by a driver:  Access to this member may be permitted for certain classes of drivers. See the documentation for this warning for more information.

The source code follows as below:

static BOOLEAN
is_usbip_stub_attached(PDEVICE_OBJECT pdo)
{
    DEVICE_OBJECT   *attached;

    attached = pdo->AttachedDevice;
    while (attached) {
        PDRIVER_OBJECT  drvobj = attached->DriverObject;

        if (drvobj != NULL) {
            UNICODE_STRING  name_uni;
            RtlInitUnicodeString(&name_uni, L"\\driver\\usbip_stub");
            if (RtlEqualUnicodeString(&drvobj->DriverName, &name_uni, TRUE))
                return TRUE;
        }
        attached = attached->AttachedDevice;
    }
    return FALSE;
}

The help page of Microsoft recommends that the proper way is to use IoEnumerateDeviceObjectList function.
I'm not sure that I get the attached devices using this function.
I think that IoGetAttachedDevice or IoGetAttachedDeviceReference function is more proper than IoEnumerateDeviceObjectList function.
But, I don't know how to use these functions to solve the above warnings in detail.

As I'm a beginner in the driver development, I hope someone to let me know a good solution or provide the sample code.

Thanks,
Andrey

Comments

  • Mark_RoddyMark_Roddy Member - All Emails Posts: 4,575
    edited November 2

    You need to use IoGetAttachedDeviceReference to do this correctly. The code shown is indeed not good. It is vulnerable to changes in the device stack while enumerating the stack.

  • Andrey_KhramovAndrey_Khramov Member Posts: 4

    Hi, @Mark_Roddy
    Thanks for your reply.

    I have one question.
    As you see the is_usbip_stub_attached() function, this function gets all the attached devices via loop.
    How can we implement this loop using IoGetAttachedDeviceReference function?

    Thanks.

  • Andrey_KhramovAndrey_Khramov Member Posts: 4

    Hi, @Mark_Roddy

    I've modified the is_usbip_stub_attached() function as below:

    static BOOLEAN
    is_usbip_stub_attached(PDEVICE_OBJECT pdo)
    {
        PDEVICE_OBJECT attached = NULL;
    
        attached = IoGetAttachedDeviceReference(pdo);
        while (attached && attached != pdo) {
            PDRIVER_OBJECT  drvobj = attached->DriverObject;
            pdo = attached;
            ObDereferenceObject(attached);
    
            if (drvobj != NULL) {
                UNICODE_STRING  name_uni;
                RtlInitUnicodeString(&name_uni, L"\\driver\\usbip_stub");
                if (RtlEqualUnicodeString(&drvobj->DriverName, &name_uni, TRUE))
                    return TRUE;
            }
    
            attached = IoGetAttachedDeviceReference(pdo);
        }
        return FALSE;
    }
    

    Please check if my code is correct.

    Thanks.

  • Mark_RoddyMark_Roddy Member - All Emails Posts: 4,575
    edited November 2

    You can't dereference the device object while you are using the contents of the object, in particular the driver object. So your code needs some more work to get the object dereferenced correctly.

    As an aside, this seems like a horrible way to do anything. So what is the code trying to do by searching for the usbip_stub driver?

  • Mark_RoddyMark_Roddy Member - All Emails Posts: 4,575

    A better way to do this would be to have a custom ioctl that only usbip_stub responds to, basically a ping function for usbip_stub. Then you could just send the ioctl down the stack and your function returns true if usbip_stub responds with success.

  • Tim_RobertsTim_Roberts Member - All Emails Posts: 14,402

    "AttachedDevice" gives you the drivers above you, right? Function devices should simply not care whether a specific filter is in the stack above you. That's the whole point of the architecture. You do what you need to do, without worrying about the filters above you.

    Similar to what Mark said, you could have the upper filter send down a specific ioctl to register itself, but what would you do with that information? How does this help you?

    Tim Roberts, [email protected]
    Providenza & Boekelheide, Inc.

  • Mark_RoddyMark_Roddy Member - All Emails Posts: 4,575

    AttachedDevice" gives you the drivers above you, right?

    Or all the current occupants of the stack you might want to attach to. I believe the op is trying to probe for usbip_stub on a device stack in order to only attach to that particular stack. That's a valid thing to do, AFAIC.

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 30 January 2023 Live, Online
Developing Minifilters 20 March 2023 Live, Online
Writing WDF Drivers TBD 2023 Live, Online
Internals & Software Drivers 17 April 2023 Live, Online