Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTDEV

Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


ExDeleteLookasideListEx does not free all allocated buffers in it?

tanda996tanda996 Member Posts: 24

please review my code:

EXTERN_C
NTSTATUS
DriverEntry(
    __in PDRIVER_OBJECT  DriverObject,
    __in PUNICODE_STRING
)
{
    DriverObject->DriverUnload = MyUnload;
    LOOKASIDE_LIST_EX lal = {};
    PVOID pData = nullptr;

    struct MY_TEST
    {
        UCHAR a[100];
    };

    if (NT_SUCCESS(ExInitializeLookasideListEx(&lal, nullptr, nullptr, PagedPool, 0, sizeof(MY_TEST), '2222', 0)))
    {
        // 1
        pData = ExAllocateFromLookasideListEx(&lal);
        if (pData)
        {
            KdPrint(("[LAL] allocated ok\n"));
        }
        // 2
        pData = ExAllocateFromLookasideListEx(&lal);
        if (pData)
        {
            KdPrint(("[LAL] allocated ok\n"));
        }
        // 3
        pData = ExAllocateFromLookasideListEx(&lal);
        if (pData)
        {
            KdPrint(("[LAL] allocated ok\n"));
        }

        ExDeleteLookasideListEx(&lal); // free all allocated buffers?
    }
    else
    {
        KdPrint(("[LAL] init fail\n"));
    }

    return STATUS_SUCCESS;
}

inside ExDeleteLookasideListEx:
HKLKlf4.png

i saw that ExDeleteLookasideListEx call free routine callback at the end, but it actually do not free anything:
HKLKOqx.md.png

does programmer must free by their own or i misunderstanding something?
pls explain, thank you so much.

Comments

  • Tim_RobertsTim_Roberts Member - All Emails Posts: 14,445

    Is that pool monitor supposed to auto-refresh? I notice it looks like it is paused.

    Tim Roberts, [email protected]
    Providenza & Boekelheide, Inc.

  • Doron_HolanDoron_Holan Member - All Emails Posts: 10,735
    IIRC the lookaside doesn’t track allocations, it tracks allocations freed back to it. IOW when deleted the lookaside will free all allocations previously passed to ExFreeToLookasideListEx. Any outstanding allocations are leaked. This is implied on https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/using-lookaside-lists, but not explicitly stated….BUT the memory pattern across the kernel is you just explicitly free/release what you have allocated/ref’Ed and expecting the lookaside to behave outside of the normal pattern does not align with how kernel apis are designed.
    d
  • tanda996tanda996 Member Posts: 24

    @Tim_Roberts
    Yes, it will be update frequently with time interval (2s).

    @Doron_Holan
    I think you are right, it seem like ExDeleteLookasideListEx is a freed buffer list cleaner and thanks for you advice.

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 30 January 2023 Live, Online
Developing Minifilters 20 March 2023 Live, Online
Internals & Software Drivers 17 April 2023 Live, Online
Writing WDF Drivers 22 May 2023 Live, Online