ExDeleteLookasideListEx does not free all allocated buffers in it?

tanda996

please review my code:

EXTERN_C
NTSTATUS
DriverEntry(
    __in PDRIVER_OBJECT  DriverObject,
    __in PUNICODE_STRING
)
{
    DriverObject->DriverUnload = MyUnload;
    LOOKASIDE_LIST_EX lal = {};
    PVOID pData = nullptr;

    struct MY_TEST
    {
        UCHAR a[100];
    };

    if (NT_SUCCESS(ExInitializeLookasideListEx(&lal, nullptr, nullptr, PagedPool, 0, sizeof(MY_TEST), '2222', 0)))
    {
        // 1
        pData = ExAllocateFromLookasideListEx(&lal);
        if (pData)
        {
            KdPrint(("[LAL] allocated ok\n"));
        }
        // 2
        pData = ExAllocateFromLookasideListEx(&lal);
        if (pData)
        {
            KdPrint(("[LAL] allocated ok\n"));
        }
        // 3
        pData = ExAllocateFromLookasideListEx(&lal);
        if (pData)
        {
            KdPrint(("[LAL] allocated ok\n"));
        }

        ExDeleteLookasideListEx(&lal); // free all allocated buffers?
    }
    else
    {
        KdPrint(("[LAL] init fail\n"));
    }

    return STATUS_SUCCESS;
}

inside ExDeleteLookasideListEx:

i saw that ExDeleteLookasideListEx call free routine callback at the end, but it actually do not free anything:

does programmer must free by their own or i misunderstanding something?
pls explain, thank you so much.

Tim_Roberts

Is that pool monitor supposed to auto-refresh? I notice it looks like it is paused.

Doron_Holan

IIRC the lookaside doesn’t track allocations, it tracks allocations freed back to it. IOW when deleted the lookaside will free all allocations previously passed to ExFreeToLookasideListEx. Any outstanding allocations are leaked. This is implied on https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/using-lookaside-lists, but not explicitly stated….BUT the memory pattern across the kernel is you just explicitly free/release what you have allocated/ref’Ed and expecting the lookaside to behave outside of the normal pattern does not align with how kernel apis are designed.

tanda996

@Tim_Roberts
Yes, it will be update frequently with time interval (2s).

@Doron_Holan
I think you are right, it seem like ExDeleteLookasideListEx is a freed buffer list cleaner and thanks for you advice.