RE : LookasideListEx alignment

Initializing the lookaside is one of the first things I do when setting up
the device. Not much else can go wrong before that. I’ll add the assert
check just to be safe. I haven’t spent much time tracking it down. Maybe
I’ll dig in a little closer today. Allocating the structure surely solves
the BSOD. I’ll post more information if I discover some root cause that I
am not seeing right now.

The bug is rare, and does not happen on all machines. If it does not happen
on a machine, it appears to never happen on that machine. If I find a
machine where it does happen, it happens frequently.

On Sat, May 6, 2017 at 2:38 PM xxxxx@outlook.com <
xxxxx@outlook.com> wrote:

The offset of a member of a structure is constant for the lifetime of the
structure. I’m afraid you have a bug because if a member is properly
aligned once, it should always be properly aligned.

C_ASSERT((FIELD_OFFSET(DEVICE_EXT,LookAsideListEx) & 0xF) == 0)

If you can compile then the member is properly aligned. Than you need to
check that the device extension is properly aligned as well.

J. S.


NTDEV is sponsored by OSR

Visit the list online at: <
http://www.osronline.com/showlists.cfm?list=ntdev\>

MONTHLY seminars on crash dump analysis, WDF, Windows internals and
software drivers!
Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at <
> http://www.osronline.com/page.cfm?name=ListServer&gt;
></http:>

> The bug is rare, and does not happen on all machines. If it does not happen
on a machine, it appears to never happen on that machine.

A lookaside list can be garbage-collected by the kernel whenever it decides so. Maybe those machines become low on memory and you have a dangling pointer to a reclaimed item. Or, there’s some synchronization problem (a lookaside list has some lock to sync between allocations, frees and garbage collection…). When you repro this again, post a call stack …

– pa

@Mr Kirby:

I hope you haven’t forgotten to call ExDeleteLookasideListEx before IoDeleteDevice?

It is a Storport miniport, but yes, I do delete the list where appropriate.

On Sat, May 6, 2017 at 9:11 PM wrote:

> @Mr Kirby:
>
> I hope you haven’t forgotten to call ExDeleteLookasideListEx before
> IoDeleteDevice?
>
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list online at: <
> http://www.osronline.com/showlists.cfm?list=ntdev&gt;
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at <
> http://www.osronline.com/page.cfm?name=ListServer&gt;
></http:>

Def pool corruption.

fffff8800496bb88 fffff800027866d2 : 0000000000000003 fffffa80021e2a60
0000000000000065 fffff800026cf314 : nt!RtlpBreakWithStatusInstruction
fffff8800496bb90 fffff800027874be : 0000000000000003 0000000000000000
fffff800026cbee0 0000000000000019 : nt!KiBugCheckDebugBreak+0x12
fffff8800496bbf0 fffff80002691004 : fffff8800496c500 0000000000000000
0000000000000000 fffffa8001904320 : nt!KeBugCheck2+0x71e
fffff8800496c2c0 fffff800027c2d6f : 0000000000000019 0000000000000003
fffff8000281ea80 000000000007e73a : nt!KeBugCheckEx+0x104
fffff8800496c300 fffff800028fc89e : 0000000000000000 fffffa8001af5b60
fffffa8072724d46 0000000000000000 : nt!ExFreePool+0x536
fffff8800496c3f0 fffff88001097310 : fffff8800496c4f0 0000000000000005
fffffa80019d6be0 fffffa800199a730 :
nt!ExAllocateCacheAwareRundownProtection+0xe6
fffff8800496c420 fffff880010990e1 : fffff8a005e4d3a0 ffffffff80000914
fffffa8000000005 00000000000007ff : fltmgr!FltpInitInstance+0x130
fffff8800496c490 fffff880010978bb : fffff8a001c334e0 0000000000000000
0000000000000050 0000000000000018 :
fltmgr!FltpCreateInstanceFromName+0x1d1
fffff8800496c560 fffff880010980bc : fffffa80019d6bf0 fffffa80019bf010
fffffa80019d6bf0 0000000000000020 :
fltmgr!FltpEnumerateRegistryInstances+0x15b
fffff8800496c600 fffff880010933f0 : fffffa8001d97800 fffffa8000000000
fffffa80019d6bf0 fffffa80019bf010 :
fltmgr!FltpDoFilterNotificationForNewVolume+0xec
fffff8800496c670 fffff80002991477 : 0000000000000025 fffff80002990ed0
fffffa8002c27b10 0000000000000000 : fltmgr!FltpCreate+0x3e0
fffff8800496c720 fffff80002987764 : fffffa8001f09060 0000000000000000
fffffa8001d7db10 0000000000000001 : nt!IopParseDevice+0x5a7
fffff8800496c8b0 fffff8000298c876 : fffffa8001d7db10 fffff8800496ca30
0000000000000040 fffffa80018ba750 : nt!ObpLookupObjectName+0x585
fffff8800496c9b0 fffff80002993587 : fffffa80018ba750 0000000000000001
00000000746c6601 fffff8800496cac0 : nt!ObOpenObjectByName+0x306
fffff8800496ca80 fffff8000299d198 : 0000000001d5e338 fffff80080100080
0000000000000000 0000000001d5e348 : nt!IopCreateFile+0x2b7
fffff8800496cb20 fffff80002690153 : ffffffffffffffff 0000000001d5e348
0000000001d5e360 0000000000000004 : nt!NtCreateFile+0x78
fffff8800496cbb0 00000000778f040a : 000007fefdb24d76 0000000000000000
0000000080000000 ffffffffffffffff : nt!KiSystemServiceCopyEnd+0x13
0000000001d5e2b8 000007fefdb24d76 : 0000000000000000 0000000080000000
ffffffffffffffff 0000000000000018 : ntdll!NtCreateFile+0xa
0000000001d5e2c0 0000000077792aad : 0000000080000000 0000000080000000
0000000000000003 0000000001d5e778 : KERNELBASE!CreateFileW+0x2cd
0000000001d5e420 000007feed39b2be : 000000000048c190 0000000001d5e778
0000000000000000 000000000048c190 :
kernel32!CreateFileWImplementation+0x7d
0000000001d5e480 000007feed0e39e0 : 000000000048c190 0000000000489820
000007feed0ca0d8 000000000048c190 : vdsutil!OpenDevice+0xfe
0000000001d5e740 00000000fff5b970 : 0000000000000000 0000000000000001
0000000001d5e800 0000000000457b00 : vdsbas!CBasicDisk::GetProperties+0x398
0000000001d5e7d0 000007feff40c7f5 : 0000000000000002 0000000001d5ebf0
000007feed33e6e0 000007feff78f17d : vds!CVdsDiskLun::GetProperties+0x98
0000000001d5e820 000007feff4bb62e : 0000000000000002 0000000000487c80
000007feed33d3d0 0000000000496760 : RPCRT4!Invoke+0x65
0000000001d5e870 000007feff40f1f6 : 0000000000000000 0000000000000000
0000000000000000 0000000000000000 : RPCRT4!Ndr64StubWorker+0x61b
0000000001d5ee30 000007feff78f223 : 0000000000000000 0000000000000000
000007feed33f460 000000000043d960 : RPCRT4!NdrStubCall3+0xb5
0000000001d5ee90 000007feff78fc0d : 0000000000000001 0000000000000000
0000000000000000 0000000000000000 : ole32!CStdStubBuffer_Invoke+0x5b
[d:\w7rtm\com\rpc\ndrole\stub.cxx @ 1586]
0000000001d5eec0 000007feff78fb83 : 0000000000496760 0000000000484c04
000000000044bc20 00000000fff04ca0 : ole32!SyncStubInvoke+0x5d
[d:\w7rtm\com\ole32\com\dcomrem\channelb.cxx @ 1187]
0000000001d5ef30 000007feff62fd60 : 0000000000496760 000000000044fa20
0000000000496760 0000000000000000 : ole32!StubInvoke+0xdb
[d:\w7rtm\com\ole32\com\dcomrem\channelb.cxx @ 1396]
0000000001d5efe0 000007feff78fa22 : 0000000000000000 0000000000000010
0000000000499f10 000000000043d960 :
ole32!CCtxComChnl::ContextInvoke+0x190
[d:\w7rtm\com\ole32\com\dcomrem\ctxchnl.cxx @ 1262]
0000000001d5f170 000007feff78f76b : 00000000d0908070 000000000044fa20
00000000004496b0 0000000000487c80 : ole32!AppInvoke+0xc2
[d:\w7rtm\com\ole32\com\dcomrem\channelb.cxx @ 1086]
0000000001d5f1e0 000007feff78ed6d : 000000000044fa20 000000000044fa20
000000000043d960 0000000000070005 : ole32!ComInvokeWithLockAndIPID+0x52b
[d:\w7rtm\com\ole32\com\dcomrem\channelb.cxx @ 1727]
0000000001d5f370 000007feff409c24 : 000007feff7f7930 0000000000000000
0000000000452960 000007feff402d97 : ole32!ThreadInvoke+0x30d
[d:\w7rtm\com\ole32\com\dcomrem\channelb.cxx @ 4751]
0000000001d5f410 000007feff409d86 : 000007feff79fab0 0000000000000001
0000000001d5f680 000007feff629910 : RPCRT4!DispatchToStubInCNoAvrf+0x14
0000000001d5f440 000007feff40c44b : 0000000000484be0 0000000000000000
0000000001d5f764 0000000000484be0 :
RPCRT4!RPC_INTERFACE::DispatchToStubWorker+0x146
0000000001d5f560 000007feff40c38b : 0000000000000000 0000000001d5f680
0000000001d5f680 0000000000452960 :
RPCRT4!RPC_INTERFACE::DispatchToStub+0x9b
0000000001d5f5a0 000007feff40c322 : 0000000000484be0 0000000000484be0
0000000000484be0 000007feff40ac00 :
RPCRT4!RPC_INTERFACE::DispatchToStubWithObject+0x5b
0000000001d5f620 000007feff40a11d : 0000000000000001 0000000000000000
000007feff3e0000 0000000000484be0 :
RPCRT4!LRPC_SCALL::DispatchRequest+0x422
0000000001d5f700 000007feff417ddf : 0000000000010000 0000000000000000
0000000000000000 0000000000000001 : RPCRT4!LRPC_SCALL::HandleRequest+0x20d
0000000001d5f830 000007feff417995 : 0000000000000000 0000000000000000
000000000043a5d0 0000000000000000 : RPCRT4!LRPC_ADDRESS::ProcessIO+0x3bf
0000000001d5f970 00000000778bb43b : 0000000000000000 0000000000000000
0000000000000000 0000000000000000 : RPCRT4!LrpcIoComplete+0xa5
0000000001d5fa00 00000000778b923f : 0000000000000000 0000000000000000
000000000000ffff 0000000000000000 : ntdll!TppAlpcpExecuteCallback+0x26b
0000000001d5fa90 000000007779f56d : 0000000000000000 0000000000000000
0000000000000000 0000000000000000 : ntdll!TppWorkerThread+0x3f8
0000000001d5fd90 00000000778d3281 : 0000000000000000 0000000000000000
0000000000000000 0000000000000000 : kernel32!BaseThreadInitThunk+0xd
0000000001d5fdc0 0000000000000000 : 0000000000000000 0000000000000000
0000000000000000 0000000000000000 : ntdll!RtlUserThreadStart+0x1d

On Sat, May 6, 2017 at 10:26 PM Jamey Kirby wrote:

> It is a Storport miniport, but yes, I do delete the list where appropriate.
>
> On Sat, May 6, 2017 at 9:11 PM wrote:
>
>> @Mr Kirby:
>>
>> I hope you haven’t forgotten to call ExDeleteLookasideListEx before
>> IoDeleteDevice?
>>
>>
>> —
>> NTDEV is sponsored by OSR
>>
>> Visit the list online at: <
>> http://www.osronline.com/showlists.cfm?list=ntdev&gt;
>>
>> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
>> software drivers!
>> Details at http:
>>
>> To unsubscribe, visit the List Server section of OSR Online at <
>> http://www.osronline.com/page.cfm?name=ListServer&gt;
>>
></http:>

My driver is not in the call stack.

On Sat, May 6, 2017 at 10:27 PM Jamey Kirby wrote:

> Def pool corruption.
>
> fffff8800496bb88 fffff800027866d2 : 0000000000000003 fffffa80021e2a60
> 0000000000000065 fffff800026cf314 : nt!RtlpBreakWithStatusInstruction
> fffff8800496bb90 fffff800027874be : 0000000000000003 0000000000000000
> fffff800026cbee0 0000000000000019 : nt!KiBugCheckDebugBreak+0x12
> fffff8800496bbf0 fffff80002691004 : fffff8800496c500 0000000000000000
> 0000000000000000 fffffa8001904320 : nt!KeBugCheck2+0x71e
> fffff8800496c2c0 fffff800027c2d6f : 0000000000000019 0000000000000003
> fffff8000281ea80 000000000007e73a : nt!KeBugCheckEx+0x104
> fffff8800496c300 fffff800028fc89e : 0000000000000000 fffffa8001af5b60
> fffffa8072724d46 0000000000000000 : nt!ExFreePool+0x536
> fffff8800496c3f0 fffff88001097310 : fffff8800496c4f0 0000000000000005
> fffffa80019d6be0 fffffa800199a730 :
> nt!ExAllocateCacheAwareRundownProtection+0xe6
> fffff8800496c420 fffff880010990e1 : fffff8a005e4d3a0 ffffffff80000914
> fffffa8000000005 00000000000007ff : fltmgr!FltpInitInstance+0x130
> fffff8800496c490 fffff880010978bb : fffff8a001c334e0 0000000000000000
> 0000000000000050 0000000000000018 :
> fltmgr!FltpCreateInstanceFromName+0x1d1
> fffff8800496c560 fffff880010980bc : fffffa80019d6bf0 fffffa80019bf010
> fffffa80019d6bf0 0000000000000020 :
> fltmgr!FltpEnumerateRegistryInstances+0x15b
> fffff8800496c600 fffff880010933f0 : fffffa8001d97800 fffffa8000000000
> fffffa80019d6bf0 fffffa80019bf010 :
> fltmgr!FltpDoFilterNotificationForNewVolume+0xec
> fffff8800496c670 fffff80002991477 : 0000000000000025 fffff80002990ed0
> fffffa8002c27b10 0000000000000000 : fltmgr!FltpCreate+0x3e0
> fffff8800496c720 fffff80002987764 : fffffa8001f09060 0000000000000000
> fffffa8001d7db10 0000000000000001 : nt!IopParseDevice+0x5a7
> fffff8800496c8b0 fffff8000298c876 : fffffa8001d7db10 fffff8800496ca30
> 0000000000000040 fffffa80018ba750 : nt!ObpLookupObjectName+0x585
> fffff8800496c9b0 fffff80002993587 : fffffa80018ba750 0000000000000001
> 00000000746c6601 fffff8800496cac0 : nt!ObOpenObjectByName+0x306
> fffff8800496ca80 fffff8000299d198 : 0000000001d5e338 fffff80080100080
> 0000000000000000 0000000001d5e348 : nt!IopCreateFile+0x2b7
> fffff8800496cb20 fffff80002690153 : ffffffffffffffff 0000000001d5e348
> 0000000001d5e360 0000000000000004 : nt!NtCreateFile+0x78
> fffff8800496cbb0 00000000778f040a : 000007fefdb24d76 0000000000000000
> 0000000080000000 ffffffffffffffff : nt!KiSystemServiceCopyEnd+0x13
> 0000000001d5e2b8 000007fefdb24d76 : 0000000000000000 0000000080000000
> ffffffffffffffff 0000000000000018 : ntdll!NtCreateFile+0xa
> 0000000001d5e2c0 0000000077792aad : 0000000080000000 0000000080000000
> 0000000000000003 0000000001d5e778 : KERNELBASE!CreateFileW+0x2cd
> 0000000001d5e420 000007feed39b2be : 000000000048c190 0000000001d5e778
> 0000000000000000 000000000048c190 :
> kernel32!CreateFileWImplementation+0x7d
> 0000000001d5e480 000007feed0e39e0 : 000000000048c190 0000000000489820
> 000007feed0ca0d8 000000000048c190 : vdsutil!OpenDevice+0xfe
> 0000000001d5e740 00000000fff5b970 : 0000000000000000 0000000000000001
> 0000000001d5e800 0000000000457b00 : vdsbas!CBasicDisk::GetProperties+0x398
> 0000000001d5e7d0 000007feff40c7f5 : 0000000000000002 0000000001d5ebf0
> 000007feed33e6e0 000007feff78f17d : vds!CVdsDiskLun::GetProperties+0x98
> 0000000001d5e820 000007feff4bb62e : 0000000000000002 0000000000487c80
> 000007feed33d3d0 0000000000496760 : RPCRT4!Invoke+0x65
> 0000000001d5e870 000007feff40f1f6 : 0000000000000000 0000000000000000
> 0000000000000000 0000000000000000 : RPCRT4!Ndr64StubWorker+0x61b
> 0000000001d5ee30 000007feff78f223 : 0000000000000000 0000000000000000
> 000007feed33f460 000000000043d960 : RPCRT4!NdrStubCall3+0xb5
> 0000000001d5ee90 000007feff78fc0d : 0000000000000001 0000000000000000
> 0000000000000000 0000000000000000 : ole32!CStdStubBuffer_Invoke+0x5b
> [d:\w7rtm\com\rpc\ndrole\stub.cxx @ 1586]
> 0000000001d5eec0 000007feff78fb83 : 0000000000496760 0000000000484c04
> 000000000044bc20 00000000fff04ca0 : ole32!SyncStubInvoke+0x5d
> [d:\w7rtm\com\ole32\com\dcomrem\channelb.cxx @ 1187]
> 0000000001d5ef30 000007feff62fd60 : 0000000000496760 000000000044fa20
> 0000000000496760 0000000000000000 : ole32!StubInvoke+0xdb
> [d:\w7rtm\com\ole32\com\dcomrem\channelb.cxx @ 1396]
> 0000000001d5efe0 000007feff78fa22 : 0000000000000000 0000000000000010
> 0000000000499f10 000000000043d960 :
> ole32!CCtxComChnl::ContextInvoke+0x190
> [d:\w7rtm\com\ole32\com\dcomrem\ctxchnl.cxx @ 1262]
> 0000000001d5f170 000007feff78f76b : 00000000d0908070 000000000044fa20
> 00000000004496b0 0000000000487c80 : ole32!AppInvoke+0xc2
> [d:\w7rtm\com\ole32\com\dcomrem\channelb.cxx @ 1086]
> 0000000001d5f1e0 000007feff78ed6d : 000000000044fa20 000000000044fa20
> 000000000043d960 0000000000070005 : ole32!ComInvokeWithLockAndIPID+0x52b
> [d:\w7rtm\com\ole32\com\dcomrem\channelb.cxx @ 1727]
> 0000000001d5f370 000007feff409c24 : 000007feff7f7930 0000000000000000
> 0000000000452960 000007feff402d97 : ole32!ThreadInvoke+0x30d
> [d:\w7rtm\com\ole32\com\dcomrem\channelb.cxx @ 4751]
> 0000000001d5f410 000007feff409d86 : 000007feff79fab0 0000000000000001
> 0000000001d5f680 000007feff629910 : RPCRT4!DispatchToStubInCNoAvrf+0x14
> 0000000001d5f440 000007feff40c44b : 0000000000484be0 0000000000000000
> 0000000001d5f764 0000000000484be0 :
> RPCRT4!RPC_INTERFACE::DispatchToStubWorker+0x146
> 0000000001d5f560 000007feff40c38b : 0000000000000000 0000000001d5f680
> 0000000001d5f680 0000000000452960 :
> RPCRT4!RPC_INTERFACE::DispatchToStub+0x9b
> 0000000001d5f5a0 000007feff40c322 : 0000000000484be0 0000000000484be0
> 0000000000484be0 000007feff40ac00 :
> RPCRT4!RPC_INTERFACE::DispatchToStubWithObject+0x5b
> 0000000001d5f620 000007feff40a11d : 0000000000000001 0000000000000000
> 000007feff3e0000 0000000000484be0 :
> RPCRT4!LRPC_SCALL::DispatchRequest+0x422
> 0000000001d5f700 000007feff417ddf : 0000000000010000 0000000000000000
> 0000000000000000 0000000000000001 : RPCRT4!LRPC_SCALL::HandleRequest+0x20d
> 0000000001d5f830 000007feff417995 : 0000000000000000 0000000000000000
> 000000000043a5d0 0000000000000000 : RPCRT4!LRPC_ADDRESS::ProcessIO+0x3bf
> 0000000001d5f970 00000000778bb43b : 0000000000000000 0000000000000000
> 0000000000000000 0000000000000000 : RPCRT4!LrpcIoComplete+0xa5
> 0000000001d5fa00 00000000778b923f : 0000000000000000 0000000000000000
> 000000000000ffff 0000000000000000 : ntdll!TppAlpcpExecuteCallback+0x26b
> 0000000001d5fa90 000000007779f56d : 0000000000000000 0000000000000000
> 0000000000000000 0000000000000000 : ntdll!TppWorkerThread+0x3f8
> 0000000001d5fd90 00000000778d3281 : 0000000000000000 0000000000000000
> 0000000000000000 0000000000000000 : kernel32!BaseThreadInitThunk+0xd
> 0000000001d5fdc0 0000000000000000 : 0000000000000000 0000000000000000
> 0000000000000000 0000000000000000 : ntdll!RtlUserThreadStart+0x1d
>
>
> On Sat, May 6, 2017 at 10:26 PM Jamey Kirby wrote:
>
>> It is a Storport miniport, but yes, I do delete the list where
>> appropriate.
>>
>> On Sat, May 6, 2017 at 9:11 PM wrote:
>>
>>> @Mr Kirby:
>>>
>>> I hope you haven’t forgotten to call ExDeleteLookasideListEx before
>>> IoDeleteDevice?
>>>
>>>
>>> —
>>> NTDEV is sponsored by OSR
>>>
>>> Visit the list online at: <
>>> http://www.osronline.com/showlists.cfm?list=ntdev&gt;
>>>
>>> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
>>> software drivers!
>>> Details at http:
>>>
>>> To unsubscribe, visit the List Server section of OSR Online at <
>>> http://www.osronline.com/page.cfm?name=ListServer&gt;
>>>
>></http:>

>It is a Storport miniport, but yes, I do delete the list where appropriate.

In which callback do you delete the list? Have you verified it’s actually been called when the miniport is unloaded?

I am a long way from deleting or unloading anything. When it occurs, it is
after system boot when my virtual adapter is initializing. Really, not very
much has happened at that point (I delay initialization via
StorPortEnablePassiveInitialization()). Although a virtual storport
initialization should occur at PASSIVE_LEVEL, I figured using
StorPortEnablePassiveInitialization() makes it clear that it MUST be done
at PASSIVE_LEVEL:

BOOLEAN VirtualHwInitializePassive(In PVHBA_EXT vhba_ext) {
KeInitializeSpinLock(&vhba_ext->request_lock);
InitializeListHead(&vhba_ext->request_head);
KeInitializeEvent(&vhba_ext->thread_ready_event, SynchronizationEvent,
FALSE);
KeInitializeEvent(&vhba_ext->stop_thread_event, SynchronizationEvent,
FALSE);
KeInitializeEvent(&vhba_ext->request_queued_event, SynchronizationEvent,
FALSE);
// Initialize our lookaside list for requests.
// Fix BSOD by allocating lookaside header.
vhba_ext->node_pool = ExAllocatePoolWithTag(NonPagedPool,
sizeof(LOOKASIDE_LIST_EX), 0xBEEF);
NTSTATUS status = ExInitializeLookasideListEx(vhba_ext->node_pool, NULL,
NULL, NonPagedPool, 0, sizeof (SRB_IO_NODE), 0xBEEF, 0);
if (!NT_SUCCESS(status)) {
return FALSE;
}

}

BOOLEAN VirtualHwInitialize(In PVHBA_EXT vhba_ext) {
// WDK indicates that this callback should called at PASSIVE_LEVEL
// To be safe, let’s tell storport to complete initialization
at PASSIVE_LEVEL
// anyway.
return StorPortEnablePassiveInitialization(vhba_ext,
VirtualHwInitializePassive);
}

Nothing out of the ordinary, unless I am returning something incorrect from
the find adapter callback:

ULONG VirtualHwFindAdapter(In PVHBA_EXT vhba_ext, In PVOID vhw_context,
In PVOID bus_info, In PVOID lower_device, In PCHAR arg_string,
Inout PPORT_CONFIGURATION_INFORMATION config_info, Out PBOOLEAN again) {
UNREFERENCED_PARAMETER(vhw_context);
UNREFERENCED_PARAMETER(bus_info);
UNREFERENCED_PARAMETER(arg_string);
UNREFERENCED_PARAMETER(again);
#if NTDDI_VERSION >= NTDDI_WIN8
UNREFERENCED_PARAMETER(lower_device);
UNREFERENCED_PARAMETER(vhba_ext);
#endif
config_info->VirtualDevice = TRUE;
config_info->WmiDataProvider = FALSE;
config_info->MaximumTransferLength = VIRTUAL_MAX_IO_SIZE;
config_info->AlignmentMask = 0x3;
config_info->CachesData = FALSE;
config_info->MaximumNumberOfTargets = SCSI_MAXIMUM_TARGETS;
config_info->NumberOfBuses = SCSI_MAXIMUM_BUSES;
config_info->SynchronizationModel = StorSynchronizeFullDuplex;
config_info->ScatterGather = TRUE;
config_info->MultipleRequestPerLu = FALSE;
return SP_RETURN_FOUND;
}

At the time I get the BSOD, I’ve not done much.

Here is the top of the device extension:

typedef struct _VHBA_EXT {
LIST_ENTRY request_head;
KSPIN_LOCK request_lock;
// Changed to pointer, and allocated to fix BSOD.
PLOOKASIDE_LIST_EX node_pool;
KEVENT thread_ready_event;
KEVENT request_queued_event;
KEVENT stop_thread_event;

} VHBA_EXT, *PVHBA_EXT;

I’ll add the C_ASSERT next to verify things are aligned as they shoudl be.
I haven’t look at it much over the weekend.

On Sun, May 7, 2017 at 8:17 AM wrote:

> >It is a Storport miniport, but yes, I do delete the list where
> appropriate.
>
> In which callback do you delete the list? Have you verified it’s actually
> been called when the miniport is unloaded?
>
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list online at: <
> http://www.osronline.com/showlists.cfm?list=ntdev&gt;
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at <
> http://www.osronline.com/page.cfm?name=ListServer&gt;
></http:>

C_ASSERT is not needed now that you use a pointer.

Why don’t you check that the returned value of ExAllocatePoolWithTag is not null before calling ExInitializeLookAsideListEx ?

I don’t think that 0xBEEF is a useful pool tag for pool tracking. According to MSDN a pool tag is made of ASCII characters in the range 0x20 (space) to 0x126 (tilde).

Use driver verifier with pool tracking.

https://docs.microsoft.com/en-us/windows-hardware/drivers/devtest/pool-tracking

J. S.

Once the struct is allocated, fill it with zeros.

Wai. N.

Johns, the original problem was when I was not allocating it. Once I
started allocating it, the BSOD went away. My confusion is why there was a
BSOD when I was not allocating it.

On Sun, May 7, 2017 at 6:25 PM xxxxx@outlook.com
wrote:

> Once the struct is allocated, fill it with zeros.
>
>
>
> Wai. N.
>
>
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list online at: <
> http://www.osronline.com/showlists.cfm?list=ntdev&gt;
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at <
> http://www.osronline.com/page.cfm?name=ListServer&gt;
></http:>

Check if vhba_ext is aligned.

That’s what I will check now. If it is not, I would consider this to be a
bug in the StorPort stack. I assume the extension is allocated via
ExAllocatePool(), and on 64 bit systems, this should be 16 byte aligned.
But, I will check.

On Sun, May 7, 2017 at 10:03 PM wrote:

> Check if vhba_ext is aligned.
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list online at: <
> http://www.osronline.com/showlists.cfm?list=ntdev&gt;
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at <
> http://www.osronline.com/page.cfm?name=ListServer&gt;
></http:>

Wai, I will also zero out the structure to be safe. But I assume the
initialization routine should do this for me. Or at the very least
initialize the structure to a usable state.

On Sun, May 7, 2017 at 10:05 PM Jamey Kirby wrote:

> That’s what I will check now. If it is not, I would consider this to be a
> bug in the StorPort stack. I assume the extension is allocated via
> ExAllocatePool(), and on 64 bit systems, this should be 16 byte aligned.
> But, I will check.
>
>
> On Sun, May 7, 2017 at 10:03 PM wrote:
>
>> Check if vhba_ext is aligned.
>>
>> —
>> NTDEV is sponsored by OSR
>>
>> Visit the list online at: <
>> http://www.osronline.com/showlists.cfm?list=ntdev&gt;
>>
>> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
>> software drivers!
>> Details at http:
>>
>> To unsubscribe, visit the List Server section of OSR Online at <
>> http://www.osronline.com/page.cfm?name=ListServer&gt;
>>
></http:>

FindAdapter gets adapter extension zero-initialized already.
FindAdapter can be called another time after STOP_DEVICE, but this time adapter extension carries the same state.

You may be assuming that the extension is allocated separately, but it isn’t - its memory is part of the same allocation used for the corresponding DEVICE_OBJECT, and has a 8-byte alignment - not necessarily the 16-byte alignment you are hoping for.

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Jamey Kirby
Sent: 08 May 2017 03:06
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] RE : LookasideListEx alignment

That’s what I will check now. If it is not, I would consider this to be a bug in the StorPort stack. I assume the extension is allocated via ExAllocatePool(), and on 64 bit systems, this should be 16 byte aligned. But, I will check.

On Sun, May 7, 2017 at 10:03 PM > wrote:
Check if vhba_ext is aligned.


NTDEV is sponsored by OSR

Visit the list online at: http:

MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers!
Details at http:

To unsubscribe, visit the List Server section of OSR Online at http:
— NTDEV is sponsored by OSR Visit the list online at: MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers! Details at To unsubscribe, visit the List Server section of OSR Online at</http:></http:></http:>

Well that would explain a lot.

On Mon, May 8, 2017 at 10:19 AM David Boyce wrote:

> You may be assuming that the extension is allocated separately, but it
> isn’t - its memory is part of the same allocation used for the
> corresponding DEVICE_OBJECT, and has a 8-byte alignment - not necessarily
> the 16-byte alignment you are hoping for.
>
>
>
> From: xxxxx@lists.osr.com [mailto:
> xxxxx@lists.osr.com] *On Behalf Of *Jamey Kirby
> Sent: 08 May 2017 03:06
> To: Windows System Software Devs Interest List
> Subject: Re: [ntdev] RE : LookasideListEx alignment
>
>
>
> That’s what I will check now. If it is not, I would consider this to be a
> bug in the StorPort stack. I assume the extension is allocated via
> ExAllocatePool(), and on 64 bit systems, this should be 16 byte aligned.
> But, I will check.
>
>
>
>
>
> On Sun, May 7, 2017 at 10:03 PM wrote:
>
> Check if vhba_ext is aligned.
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list online at: <
> http://www.osronline.com/showlists.cfm?list=ntdev&gt;
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at <
> http://www.osronline.com/page.cfm?name=ListServer&gt;
>
> — NTDEV is sponsored by OSR Visit the list online at: MONTHLY seminars
> on crash dump analysis, WDF, Windows internals and software drivers!
> Details at To unsubscribe, visit the List Server section of OSR Online at
>
>
> ------------------------------
> This email message has been delivered safely and archived online by
> Mimecast.
> For more information please visit http://www.mimecast.com
> ------------------------------
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list online at: <
> http://www.osronline.com/showlists.cfm?list=ntdev&gt;
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at <
> http://www.osronline.com/page.cfm?name=ListServer&gt;
></http:></http:>

S. J. wrote:

I don?t think that 0xBEEF is a useful pool tag for pool tracking. According to
MSDN a pool tag is made of ASCII characters in the range 0x20 (space) to 0x126

Hmm hmm. A good point. IIRC bits 16 and 31 (0x8000 in 0xBEEF ) have some magic effects …

– pa

Yes, the following is a better choice:

(ULONG)‘FEEB’

J. S.

I gave numerous structures in my extension. Now, my extension contains just
a pointer to another allocated structure. This cleared up a couple of other
oddities in my driver.

On Mon, May 8, 2017, 6:24 PM xxxxx@outlook.com <
xxxxx@outlook.com> wrote:

Yes, the following is a better choice:

(ULONG)‘FEEB’

J. S.


NTDEV is sponsored by OSR

Visit the list online at: <
http://www.osronline.com/showlists.cfm?list=ntdev\>

MONTHLY seminars on crash dump analysis, WDF, Windows internals and
software drivers!
Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at <
> http://www.osronline.com/page.cfm?name=ListServer&gt;
></http:>