Does WFP classifyFn, notifyFn, flowDeleteFn thread-safe ?

I just google seach “WFP thread safe” “WFP sync” no result.
The official document also did not mention.

Since those are functions YOU supply, it’s up to you to make sure they are “thread safe”. Are you asking if these are automatically serialized? I’m pretty sure the answer to that is “no”.

@Tim_Roberts said:
Since those are functions YOU supply, it’s up to you to make sure they are “thread safe”. Are you asking if these are automatically serialized? I’m pretty sure the answer to that is “no”.

Because my driver has a BSOD due to KERNEL_SECURITY_CHECK_FAILURE (139) A LIST_ENTRY has been corrupted, but it happens randomly, from a few minutes to a few hours.

Then I add KdPrint(“%s begin/end”, __FUNCTION__) to those functions, I saw the logs like this:
// -------------------------------------------------
xxx begin
xxx other logs…
xxx end

yyy begin
yyy other logs…
yyy end

zzz begin
zzz other logs…
zzz end
// -------------------------------------------------

I never see yyy between xxx begin and xxx end. So, can I assume those functions are thread-safe ?

Just because something happens often does not mean it is guaranteed.

And your terminology is wrong. “Thread safe” refers to the behavior of the function. If you had written them to be thread-safe, then it wouldn’t matter how they were called. What you’re asking is if those callbacks are serialized or synchronized.

> @Tim_Roberts said: > Just because something happens often does not mean it is guaranteed. > > And your terminology is wrong. “Thread safe” refers to the behavior of the function. If you had written them to be thread-safe, then it wouldn’t matter how they were called. What you’re asking is if those callbacks are serialized or synchronized. I know what is “synchronized”, but what is “serialized” in this scenario?

In this context, two words for the same thing. If the requests are serialized, then you won’t get #2 until #1 has completed. They would be issues serially (as opposed to “in parallel”).

@Tim_Roberts said:
In this context, two words for the same thing. If the requests are serialized, then you won’t get #2 until #1 has completed. They would be issues serially (as opposed to “in parallel”).

Thank you for your guide. I will try to use lock to solve this issue.