The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
I've been looking at what it means for a wait to be Altertable. I found these two helpful paragraphs:
Alerts, a seldom-used mechanism that are internal to the operating system,
can also interrupt alertable wait states. An alert can interrupt a wait when
Alertable = TRUE, regardless of the value of the WaitMode parameter.
The waiting routine returns a value of STATUS_ALERTED.
It is especially important to check the return value of KeWaitForSingleObject
when the WaitMode parameter is UserMode or Alertable is TRUE, because
KeWaitForSingleObject might return early with a status of STATUS_USER_APC
I found a bug in our driver where it would call KeWaitForSingleObject
setting Alterable and then did not check for STATUS_ALERTED.
It was waiting on a KMUTEX then assuming it held the mutex whatever the
return code. When the return code was STATUS_ALERTED this assumption was false.
We'd get a mutex-released-when-not-held blue screen shortly after that of course!
The fix was simply not to set Alterable on the wait of course.
In the general case, are Altertable KernelMode KeWaitForSingleObject
calls that don't check their return-code all bugs? I think so.
More generally, should a KernelMode KeWaitForSingleObject ever set Alterable?
I do not think it should. Is that correct?
If not, how is one supposed to process STATUS_ALERTED?
Thanks in advance,
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!||Kernel Debugging||30 Mar 2020||OSR Seminar Space|
|Developing Minifilters||15 Jun 2020||LIVE ONLINE|
|Writing WDF Drivers||22 June 2020||LIVE ONLINE|
|Internals & Software Drivers||28 Sept 2020||Dulles, VA|