Accessing MDL from user-mode at DISPATCH_LEVEL

NTDEV
1

Hello all,

I got a strange crash (IRQL_NOT_LESS_OR_EQUAL) when
accessing memory specified by a MDL received from a
ioctl using DIRECT_IO. I have two questions:

1 - does the IO manager call MmProbeAndLockPages on
this MDL?

2 - Is it safe to access this memory at DISPATCH_LEVEL
through the virtual address? I am thinking that the
process PTEs can be paged out even if the memory is
locked.

Thank you.

Finding fabulous fares is fun.
Let Yahoo! FareChase search your favorite travel sites to find flight and hotel bargains.
http://farechase.yahoo.com/promo-generic-14795097

2

> 1 - does the IO manager call MmProbeAndLockPages on

this MDL?

Yes.

2 - Is it safe to access this memory at DISPATCH_LEVEL
through the virtual address? I am thinking that the
process PTEs can be paged out even if the memory is
locked.

No.

You need to call MmGetSystemAddressForMdlSafe to do this.

–
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

3

> Is it safe to access this memory at DISPATCH_LEVEL through the virtual address?

Unless the virtual range, desribed by MDL, belongs to non-paged pool, you should not access it
as a virtual address - instead, you should pass it to MmMapLockedPagesSpecifyCache(), and access it by the address that MmMapLockedPagesSpecifyCache() returns. Look at how MmGetSystemAddressForMdlSafe() macro in ntddk.h is declared, and you will understand what my statement is based upon…

Anton Bassov