Bogus bugcheck with DriverVerifier and KeRaiseIrql( )?

NTDEV
1

I think I’m getting a bogus trap by driver verifier. The following code
produces a trap:

if (KeGetCurrentIrql() < DISPATCH_LEVEL)
KeRaiseIrql(DISPATCH_LEVEL, &oldIrql);
Where oldirq is an automatic variable on the stack.

*********************************************
I’m getting:
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pagable (or completely invalid) address at
an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: f601143f, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: f601143f, address which referenced memory

*********************************************
IMO this is a bogus trap. When KeRaiseIrql() is called, DriverVerifier
tests pages to ensure that they are not from the paged pool. In this case,
I believe DriverVerifier is complaining about the use of oldIrql which is
on the stack which could be from the paged pool.

However, it is my understanding that it cannot be currently paged because
this code is executing.
Any insights?

Thanks in advance,

Allan

2

> I think I’m getting a bogus trap by driver verifier. The following code

produces a trap:

if (KeGetCurrentIrql() < DISPATCH_LEVEL)
KeRaiseIrql(DISPATCH_LEVEL, &oldIrql);
Where oldirq is an automatic variable on the stack.

*********************************************
I’m getting:
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pagable (or completely invalid) address at
an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: f601143f, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: f601143f, address which referenced memory

*********************************************
IMO this is a bogus trap. When KeRaiseIrql() is called, DriverVerifier
tests pages to ensure that they are not from the paged pool. In this case,
I believe DriverVerifier is complaining about the use of oldIrql which is
on the stack which could be from the paged pool.

Looks to me like you raised IRQL in a routine that can be paged,
check the fact that arg1 and arg4 are the same.

Don Burn
Egenera, Inc

3

“Allan Smith” wrote in message news:xxxxx@ntdev…
>
> I think I’m getting a bogus trap by driver verifier. The following code
> produces a trap:
>
> if (KeGetCurrentIrql() < DISPATCH_LEVEL)
> KeRaiseIrql(DISPATCH_LEVEL, &oldIrql);
> Where oldirq is an automatic variable on the stack.
>
> *********************************************
> I’m getting:
> DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
>

This doesn’t look like Verifier complaining about something to me. It looks
like an ordinary bugcheck.

Standard questions:

1) WHERE does it crash?
2) WHAT’s the stack look like at the time of crash?
3) You ARE running this on the CHECKED build of the operating system, right?
If not, please repro on the checked build.

Peter
OSR