checks for invalid kernel handles

NTDEV
1

all,

our driver open file handles inside it. It uses zw calls a lot.
Everything works till we run verifier on this driver. we get invalid
handl BSODs in our zwClose calls.

after looking into the issue more, it looks like verifier randomly
makes some handles invalid, and hence we crash.

Is there a good way to ensure that the handles are valid? is there
somethign extra one needs to do other than the usual if conditional
check to see if this handle is valid before calling zwCalls?

2

Verifier does NOT make handles randomly invalid. How would that work? Either you have a bug or another driver is closing the handle behind your back. I would first assume your driver has the bug before assuming it is external. Do you pass the handle value to another driver?

d

debt from my phone

From: Ami Awbadhho
Sent: 1/7/2012 1:54 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] checks for invalid kernel handles

all,

our driver open file handles inside it. It uses zw calls a lot.
Everything works till we run verifier on this driver. we get invalid
handl BSODs in our zwClose calls.

after looking into the issue more, it looks like verifier randomly
makes some handles invalid, and hence we crash.

Is there a good way to ensure that the handles are valid? is there
somethign extra one needs to do other than the usual if conditional
check to see if this handle is valid before calling zwCalls?

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

3

You have to track the validity of handles yourself. As Doron say’s this
is not a verifier bug, this is your driver closing an invalid handle.

Don Burn
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

“Ami Awbadhho” wrote in message news:xxxxx@ntdev:

> all,
>
> our driver open file handles inside it. It uses zw calls a lot.
> Everything works till we run verifier on this driver. we get invalid
> handl BSODs in our zwClose calls.
>
> after looking into the issue more, it looks like verifier randomly
> makes some handles invalid, and hence we crash.
>
> Is there a good way to ensure that the handles are valid? is there
> somethign extra one needs to do other than the usual if conditional
> check to see if this handle is valid before calling zwCalls?

4

It might be useful to show how you create the handle. If you create the
handle and associate it with a process, this could have seriuos
consequences if the process terminates and you do not handle the
termination gracefully. But that’s the only idea that comes to mind right
now.
joe

all,

our driver open file handles inside it. It uses zw calls a lot.
Everything works till we run verifier on this driver. we get invalid
handl BSODs in our zwClose calls.

after looking into the issue more, it looks like verifier randomly
makes some handles invalid, and hence we crash.

Is there a good way to ensure that the handles are valid? is there
somethign extra one needs to do other than the usual if conditional
check to see if this handle is valid before calling zwCalls?

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer