Copy an IRP with SRB and send to lower-level driver

NTDEV
1

Well, I'm working on a lower-level disk filter driver. This driver enhances the disk throughput a write-back cache for a specific disk, actually all write operations
are not written to the target disk at all but just to the cache and flush to a file when the cache overflow.

Now I'd like to also send the write IRPs to the target disk as well. The original IRP is completed by our disk filter driver after writing to cache successfully.
I do the thing like below:

  1. Copy the orignal IRP.
    pIrp = IoAllocateIrp(DeviceObject->StackSize, FALSE);
    if (!pIrp)
    {
    return STATUS_INSUFFICIENT_RESOURCES;
    }

    status = CopySrb(Irp, &srb);
    if (!NT_SUCCESS(status))
    {
    return status;
    }

    SrbSetOriginalRequest(srb, pIrp);
    IoSetNextIrpStackLocation(pIrp);

    pOriginalSp = IoGetCurrentIrpStackLocation(Irp);
    pCurrentSp = IoGetCurrentIrpStackLocation(pIrp);
    RtlCopyMemory(pCurrentSp, pOriginalSp, FIELD_OFFSET(IO_STACK_LOCATION, CompletionRoutine));

    PVOID dataBuffer = SrbGetDataBuffer(srb);
    IoAllocateMdl(dataBuffer, SrbGetDataTransferLength(srb), FALSE, FALSE, pIrp);
    if (!pIrp->MdlAddress)
    {
    status = STATUS_INSUFFICIENT_RESOURCES;
    break;
    }

    try
    {
    MmProbeAndLockPages(pIrp->MdlAddress, KernelMode, IoWriteAccess);
    }
    except(EXCEPTION_EXECUTE_HANDLER)
    {
    status = GetExceptionCode();
    break;
    }

    pIrp->Cancel = FALSE;
    pIrp->CancelRoutine = NULL;
    pIrp->UserBuffer = NULL;
    pIrp->UserEvent = NULL;
    pIrp->AssociatedIrp.SystemBuffer = NULL;
    pIrp->Flags = IRP_NOCACHE;
    pIrp->RequestorMode = KernelMode;
    pIrp->Tail.Overlay.Thread = KeGetCurrentThread();
    RtlZeroMemory(&pIrp->IoStatus, sizeof(IO_STATUS_BLOCK));

  2. Add the copied IRP into a CSQ.

  3. Create a thread by PsCreateSystemThread to handle the queued IRPs

  4. In the thread sends the IRP to lower-level driver like below:
    IoCopyCurrentIrpStackLocationToNext(Irp);
    IoSetCompletionRoutine(
    Irp,
    DoubleWriteCompletionRoutine,
    NULL,
    TRUE,
    TRUE,
    TRUE);
    return IoCallDriver(deviceExtension->TargetDeviceObject, Irp);

During debugging, the following error consistently occurs after a period of time. Any guidance on resolving this issue would be greatly appreciated!

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common BugCheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80359214098, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffb68d00000010, Parameter 1 of the exception

STACK_TEXT:
ffff8001433718d8 fffff80356567422 : ffff800143371a40 fffff8035628e920 ffff800143351180 ffffffffc0000001 : nt!DbgBreakPointWithStatus
ffff8001433718e0 fffff80356566ae3 : ffff800100000003 ffff800143371a40 fffff8035642fdf0 000000000000001e : nt!KiBugCheckDebugBreak+0x12
ffff800143371940 fffff80356415ef7 : fffffb05aee5fc00 fffff803560ed884 fffffb05aee5ee78 0000000000000000 : nt!KeBugCheck2+0xba3
ffff8001433720b0 fffff8035654752a : 000000000000001e ffffffffc0000005 fffff80359214098 0000000000000000 : nt!KeBugCheckEx+0x107
ffff8001433720f0 fffff8035642148f : ffff800143372900 ffff8001433721c0 fffff80356000000 fffff8035641adfe : nt!HvlpVtlCallExceptionHandler+0x22
ffff800143372130 fffff8035635fc73 : fffffb05aee5f950 fffffb05aee5ee78 fffff8035641adfe fffff803560ed884 : nt!RtlpExecuteHandlerForException+0xf
ffff800143372160 fffff803562b0aee : ffffffffffffffff fffffb05aee5ef20 fffffb05aee5ef20 ffff800143372900 : nt!RtlDispatchException+0x2f3
ffff8001433728d0 fffff80356417012 : 894de44b8d4dd04b 894de24b8d4dc84b 894de04b8d4dc04b 894dde4b8d4db84b : nt!KiDispatchException+0x1ae
ffff800143372fb0 fffff80356416fe0 : fffff8035642be75 0000000000000000 fffff80356643c32 0000000000000000 : nt!KxExceptionDispatchOnExceptionStack+0x12
fffffb05aee5ed38 fffff8035642be75 : 0000000000000000 fffff80356643c32 0000000000000000 fffff80300000000 : nt!KiExceptionDispatchOnExceptionStackContinue
fffffb05aee5ed40 fffff80356427163 : fffff8035921edf0 fffff80356aabae0 ffffb68d1f66dc10 0000000000000000 : nt!KiExceptionDispatch+0x135
fffffb05aee5ef20 fffff80359214098 : ffffb68d2a686b04 0000000000000000 ffffb68d2a686af0 ffffb68d17db51a0 : nt!KiPageFault+0x463
fffffb05aee5f0b0 fffff80359211aec : ffffb68d17d82040 0000000000989680 ffffb68d17db31a0 ffffb68d2a686b00 : storport!StorpTelemetryCollectPerfData+0xbd8
fffffb05aee5f1f0 fffff8035921ee7c : ffffb68d00400a02 ffff800143351180 fffff78000000320 0000000000000000 : storport!RaidUnitCompleteRequest+0x37c
fffffb05aee5f370 fffff803563332cc : 0000000000000001 0000000000000001 fffffb0500000000 0000000000000002 : storport!RaidpAdapterRedirectDpcRoutine+0x8c
fffffb05aee5f410 fffff803563322d4 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiExecuteAllDpcs+0x42c
fffffb05aee5f950 fffff8035641adfe : 0000000000000000 ffff800143351180 ffffb68d16b98080 ffffb68d1b229080 : nt!KiRetireDpcList+0x1b4
fffffb05aee5fc00 0000000000000000 : fffffb05aee60000 fffffb05aee59000 0000000000000000 0000000000000000 : nt!KiIdleLoop+0x9e

SYMBOL_NAME: storport!StorpTelemetryCollectPerfData+bd8
MODULE_NAME: storport
IMAGE_NAME: storport.sys