Hi,
I’m stumped by an odd crash (see below) that occurs when
PsTerminateSystemThread is called from within a thread I created within my
filter driver. The thread terminates when a flag is set from within my
IRP_MJ_CLOSE processing. The thread creation code called during
IRP_MJ_CREATE looks like:
// :
// Init abort handling
pDevExt->bAbortThread = FALSE;
KeInitializeEvent(&pDevExt->eventAbort, NotificationEvent, FALSE);
// Startup the kernel thread
ntStatus = PsCreateSystemThread(&hThread, (ACCESS_MASK)0,
NULL, (HANDLE)0, NULL, JCSerialThreadMain, pDevExt);
if (!NT_SUCCESS(ntStatus))
goto ZB_OPEN_EXIT;
// Convert the Thread object handle into a pointer to the
// Thread object itself. Then close the handle.
ObReferenceObjectByHandle(hThread, THREAD_ALL_ACCESS, NULL,
KernelMode, &pDevExt->threadWorker, NULL);
ZwClose(hThread);
// :
The thread itself is structured like this:
VOID JCSerialThreadMain(PVOID Context)
{
// :
// :
while (TRUE) // Loop until thread suicide is requested
{
if (pDevExt->bAbortThread)
break; // Abort the thread
//:
//:
}
JCSerialDump(JCSTRACECALLS, (“JCSerial: JCSerialThreadMain - End\n”));
PsTerminateSystemThread(STATUS_SUCCESS);
}
Finally the IRP_MJ_CLOSE code looks like:
// Set the abort flag and trigger the sync event used
// by the worker thread.
pDevExt->bAbortThread = TRUE;
KeSetEvent(&pDevExt->eventAbort, IO_NO_INCREMENT, TRUE);
// Wait for the thread to die
KeWaitForSingleObject(pDevExt->threadWorker, Executive, KernelMode, FALSE,
NULL);
// The thread is dead
ObDereferenceObject(pDevExt->threadWorker); // Release hold on object
From looking around this technique is pretty standard stuff. The crash is
somewhat random in occurence. Has anyone seen anything like this? Can
someone shed some light what PsUnlockProcess does?
Dale
Access violation - code c0000005 (!!! second chance !!!)
nt!PsUnlockProcess+47:
806647d3 ff8180000000 inc dword ptr [ecx+0x80]
kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Unknown bugcheck code (0)
Unknown bugcheck description
Arguments:
Arg1: 00000000
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000
Debugging Details:
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x0
LAST_CONTROL_TRANSFER: from 806657fc to 806647d3
STACK_TEXT:
f3247cc0 806657fc 00000001 00000000 00000000 nt!PsUnlockProcess+0x47
f3247d74 80581359 00000000 f3247da8 eb333e58 nt!PspExitThread+0x4a2
f3247d80 eb333e58 00000000 20000000 20000000
nt!PsTerminateSystemThread+0x31
f3247da8 805811e6 81eda648 00000000 00000000
jcserial!JCSerialThreadMain+0x32a [d:\daleprojs\jcserial\jcserial.c @
1019]
f3247ddc 8059bd4a eb333b2e 81eda648 00000000
nt!PspSystemThreadStartup+0x54
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
FOLLOWUP_IP:
jcserial!JCSerialThreadMain+32a
eb333e58 8be5 mov esp,ebp
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: jcserial!JCSerialThreadMain+32a
MODULE_NAME: jcserial
IMAGE_NAME: jcserial.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 3d778508
STACK_COMMAND: kb
BUCKET_ID: 0x0_jcserial!JCSerialThreadMain+32a
