Hi,
I have a volume filter driver in which I have registered for a reinitialize
routine using IoRegisterDriverReinitialization(). In the reinitialize
routine I am supposed to allocate memory and read some data from a file on
the volume. But when I read the file using ZwReadFile call, the system
bugchecks with DRIVER_CORRUPTED_EXPOOL (c5)
Here is a part of the stack trace after my reinitialize routine is called
STACK_TEXT:
f78f5a9c 8082616f 00000003 00000000 0000000a
nt!RtlpBreakWithStatusInstruction
f78f5ae8 80827044 00000003 00000008 80892115 nt!KiBugCheckDebugBreak+0x19
f78f5e80 8088bdd3 0000000a 00000008 00000002 nt!KeBugCheck2+0x5b2
f78f5e80 80892115 0000000a 00000008 00000002 nt!KiTrap0E+0x2a7
f78f5f4c 808928c3 808aeae0 00000000 862d44b8 nt!ExDeferredFreePool+0x10f
f78f5fa4 8081c131 862d44b8 00000000 8619be50 nt!ExFreePoolWithTag+0x57f
f78f5fc0 808216a8 862d44b8 862d44b8 00000103 nt!IopFreeIrp+0xe9
f78f6010 808f47d3 862d44f8 f78f6054 f78f604c nt!IopCompleteRequest+0x3be
f78f6038 808f196b 861fc020 00000000 8619be50
nt!IopSynchronousServiceTail+0x147
f78f60d0 80888c6c 8000044c 00000000 00000000 nt!NtReadFile+0x5cf
f78f60d0 8082ece5 8000044c 00000000 00000000 nt!KiFastCallEntry+0xfc
f78f616c f70ff0d8 8000044c 00000000 00000000 nt!ZwReadFile+0x11
f78f61a4 f71024a8 8000044c 86008000 00001000 VTrack!CtReadFile+0x38
f78f6238 f7103a84 864e3018 00000000 864e3178 VTrack!CtLoadMapFile+0x6b8
f78f6674 f70fdebd 864e3018 01000020 864e3178 VTrack!CtFsReady+0x504
f78f66a0 808f3f8d 862689c0 00000000 00000001 VTrack!VtReinitialize+0xfd
f78f66bc 808f6240 f78f675c 00000000 00000000
nt!IopCallDriverReinitializationRoutines+0x3b
f78f66d4 808f9395 80000430 f78f675c f78f67d8 nt!IopLoadUnloadDriver+0x66
f78f6750 80888c6c f78f67e4 f78f67ec 8082e5dd nt!NtLoadDriver+0x143
f78f6750 8082e5dd f78f67e4 f78f67ec 8082e5dd nt!KiFastCallEntry+0xfc
f78f67cc f76a9691 f78f67e4 f769f1b4 f769eaec nt!ZwLoadDriver+0x11
f78f67ec f76b01a7 f769eaec f78f6810 f769f1b4 WDFLDR!ReferenceVersion+0xaf
f78f681c f769dc1f 8630a358 f769f1b4 f769eaec WDFLDR!WdfVersionBind+0x67
…
Am I not supposed to use Zw-calls inside the reinitialize routine? Because i
checked the buffer and the handle, they seemed to be OK. Is it that the file
system is not fully initialized in the reinitialize callback, so the driver
is forbidden to any Zw-calls from there? In that case what is the earliest
instance in the boot process when it is safe to do Zw-calls for reading from
a file?
Thanks,
-Nitesh