Hi!
I’m developing a cryptography file system filter, and I’m having some
troubles while testing with Driver Verifier.
Sometimes, it fires the IRQL_NOT_LESS_OR_EQUAL BugCheck in the write
completion routine, while reading Irp->MdlAddress. Here’s the transcription:
kd> !analyze -v
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
Arg1: fa6e5fe4, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: f1c577e4, address which referenced memory
READ_ADDRESS: fa6e5fe4 Special pool
CURRENT_IRQL: 2
FAULTING_IP:
–> NewMdl = Irp->MdlAddress; <–
f1c577e4 8b481c mov ecx,[eax+0x1c]
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xD1
LAST_CONTROL_TRANSFER: from 8042bcb9 to 80452e70
STACK_TEXT:
f2023a80 8042bcb9 00000003 f2023ac8 fa6e5fe4
nt!RtlpBreakWithStatusInstruction
f2023ab0 8042c068 00000003 fa6e5fe4 f1c577e4 nt!KiBugCheckDebugBreak+0x31
f2023e38 80464b1f 00000000 fa6e5fe4 00000002 nt!KeBugCheckEx+0x37b
f2023e38 f1c577e4 00000000 fa6e5fe4 00000002 nt!KiTrap0E+0x27c
f2023eec 8052cc3c fd92f360 fa6d9e70 fa6e5fc8 mydriver!MyWriteCompletion+0x64
<<—
f2023f34 fd5cfb47 fd763368 fd5cf032 fd763368
nt!IovSpecialIrpCompleteRequest+0x18c
f2023f70 fd5cdc03 fd9344a8 fd763368 f2023fdf SCSIPORT!SpCompleteRequest+0x55
f2023f70 fd5cdc03 fd9344a8 fd763368 f2023fdf
SCSIPORT!ScsiPortCompletionDpc+0x2cd
f2023fe0 80460bd4 fd934464 fd9343f0 00000000
SCSIPORT!ScsiPortCompletionDpc+0x2cd
f2023ff4 80403a82 f206b8a8 00000000 00000000 nt!KiRetireDpcList+0x30
kd> !pool 0xfa6e5fe4
fa6e5000: Unable to get contents of special pool block
Why I can’t get info about a special pool allocation?
Sometimes, the driver creates a new MDL in the IRP_MJ_WRITE routine, but
it’s allocated from the non-paged pool. Why the error in memory access?
Thanks
Strauss