Is there any flag indicating an IRP is already completed?

NTFSD
1

Hi all

Is there any flag indicating an IRP is already completed?
Thanx in advance.

2

Well there’s this great big blue screen that’s a pretty good indication an
IRP has already been completed.

Think about your question. Just how would you test that flag? Once an IRP
has been completed it MUST be considered invalid, so there is no way that
you can test that flag with crashing the system. To get to that flag you
have to go through an invalid pointer, or a pointer to memory that has been
reallocated and re-used so that now what ever flag you’re looking at is
totally meaningless.

–
Gary G. Little
Have Computer, Will Travel …
909-698-3191
909-551-2105
http://www.wd-3.com

wrote in message news:xxxxx@ntfsd…
>
> Hi all
>
> Is there any flag indicating an IRP is already completed?
> Thanx in advance.
>
>

3

Very well. OK, I have a code like:
__try
{
IoCallDriver(…);
}__except(…)
{
}

What should I do in the exception handler w/o knowing have the target
driver already completed request or not? I get that BSOD while trying to
complete an IRP referencing by a valid pointer. The I/O manager somehow
determines this particular IRP is already completed. Obviously, it has
some internal table.
Why not to have a flag indicating the same thing since there’s a delay
between the actual IRP completion (return of IRP to I/O manager) and the
memory buffer re-usage?

Well there’s this great big blue screen that’s a pretty good indication an
IRP has already been completed.

Think about your question. Just how would you test that flag? Once an IRP
has been completed it MUST be considered invalid, so there is no way that
you can test that flag with crashing the system. To get to that flag you
have to go through an invalid pointer, or a pointer to memory that has been
reallocated and re-used so that now what ever flag you’re looking at is
totally meaningless.

–
Gary G. Little
Have Computer, Will Travel …
909-698-3191
909-551-2105
http://www.wd-3.com

wrote in message news:xxxxx@ntfsd…
> >
> > Hi all
> >
> > Is there any flag indicating an IRP is already completed?
> > Thanx in advance.
> >
> >

4

The problem at hand is how long do you suggest the Irp remain valid with
this flag set so that other drivers can observe it is completed?

Why not set a completion routine on the Irp and after you IoCallDriver
wait on some event that is set in your completion routine. Or why not do
the cleanup work in your completion routine? It is the completion
routine getting called that will signal to you that the Irp has been
completed.

Pete

Peter Scott
xxxxx@KernelDrivers.com
www.KernelDrivers.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@storactive.com
Sent: Thursday, April 10, 2003 10:08 AM
To: File Systems Developers
Subject: [ntfsd] Re: Is there any flag indicating an IRP is already
completed?

Very well. OK, I have a code like:
__try
{
IoCallDriver(…);
}__except(…)
{
}

What should I do in the exception handler w/o knowing have the target
driver already completed request or not? I get that BSOD while trying to
complete an IRP referencing by a valid pointer. The I/O manager
somehow
determines this particular IRP is already completed. Obviously, it has
some internal table.
Why not to have a flag indicating the same thing since there’s a delay
between the actual IRP completion (return of IRP to I/O manager) and the
memory buffer re-usage?

Well there’s this great big blue screen that’s a pretty good
indication an
IRP has already been completed.

Think about your question. Just how would you test that flag? Once an
IRP
has been completed it MUST be considered invalid, so there is no way
that
you can test that flag with crashing the system. To get to that flag
you
have to go through an invalid pointer, or a pointer to memory that has
been
reallocated and re-used so that now what ever flag you’re looking at
is
totally meaningless.

–
Gary G. Little
Have Computer, Will Travel …
909-698-3191
909-551-2105
http://www.wd-3.com

wrote in message
news:xxxxx@ntfsd…
> >
> > Hi all
> >
> > Is there any flag indicating an IRP is already completed?
> > Thanx in advance.
> >
> >

—
You are currently subscribed to ntfsd as: xxxxx@kerneldrivers.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

5

>Very well. OK, I have a code like:

__try
{
IoCallDriver(…);
}__except(…)
{
}

What should I do in the exception handler w/o knowing have the target
driver already completed request or not? I get that BSOD while trying to

Calling KeBugCheck from from the exception handler is the best thing to
do.
If you got there it means that underlying driver has a bug. Some exception
happened in it and the driver didn’t handle it. Underlying driver may
leave not only IRP not completed but also leave some other uncompleted
work, for example it may leave some resources or mutexes acquired. It may
also leave some inconsistent data that will lead to blue screen in future.
Also if IRP got completed, how are you going to get it’s status? You need
to know the status to return it from your dispatch routine.

Alexei.

6

You should never wrap IoCallDriver in an exception handler.
If there’s a bug in the driver you will catch it… And potentially
continue without halting the system.

Since you have no way of knowing whether the system is recoverable,
despite the bug in the driver, surprisingly enough,
it’s better to halt (bugcheck) than to continue running in a compromised
state.
Why? Kernel address space is shared.
Ravi

-----Original Message-----
From: xxxxx@storactive.com
[mailto:xxxxx@storactive.com]
Sent: Thursday, April 10, 2003 9:08 AM
To: File Systems Developers
Subject: [ntfsd] Re: Is there any flag indicating an IRP is already
completed?

Very well. OK, I have a code like:
__try
{
IoCallDriver(…);
}__except(…)
{
}

What should I do in the exception handler w/o knowing have the target
driver already completed request or not? I get that BSOD while trying to
complete an IRP referencing by a valid pointer. The I/O manager
somehow determines this particular IRP is already completed.
Obviously, it has some internal table. Why not to have a flag indicating
the same thing since there’s a delay between the actual IRP completion
(return of IRP to I/O manager) and the memory buffer re-usage?

Well there’s this great big blue screen that’s a pretty good
indication an IRP has already been completed.

Think about your question. Just how would you test that flag? Once an
IRP has been completed it MUST be considered invalid, so there is no
way that you can test that flag with crashing the system. To get to
that flag you have to go through an invalid pointer, or a pointer to
memory that has been reallocated and re-used so that now what ever
flag you’re looking at is totally meaningless.

–
Gary G. Little
Have Computer, Will Travel …
909-698-3191
909-551-2105
http://www.wd-3.com

wrote in message
> news:xxxxx@ntfsd…
> >
> > Hi all
> >
> > Is there any flag indicating an IRP is already completed? Thanx in
> > advance.
> >
> >

—
You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com