KeLeaveCriticalRegion of a terminated thread

NTDEV
1

Hi all,

I know that I must call KeLeaveCriticalRegion as many times I called
KeEnterCriticalRegion, but supposing that I called KeEnterCriticalRegion
from a thread that was terminated, can I call KeLeaveCriticalRegion from
callback routine registered by PsSetCreateThreadNotifyRoutine?

Thanks in advance,

Fernando Roberto da Silva.

http://driverentry.com.br http:</http:>

2

There is no “was terminated” in kernel mode. Kernel-mode threads die only by their own choice. Look at the signature for PsTerminateSystemThread:

NTSTATUS
PsTerminateSystemThread(
IN NTSTATUS ExitStatus);

You can only terminate the thread you are running on.

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Fernando Roberto
Sent: Monday, November 06, 2006 10:45 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] KeLeaveCriticalRegion of a terminated thread

Hi all,

I know that I must call KeLeaveCriticalRegion as many times I called KeEnterCriticalRegion, but supposing that I called KeEnterCriticalRegion from a thread that was terminated, can I call KeLeaveCriticalRegion from callback routine registered by PsSetCreateThreadNotifyRoutine?

Thanks in advance,

Fernando Roberto da Silva.

http://driverentry.com.br http:</http:>

Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

3

If I remember well critical regions are per thread kernel objects, so if the threads terminates, you probably don’t have such problem like calling KeleaveCriticalSection.

Hope it helps
GV

----- Original Message -----
From: Fernando Roberto
To: Windows System Software Devs Interest List
Sent: Monday, November 06, 2006 10:44 AM
Subject: [ntdev] KeLeaveCriticalRegion of a terminated thread

Hi all,

I know that I must call KeLeaveCriticalRegion as many times I called KeEnterCriticalRegion, but supposing that I called KeEnterCriticalRegion from a thread that was terminated, can I call KeLeaveCriticalRegion from callback routine registered by PsSetCreateThreadNotifyRoutine?

Thanks in advance,

Fernando Roberto da Silva.

http://driverentry.com.br

Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

4

If the callback routine registered is guaranteed to be called on the thread that is terminating, this /might/ work. The critical region count is kept in the thread object, so if you called KeLeaveCriticalRegion from a different thread, you will screw up both threads (the one where you called Enter() and the one where you called Leave()). Furthermore, termination of the thread might require an APC to be delivered and that APC could be pended unded the critical region count is zero.

d

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Fernando Roberto
Sent: Monday, November 06, 2006 10:45 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] KeLeaveCriticalRegion of a terminated thread

Hi all,
?
I know that I must call KeLeaveCriticalRegion as many times I called KeEnterCriticalRegion, but supposing that I called KeEnterCriticalRegion from a thread that was terminated, can I call KeLeaveCriticalRegion from callback routine registered by PsSetCreateThreadNotifyRoutine?
?
Thanks in advance,
Fernando Roberto da Silva.
http://driverentry.com.br
?

Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer