MDL Leak -- KDMF Upper Filter Driver

NTDEV
1

Is it ever the case that you’d have free the MDL chain for a KDMF upper filter driver?

If one’s KDMF filter driver created it’s own WDFREQUEST and sent a read or write down the stack and it’s completed to back to the same filter driver? I ask, as I’ve got huge MDL leak and I never explicitly allocated any MDL’s in my KDML driver, but I can see them created by ntIoAllocateMdl() when, for instance my driver calls WdfIoTargetFormatRequestForWrite(). While it’s possible I missed it, but I never saw the corresponding nt!IoFreeMdl() call.

I’ve seen Doran’s FreeMdlChain() example for WDM drivers, but I suspect that KDMF differs in that it might be tracking MDL’s implicitly created?

Thanks very much for any hints or suggestions.
Mjd

2

Some follow-on information.

I’m starting to wonder if this might be related to mixing of WDM vs KDMF lookaside lists in a KDMF driver? Currently I’m using ExInitializeLookasideListEx(), ExAllocatePoolWithQuotaTag() and
ExAllocatePoolWithTag().

Should I instead be using WdfLookasideListCreate(), WdfMemoryCreateFromLookaside() and WdfObjectDelete()?

Many thanks. -mjd

3

How are you using the memory? Are you rolling your own PIRPs (vs WDFREQUESTs?)? It really shouldn’t matter if you are using a KMDF or WDM lookaside wrt MDLs

d

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Tuesday, May 03, 2011 7:20 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] MDL Leak – KDMF Upper Filter Driver

Some follow-on information.

I’m starting to wonder if this might be related to mixing of WDM vs KDMF lookaside lists in a KDMF driver? Currently I’m using ExInitializeLookasideListEx(), ExAllocatePoolWithQuotaTag() and
ExAllocatePoolWithTag().

Should I instead be using WdfLookasideListCreate(), WdfMemoryCreateFromLookaside() and WdfObjectDelete()?

Many thanks. -mjd

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

4

Doran:

I’m using WDFREQUEST’s, but re-using these requests on writes only after:
(1) An asynchronous write has completed back to the filter driver, -OR- the original WdfRequestSend() call has failed -AND-
(2) Called WdfObjectDelete() on the associated WDFMEMORY object -AND-
(3) Called ExFreeToLookasideListEx on the associated look-aside buffer -AND- finally
(4) Called WdfRequestReuse() on the WDFREQUEST.

The read path has the same conditions, except that it reuses the original read buffer, and therefore doesn’t allocate, or free a look-aside buffer [step (3) above].

I preallocate a bunch of WDFREQUESTS at boot time and keep these in pool, they are shared by the same Io Target for both reads and writes.

Thanks very much for your help,
mjd

5

I found the source of my MDL leak.

My I/O completion routine previously handled the Request (aka IRP) as follows:

  • check status
  • check length against expected length
  • WdfIoTargetFormatRequestForWrite(IoTarget, Request, NULL, NULL, NULL);
  • WdfObjectDelete(MemoryObj);
  • WdfObjectDelete(Request);
  • other cleanups (free my buffer, etc)

New handling:

  • check status
  • check length against expected length
  • WdfRequestReuse(Request, &params);
  • WdfObjectDelete(MemoryObj);
  • WdfObjectDelete(Request);
  • other cleanups (free my buffer, etc)

The problem appears to be a huge mis-understanding on my part. I.e. my use of WdfIoTargetFormatRequestForWrite() to disassociate the Request from the MemoryObj attached buffer, rather than using WdfRequestReuse().

Does one typically call WdfRequestReuse() prior to deleting an internal Request that was created and completed with the driver or filter driver context? I.e. it is not WdfRequestComplete()'ed back to the Windows I/O manager.

Many thanks. mjd