Memory leak in minifilter driver

I am allocating memory in PostCreate and PreRead callback routines in my minifilter driver and freeing the same while DriverUnload callback routine. As i have to use that memory i can deallocate it only at DriverUnload and can’t free it just before completing PostCreate and PreRead operations.

Now the question is this approach of allocating memory in a one callback routine and then freeing it in another right?

I have verified the driver with driver verifier and the driver crashes and the windbg tells that there is a memory leak.

Is it that i have forgotten to free some memory or my approach is wrong? In case my approach is wrong can anybody suggest some better way of doing the same thing.

I am using ExAllocatePoolWithTag and ExFreePoolWithTag for the purpose.

See comments inline:

I am allocating memory in PostCreate and PreRead callback routines in my
minifilter driver and freeing the same while DriverUnload callback routine. As i
have to use that memory i can deallocate it only at DriverUnload and can’t
free it just before completing PostCreate and PreRead operations.

Generally it is a good idea to insert the allocated memory in some context (stream, stream handle, instance, volume) to which it is associated. And this memory should be freed in the context cleanup routine for that context type.

Now the question is this approach of allocating memory in a one callback
routine and then freeing it in another right?
 
There is no problem with this approach. Infact, this becomes a requirement in some scenarios.

I have verified the driver with driver verifier and the driver crashes and the
windbg tells that there is a memory leak.

Try to find out what memory has not been freed. You get sufficient information in Windbg to find out what leaks have been there.

Is it that i have forgotten to free some memory or my approach is wrong? In
case my approach is wrong can anybody suggest some better way of doing the same
thing.

You have forgotten to free that memory. Still i would repeat that consider associating as much allocated memory as possible with particular context so that you can keep track of them in a better way.
 
Regards,
Ayush Gupta

Did you know? You can CHAT without downloading messenger. Go to http://in.webmessenger.yahoo.com/

>

Now the question is this approach of allocating memory in a one callback routine
and then freeing it in another right?

This is OK, but allocating in preRead and freeing in unload, does not sound so good. Imagine that the UNLOAD routine will not get called at all. What is the user never wants to unload the driver dinammicaly. Usually this never happens, the unload should be used for debugging purposes. Do global uninitializing in the regiestered shutdown routine, and I would suggest allocating and processing as much as you can in CREATE and deallocating and local uninitialize in CLEANUP and CLOSE.
Good luck.