memory leaks in kernel mode

NTDEV
1

Hi,

Could somebody recommend me a good tool/technic to deal with memory leaks
in kernel mode apps/drivers.

Thanks in advance!

You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

2

Poolmon will help, as will driver verifier. All of your memory allocations
must use tags. Each different kind of allocation you make should use a
different tag. I have no idea what a kernel mode app is. Numega has a pretty
nifty tool for user mode apps that will catch most dreadful stuff.

-----Original Message-----
From: xxxxx@yahoo.com [mailto:xxxxx@yahoo.com]
Sent: Wednesday, October 03, 2001 5:36 AM
To: NT Developers Interest List
Subject: [ntdev] memory leaks in kernel mode

Hi,

Could somebody recommend me a good tool/technic to deal with memory leaks
in kernel mode apps/drivers.

Thanks in advance!

You are currently subscribed to ntdev as: xxxxx@stratus.com To
unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

3

You can use our BoundsChecker Driver Edition for kernel mode work. If you
have DriverStudio 2.5, you can do it remote as well as locally.

A good way to do it is to write it in C++, making sure you don’t allocate
any memory except by issuing “new” statements, and making sure that your
destructors delete every object that must be deleted. If you use our
DriverWorks or DriverNetworks, our sample source code will give you a fair
amount of protection against this kind of problem.

And a “kernel mode app” might be, for example, much of an OpenGL ICD. Unless
of course you’re into direct rendering, which drives the iron directly from
user space.

Hope this helps!

Alberto.

-----Original Message-----
From: Roddy, Mark [mailto:xxxxx@stratus.com]
Sent: Wednesday, October 03, 2001 10:04 AM
To: NT Developers Interest List
Subject: [ntdev] RE: memory leaks in kernel mode

Poolmon will help, as will driver verifier. All of your memory allocations
must use tags. Each different kind of allocation you make should use a
different tag. I have no idea what a kernel mode app is. Numega has a pretty
nifty tool for user mode apps that will catch most dreadful stuff.

-----Original Message-----
From: xxxxx@yahoo.com [mailto:xxxxx@yahoo.com]
Sent: Wednesday, October 03, 2001 5:36 AM
To: NT Developers Interest List
Subject: [ntdev] memory leaks in kernel mode

Hi,

Could somebody recommend me a good tool/technic to deal with memory leaks
in kernel mode apps/drivers.

Thanks in advance!

You are currently subscribed to ntdev as: xxxxx@stratus.com To
unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntdev as: xxxxx@compuware.com
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

4

NuMega’s Bounds Checker (driver edition) could be used for this purpose. It
also comes along with DriverStudio package.

Regards,
Parswanath Dhanadevan

-----Original Message-----
From: xxxxx@yahoo.com [mailto:xxxxx@yahoo.com]
Sent: Wednesday, October 03, 2001 3:06 PM
To: NT Developers Interest List
Subject: [ntdev] memory leaks in kernel mode

Hi,

Could somebody recommend me a good tool/technic to deal with memory leaks
in kernel mode apps/drivers.

Thanks in advance!

You are currently subscribed to ntdev as: xxxxx@Satyam.com
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

5

Another very rough method -

Take few variables in DeviceExtension - one for each different type of
runtime memory you allocate - increment it for every allocation and
decrement with de-allocation. Made few operations with your device and in
the end the value for the variables should be what you have initialized it
before.

  • Vipul

-----Original Message-----
From: Roddy, Mark [mailto:xxxxx@stratus.com]
Sent: Wednesday, October 03, 2001 7:04 AM
To: NT Developers Interest List
Subject: [ntdev] RE: memory leaks in kernel mode

Poolmon will help, as will driver verifier. All of your memory allocations
must use tags. Each different kind of allocation you make should use a
different tag. I have no idea what a kernel mode app is. Numega has a pretty
nifty tool for user mode apps that will catch most dreadful stuff.

-----Original Message-----
From: xxxxx@yahoo.com [mailto:xxxxx@yahoo.com]
Sent: Wednesday, October 03, 2001 5:36 AM
To: NT Developers Interest List
Subject: [ntdev] memory leaks in kernel mode

Hi,

Could somebody recommend me a good tool/technic to deal with memory leaks
in kernel mode apps/drivers.

Thanks in advance!

You are currently subscribed to ntdev as: xxxxx@stratus.com To
unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntdev as: xxxxx@fvc.com
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

6

!poolused in WinDbg seems to be the best.

----- Original Message -----
From:
To: “NT Developers Interest List”
Sent: Wednesday, October 03, 2001 9:35 AM
Subject: [ntdev] memory leaks in kernel mode

> Hi,
>
> Could somebody recommend me a good tool/technic to deal with memory leaks
> in kernel mode apps/drivers.
>
> Thanks in advance!
>
> —
> You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
>

—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

7

Hi,

Could somebody recommend me a good tool/technic to deal with memory leaks
in kernel mode apps/drivers.

in the last week this was my job and I have a good solution. Forget
all the tools, no one og them will very usefull. I have used the MFC
macro do make my own memory tracking. The idea, for each memory
allocation I track the file name,source code line name, pool type,
memory and length. When the program is unloaded I show all memory
leaks and knows what is wrong.

here some suggestion for C++.

#if defined (F_TRACK_MEMORY)
#undef THIS_FILE
static char THIS_FILE = FILE;
#define NEW new(NonPagedPool,THIS_FILE,LINE)
#else
#define NEW new(NonPagedPool)
#endif

//---------------------------------------------------------------------------
//
//---------------------------------------------------------------------------
void * __cdecl operator
new(unsigned int nSize, POOL_TYPE iType, PCHAR pszFileName,int iLine)
{
PVOID p;

p = nSize ? ExAllocatePoolWithTag(iType, nSize, PoolTag) : NULL;

if ( p )
{
// register here all allocations like …
memoryTracker.addBuffer( p, nSize , iType, pszFileName, iLine);
}

return p;
}

elli

You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

8

BoundsChecker from DriverStudio also gives you this info when driver is
unloaded (leaks, size, tags and where it was allocated). The advantage is
that you can check release code this way. And you may avoid C++ :wink:

Best regards,

Michal Vodicka
Veridicom
(RKK - Skytale)
[WWW: http://www.veridicom.com , http://www.skytale.com]

From: Mathias Ellinger[SMTP:xxxxx@Ellisoft.de]
Reply To: NT Developers Interest List
Sent: Thursday, October 04, 2001 9:52 AM
To: NT Developers Interest List
Subject: [ntdev] Re: memory leaks in kernel mode

Hi,

>Could somebody recommend me a good tool/technic to deal with memory leaks
>in kernel mode apps/drivers.

in the last week this was my job and I have a good solution. Forget
all the tools, no one og them will very usefull. I have used the MFC
macro do make my own memory tracking. The idea, for each memory
allocation I track the file name,source code line name, pool type,
memory and length. When the program is unloaded I show all memory
leaks and knows what is wrong.

here some suggestion for C++.

#if defined (F_TRACK_MEMORY)
#undef THIS_FILE
static char THIS_FILE = FILE;
#define NEW new(NonPagedPool,THIS_FILE,LINE)
#else
#define NEW new(NonPagedPool)
#endif

//------------------------------------------------------------------------

//
//------------------------------------------------------------------------

void * __cdecl operator
new(unsigned int nSize, POOL_TYPE iType, PCHAR pszFileName,int iLine)
{
PVOID p;

p = nSize ? ExAllocatePoolWithTag(iType, nSize, PoolTag) : NULL;

if ( p )
{
// register here all allocations like …
memoryTracker.addBuffer( p, nSize , iType, pszFileName, iLine);
}

return p;
}

elli

You are currently subscribed to ntdev as: xxxxx@rkk.cz
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

9

Last, but not least, is designing the driver to reduce the probability of leaks, by:

  1. allocating less things, e.g., if you only need one instance of something, embed it in the device extension, rather than
    allocating and freeing it all the time. This will also perform better.

  2. If you only need n of something, build a private look aside list, and allocate everything up front.

  3. Avoid, if you can, the Microsoft typeless linked lists (e.g., RemoveEntryList). Use a typesafe package. In C/C++ you can
    easily create macros that do typical list manipulations without loosing type safety. In C++, there are fancy ways of using
    template classes to create type safe link lists. For each type Foo you should have a ListOfFoo (and perhaps a ListOfFooByLink
    using different link fields). [ Note, however, that making the link field a template parameter that is a pointer to member is a
    bit too fancy for VC++ 6.0. ]

  4. Think, when you are writing the code, about what coding paradigm will let you read the code, and validate that you are safe
    from leaks. This can yield code that you are sure cannot have leaks. Then think about the paradigm you should use (i.e., tags)
    that will help you diagnose where the leak is.

  5. Think, when you are writing the code, about what will happen if ExAllocatePool returns NULL. Will your driver run or crash?
    Having written an OS that survived running out of kernel memory, I guarantee this is possible. If you force yourself to write
    code that handles this case, you will find that its too hard, and instead writes code that avoids the allocation (i.e., #1).

  6. Think, read your code again, and think. My old-foggie brand of conservative programming says that you should not ever try to
    run code you just wrote unless you are sure that it does have leaks (or any other bugs, for that matter). Then when you hit the
    lab, your bug population contains only the one liners that you were unable to see and the cases you were completely clueless
    about.

-DH

PS. Hey, while I’m on my soapbox, why are so many programmers, when they find a bug of some class, incapable of grep’ing for
other instances of the same class? Instead, they seem to like to debug them one at a time.

----- Original Message -----
From: “Roddy, Mark”
To: “NT Developers Interest List”
Sent: Wednesday, October 03, 2001 10:03 AM
Subject: [ntdev] RE: memory leaks in kernel mode

> Poolmon will help, as will driver verifier. All of your memory allocations
> must use tags. Each different kind of allocation you make should use a
> different tag. I have no idea what a kernel mode app is. Numega has a pretty
> nifty tool for user mode apps that will catch most dreadful stuff.
>
> -----Original Message-----
> From: xxxxx@yahoo.com [mailto:xxxxx@yahoo.com]
> Sent: Wednesday, October 03, 2001 5:36 AM
> To: NT Developers Interest List
> Subject: [ntdev] memory leaks in kernel mode
>
>
> Hi,
>
> Could somebody recommend me a good tool/technic to deal with memory leaks
> in kernel mode apps/drivers.
>
> Thanks in advance!
>
> —
> You are currently subscribed to ntdev as: xxxxx@stratus.com To
> unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
> —
> You are currently subscribed to ntdev as: xxxxx@syssoftsol.com
> To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

10

> in the last week this was my job and I have a good solution. Forget

all the tools, no one og them will very usefull. I have used the MFC
macro do make my own memory tracking.

A good idea, but what’s wrong with !poolused?
The thing is that the Ex pool engine already does this for you - you must just switch the global flag on.

Max

You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com