Hello Gurus,
I am terribly stuck with this bug.
I am getting this bug in my Filter Driver. The Debugger says that the
driver which completed the IRP Packet is ntoskrnl.exe .
The last comments which I see are as highlighted in Red described below
in Pseudo code .
So I completed the IRP meant for ntoskrnl.exe. But this Bug is only when
I open a Heavy WebPage in Internet explorer that is : some activity
which requires heavy CREAT Processing with Asynchronous threads .
Point to be noted is I seen this Dbgprint of IRP completion many a
times before the crash i.e. It produced no crash when my driver
completed the packet may a times before .
I have read if returning STATUS_MORE_PROCESSING_REQUIRED in completion
routine , we should either return status pending with marking IRP
Pending or I should make the routine Synchronous.
Can this problem be solved buy making the routine Synchronous ?.
Can you guide me if my flow as described below in Pseudo code is correct
? .
What can be the cause of this bug in my flow .
I can provide you the crash dump details .
Any suggestions ??
Regards,
Anurag
CREAT Dispatch Routine
Control for filter :
Call SpyPassThrough Routine // as shown below
ntStatus =
KeWaitForSingleObject(&kEvent,Executive,KernelMode,FALSE,NULL);
if(ntStatus == STATUS_SUCCESS )
{
irpStack = IoGetCurrentIrpStackLocation( Irp );
Get File name from irpStack and File Object and Store in
Unicode String
If one of Registry files
{
Acquire Spinlock
Search if file is in Registry link list.
If file exist in link list
{
Release Spin Lock
Irp->IoStatus.Information = IO_REPARSE;
IoCompleteRequest(Irp,IO_NO_INCREMENT);
return STATUS_REPARSE;
}
}
Release Spin Lock
If File is one from My Buffer
{
DbgPrint(“\nCR5:Before Completing IRP:%x”,Irp);
IoCompleteRequest(Irp,IO_NO_INCREMENT);
DbgPrint(“\nCR5:After Completing IRP:%x”,Irp);
ntStatus = Irp->IoStatus.Status;
return ntStatus;
}
If Create Link List is empty // inserting first element
{
Add the file name in Link List using Spin Locks
If file is one of my files, log files using ZWCreate Function
DbgPrint(“\nCR4:Before Completing IRP:%x”,Irp);
IoCompleteRequest(Irp,IO_NO_INCREMENT);
DbgPrint(“\nCR4:After Completing IRP:%x”,Irp);
ntStatus = Irp->IoStatus.Status;
return ntStatus;
}
Acquire Spin Lock
If Create Link List has elements
{
If this filename found in Create Link List
{
KeReleaseSpinLock(&CreateListSpinLock,OldIrql);
DbgPrint(“\nCR3:Before Completing IRP:%x”,Irp);
IoCompleteRequest(Irp,IO_NO_INCREMENT);
DbgPrint(“\nCR3:After Completing IRP:%x”,Irp);
ntStatus = Irp->IoStatus.Status;
return ntStatus;
}
}
KeReleaseSpinLock(&CreateListSpinLock,OldIrql);
//Since failed in above conditions
Insert Filename in Link List Using Spin Locks
If file is one of my files
{
log files using ZWCreate Function
DbgPrint(“\nCR2:Before Completing IRP:%x”,Irp);
IoCompleteRequest(Irp,IO_NO_INCREMENT);
DbgPrint(“\nCR2:After Completing IRP:%x”,Irp);
ntStatus = Irp->IoStatus.Status;
return ntStatus;
}
DbgPrint(“\nCR1:Before Completing IRP:%x”,Irp);
IoCompleteRequest(Irp,IO_NO_INCREMENT);
DbgPrint(“\nCR1:After Completing IRP:%x”,Irp);
ntStatus = Irp->IoStatus.Status;
return ntStatus;
}
return ntStatus;
-------------------SpyPasThrough Routine---------------------
IoCopyCurrentIrpStackLocationToNext( Irp );
IoSetCompletionRoutine(Irp,MyCompletionToWait,pContext,TRUE,TRUE,TRUE);
status = IoCallDriver(
((PFILESPY_DEVICE_EXTENSION)DeviceObject->DeviceExtension)->AttachedToDe
viceObject, Irp ); return status;
--------Completion Routine : MyCompletionToWait
KeSetEvent(pkEvent,0,FALSE );
DbgPrint(“\nMyCompletionToWait End”);
return STATUS_MORE_PROCESSING_REQUIRED;