Please Refer this one: IRQL_NOT_LESS_OR_EQUAL

NTFSD
1

Hi All,
I am having IRQL_NOT_LESS_OR_EQUAL problem and I think its because of
bad pointer allocation.

I am making a link list whose elements are in NonPagedPool.
The structure being

typedef struct _DELFILES{
UNICODE_STRING DelFName;
struct _DELFILES* next;
}DELFILES, * PDELFILES;

NOW FROM THIS SMALL ROUTINE I WANT TO ASK

PDELFILES psElement = (PDELFILES) ExAllocatePoolWithTag(NonPagedPool,
sizeof(DELFILES), ‘1leD’);
FileObject = irpStack->FileObject;
FileName = &FileObject->FileName;
(&psElement->DelFName)->MaximumLength = FileName->MaximumLength + 2;
(&psElement->DelFName)->Buffer =
ExAllocatePoolWithTag(NonPagedPool,
(&psElement->DelFName)->MaximumLength,‘2leD’);

(I) If I am allocating memory like above,would it create a problem if this
linked list is populated extensively. And the linked list is accessed for
comparision very extensively.
(II)The various elements of this routine are later accessed in the
completion routine. I have taken appropriate synchronization steps but
still am getting IRQL_NOT_LESS_OR_EQUAL. Please Suggest.

Can stack memory also lead to error.

Thanks
Lalit.

2

Completion routines often run at DISPATCH_LEVEL. I
think it is more likely that you are doing something
in your completion routine that is not safe at this
level.
For example, you can’t call ExAcquireFastMutex at
DISPATCH_LEVEL.

What are you using for synchronization?

  • Randy

PS #1
At the last plugfest, Neal C. suggested to me that my
alloc tags should all begin with 2 digits that id my
company and the last 2 digits identify the specific
allocation. For example, ‘MC01’.

PS #2
Have you looked at using the built in linked list
routines in NT? (InitializeListHead, etc…)

— “Lalit S. Rana” wrote:
> Hi All,
> I am having IRQL_NOT_LESS_OR_EQUAL problem and I
> think its because of
> bad pointer allocation.
>
> I am making a link list whose elements are in
> NonPagedPool.
> The structure being
>
> typedef struct _DELFILES{
> UNICODE_STRING DelFName;
> struct _DELFILES* next;
> }DELFILES, * PDELFILES;
>
> NOW FROM THIS SMALL ROUTINE I WANT TO ASK
>
> PDELFILES psElement = (PDELFILES)
> ExAllocatePoolWithTag(NonPagedPool,
> sizeof(DELFILES), ‘1leD’);
> FileObject = irpStack->FileObject;
> FileName = &FileObject->FileName;
> (&psElement->DelFName)->MaximumLength =
> FileName->MaximumLength + 2;
> (&psElement->DelFName)->Buffer =
> ExAllocatePoolWithTag(NonPagedPool,
> (&psElement->DelFName)->MaximumLength,‘2leD’);
>
>
> (I) If I am allocating memory like above,would it
> create a problem if this
> linked list is populated extensively. And the linked
> list is accessed for
> comparision very extensively.
> (II)The various elements of this routine are later
> accessed in the
> completion routine. I have taken appropriate
> synchronization steps but
> still am getting IRQL_NOT_LESS_OR_EQUAL. Please
> Suggest.
>
> Can stack memory also lead to error.
>
> Thanks
> Lalit.
>
>
>
>
>
>
>
>
>
> —
> You are currently subscribed to ntfsd as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
xxxxx@lists.osr.com

__________________________________
Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo.
http://search.yahoo.com

3

Hi Randy,
With some modifications in the code I was able to get the problem
corrected but now am getting the same error in CLASSPNP.SYS
I am not knowing whether my program has passed some wrong arguments or
what else might be the problem.
I am using KEVENT for synchronization.

Initially I was using linked list provided by the DDK, i.e.
SINGLY_LINK_LIST, but being new to that, was not able to get a way by
which I can access elements without doing POP operation. If their is one
could you please help me knowing that.

Regards,
Lalit.

Completion routines often run at DISPATCH_LEVEL. I
think it is more likely that you are doing something
in your completion routine that is not safe at this
level.
For example, you can’t call ExAcquireFastMutex at
DISPATCH_LEVEL.

What are you using for synchronization?

  • Randy

PS #1
At the last plugfest, Neal C. suggested to me that my
alloc tags should all begin with 2 digits that id my
company and the last 2 digits identify the specific
allocation. For example, ‘MC01’.

PS #2
Have you looked at using the built in linked list
routines in NT? (InitializeListHead, etc…)

4

I use the doubly linked list stuff. Use it like this:

typedef struct _NODE
{
LIST_ENTRY linkfield;
//
// Add whatever other members you need
//
} NODE, *PNODE;

LIST_ENTRY listHead;

Make sure you init the listHead before you use the
list:
InitializeListHead(&listHead);

Add to the head like this:
InsertHeadList(&listHead, &pNode->linkfield);

See the DDK doc for the list of functions that can be
used on doubly linked lists.

There is also a set of interlocked apis that can be
used on doubly linked lists.

Make sure of course that you use proper
synchronization when add/removing/traversing the list.

Randy

— “Lalit S. Rana” wrote:
> Hi Randy,
> With some modifications in the code I was able to
> get the problem
> corrected but now am getting the same error in
> CLASSPNP.SYS
> I am not knowing whether my program has passed some
> wrong arguments or
> what else might be the problem.
> I am using KEVENT for synchronization.
>
> Initially I was using linked list provided by the
> DDK, i.e.
> SINGLY_LINK_LIST, but being new to that, was not
> able to get a way by
> which I can access elements without doing POP
> operation. If their is one
> could you please help me knowing that.
>
> Regards,
> Lalit.
>
>
> Completion routines often run at DISPATCH_LEVEL. I
> think it is more likely that you are doing something
> in your completion routine that is not safe at this
> level.
> For example, you can’t call ExAcquireFastMutex at
> DISPATCH_LEVEL.
>
> What are you using for synchronization?
>
> - Randy
>
> PS #1
> At the last plugfest, Neal C. suggested to me that
> my
> alloc tags should all begin with 2 digits that id my
> company and the last 2 digits identify the specific
> allocation. For example, ‘MC01’.
>
> PS #2
> Have you looked at using the built in linked list
> routines in NT? (InitializeListHead, etc…)
>
>
> —
> You are currently subscribed to ntfsd as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
xxxxx@lists.osr.com

__________________________________
Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo.
http://search.yahoo.com