Hi, all,
after long discussion about this problem (thanks all for
the advices), I have the last question:
Comparing the two macros MmGetSystemAddressForMdl
and MmGetSystemAddressForMdlSafe, they are almost identical,
except that the first one calls MmMapLockedPages,
the second one calls MmMapLockedPagesSpecifyCache.
If I look into assembly code of the MmMapLockedPages
function, I see there
NTSTATUS MmMapLockedPages
(PMDL Mdl, KPROCESSOR_MODE Mode
{
return MmMapLockedPagesSpecifyCache
(Mdl, Mode, MmCached, NULL, TRUE, HighPagePriority)
}
So where is the difference and why exactly is the “Safe” macro safe ?
And why my filter does create a memory leak if the last parameter
is “NormalPagePriority”, and doesn’t if “HighPagePriority” ?
L.