I am developing NDIS 6.2 Filter driver . After running my application i got Blue screen crash . With the help of WinDbg tool i took crash dumps . After nalyzing that dump , i got crash reason something like “Unable to get special pool info” . This is occur when i calling NET_BUFFER_LIST_CONTEXT_DATA_START in the driver code .
The Dump after !analyze -v :
********************************************************
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 000000000000000a, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff800ddaa369a, address which referenced memory
Debugging Details:
READ_ADDRESS: fffff8021b4d3ce0: Unable to get special pool info
fffff8021b4d3ce0: Unable to get special pool info
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
000000000000000a
CURRENT_IRQL: 2
FAULTING_IP:
mymuxtun!CFilter::SendNetBufferListsComplete+6e [c:\users\multiplexer\windows\ndis62\filter.cpp @ 510]
fffff800`ddaa369a 0fb7410a movzx eax,word ptr [rcx+0Ah]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xD1
PROCESS_NAME: chrome.exe
LAST_CONTROL_TRANSFER: from fffff8021b37bae9 to fffff8021b36ffa0
STACK_TEXT:
ffffd000786b5fe8 fffff8021b37bae9 : 000000000000000a 000000000000000a 0000000000000002 0000000000000000 : nt!KeBugCheckEx
ffffd000786b5ff0 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiBugCheckDispatch+0x69
STACK_COMMAND: .bugcheck ; kb
FOLLOWUP_IP:
nsmuxtun!CFilter::SendNetBufferListsComplete+6e [c:\users\windows\ndis62\filter.cpp @ 510]
fffff800`ddaa369a 0fb7410a movzx eax,word ptr [rcx+0Ah]
FAULTING_SOURCE_CODE:
506: if((pNetBufferList != NULL)&&((pNetBufferList->SourceHandle == m_hFilter)) ) {
507:
508: PVOID pBuffer = NULL ;
509: ASSERT(*((PVOID*)NET_BUFFER_LIST_CONTEXT_DATA_START(pNetBufferList)) != NULL);
510: pBuffer = *((PVOID*) NET_BUFFER_LIST_CONTEXT_DATA_START(pNetBufferList));
511: PMDL pMdl = NET_BUFFER_FIRST_MDL(NET_BUFFER_LIST_FIRST_NB(pNetBufferList));
512:
513: if(NULL != pMdl)
514: NdisFreeMdl(pMdl);
515:
SYMBOL_NAME: mymuxtun!CFilter::SendNetBufferListsComplete+6e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: mymuxtun
IMAGE_NAME: mymuxtun.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 568fd1a3
FAILURE_BUCKET_ID: X64_0xD1_mymuxtun!CFilter::SendNetBufferListsComplete+6e
BUCKET_ID: X64_0xD1_mymuxtun!CFilter::SendNetBufferListsComplete+6e
Followup: MachineOwner
1: kd> k
Child-SP RetAddr Call Site
ffffd000786b5fe8 fffff8021b37bae9 nt!KeBugCheckEx
ffffd000786b5ff0 0000000000000000 nt!KiBugCheckDispatch+0x69
********************************************************
my attach function :
*********************************************************
Attach(
IN NDIS_HANDLE NdisFilterHandle,
IN PNDIS_FILTER_ATTACH_PARAMETERS AttachParameters )
{
m_hFilter = NdisFilterHandle;
NET_BUFFER_LIST_POOL_PARAMETERS netBufferListPoolParameters;
NdisZeroMemory(&netBufferListPoolParameters, sizeof(NET_BUFFER_LIST_POOL_PARAMETERS));
netBufferListPoolParameters.Header.Type = NDIS_OBJECT_TYPE_DEFAULT;
netBufferListPoolParameters.Header.Size = NDIS_SIZEOF_NET_BUFFER_LIST_POOL_PARAMETERS_REVISION_1;
netBufferListPoolParameters.Header.Revision = NET_BUFFER_LIST_POOL_PARAMETERS_REVISION_1;
netBufferListPoolParameters.ProtocolId = NDIS_PROTOCOL_ID_DEFAULT;
netBufferListPoolParameters.fAllocateNetBuffer = TRUE;
netBufferListPoolParameters.ContextSize = 0;
netBufferListPoolParameters.PoolTag = MYMUXTUN_POOL_TAG;
netBufferListPoolParameters.DataSize = 0;
m_hNetBufferListPool = NdisAllocateNetBufferListPool(m_hFilter, &netBufferListPoolParameters);
if (m_hNetBufferListPool == NULL) {
status = NDIS_STATUS_RESOURCES;
DbgPrintEx(DPFLTR_IHVNETWORK_ID, DPFLTR_TRACE_LEVEL, “!!! [%p] Attach(): NdisAllocateNetBufferListPool(): failed\n”, this);
goto cfaExit;
}
NDIS_FILTER_ATTRIBUTES ndisFilterAttributes;
NdisZeroMemory(&ndisFilterAttributes, sizeof(NDIS_FILTER_ATTRIBUTES));
ndisFilterAttributes.Header.Type = NDIS_OBJECT_TYPE_FILTER_ATTRIBUTES;
ndisFilterAttributes.Header.Size = NDIS_SIZEOF_FILTER_ATTRIBUTES_REVISION_1;
ndisFilterAttributes.Header.Revision = NDIS_FILTER_ATTRIBUTES_REVISION_1;
ndisFilterAttributes.Flags = 0;
status = NdisFSetAttributes(NdisFilterHandle, this, &ndisFilterAttributes);
if (status != NDIS_STATUS_SUCCESS) {
DbgPrintEx(DPFLTR_IHVNETWORK_ID, DPFLTR_ERROR_LEVEL, “!!! [%p] Attach(): NdisFSetAttributes(): failed, status %08X\n”, this, status);
goto cfaExit;
}
cfaExit:
DbgPrintEx(DPFLTR_IHVNETWORK_ID, DPFLTR_TRACE_LEVEL, “<<< [%p] Attach(): exited, status %08X\n”, this, status);
return status;
}
*********************************************************
Send buffer list function ()
*********************************************************
SendNetBufferLists(
IN PNET_BUFFER_LIST NetBufferLists,
IN NDIS_PORT_NUMBER PortNumber,
IN ULONG SendFlags)
{
PNET_BUFFER_LIST pSendNetBufferList = NULL;
PNET_BUFFER_LIST pSendNetBufferListComplete = NULL;
PNET_BUFFER_LIST pNetBufferList = NetBufferLists;
PNET_BUFFER_LIST pNextNetBufferList = NULL;
while (pNetBufferList) {
pNextNetBufferList = NET_BUFFER_LIST_NEXT_NBL(pNetBufferList);
NET_BUFFER_LIST_NEXT_NBL(pNetBufferList) = NULL;
if (pNetBufferList->ChildRefCount != 0) {
DbgPrintEx(DPFLTR_IHVNETWORK_ID, DPFLTR_ERROR_LEVEL, “!!! [%p]SendNetBufferLists(): pNetBufferList->ChildRefCount != 0\n”, this);
}
PNET_BUFFER pNetBuffer = NET_BUFFER_LIST_FIRST_NB(pNetBufferList);
PNET_BUFFER pNextNetBuffer = NULL;
while (pNetBuffer) {
pNextNetBuffer = NET_BUFFER_NEXT_NB(pNetBuffer);
u32_t nResult = OutgoingNetBufferInput(pNetBuffer);
PNET_BUFFER_LIST pNewNetBufferList = NdisAllocateNetBufferAndNetBufferList(m_hNetBufferListPool, 0, 0, NULL, 0, 0);
if (pNewNetBufferList == NULL) {
pNetBuffer = pNextNetBuffer;
DbgPrintEx(DPFLTR_IHVNETWORK_ID, DPFLTR_WARNING_LEVEL, “!!! [%p] CFilter::SendNetBufferLists(): NdisAllocateNetBufferAndNetBufferList(): failed\n”, this);
continue;
}
PNET_BUFFER pNewNetBuffer = NET_BUFFER_LIST_FIRST_NB(pNewNetBufferList);
NET_BUFFER_FIRST_MDL(pNewNetBuffer) = NET_BUFFER_FIRST_MDL(pNetBuffer);
NET_BUFFER_DATA_LENGTH(pNewNetBuffer) = NET_BUFFER_DATA_LENGTH(pNetBuffer);
NET_BUFFER_DATA_OFFSET(pNewNetBuffer) = NET_BUFFER_DATA_OFFSET(pNetBuffer);
NET_BUFFER_CURRENT_MDL(pNewNetBuffer) = NET_BUFFER_CURRENT_MDL(pNetBuffer);
NET_BUFFER_CURRENT_MDL_OFFSET(pNewNetBuffer) = NET_BUFFER_CURRENT_MDL_OFFSET(pNetBuffer);
NDIS_SET_NET_BUFFER_LIST_CANCEL_ID(pNewNetBufferList, NDIS_GET_NET_BUFFER_LIST_CANCEL_ID(pNetBufferList));
NdisCopySendNetBufferListInfo(pNewNetBufferList, pNetBufferList);
pNewNetBufferList->SourceHandle = m_hFilter;
pNewNetBufferList->ParentNetBufferList = pNetBufferList;
pNetBufferList->ChildRefCount ++;
NdisInterlockedIncrement(&m_nSendNetBufferListCount);
if (pSendNetBufferList != NULL) {
PNET_BUFFER_LIST pCurrentNetBufferList = pSendNetBufferList;
while (NET_BUFFER_LIST_NEXT_NBL(pCurrentNetBufferList) != NULL) {
pCurrentNetBufferList = NET_BUFFER_LIST_NEXT_NBL(pCurrentNetBufferList);
}
NET_BUFFER_LIST_NEXT_NBL(pCurrentNetBufferList) = pNewNetBufferList;
} else {
pSendNetBufferList = pNewNetBufferList;
}
pNetBuffer = pNextNetBuffer;
}
if (pNetBufferList->ChildRefCount == 0) {
NET_BUFFER_LIST_STATUS(pNetBufferList) = NDIS_STATUS_SUCCESS;
if (pSendNetBufferListComplete != NULL) {
PNET_BUFFER_LIST pCurrentNetBufferList = pSendNetBufferListComplete;
while (NET_BUFFER_LIST_NEXT_NBL(pCurrentNetBufferList) != NULL) {
pCurrentNetBufferList = NET_BUFFER_LIST_NEXT_NBL(pCurrentNetBufferList);
}
NET_BUFFER_LIST_NEXT_NBL(pCurrentNetBufferList) = pNetBufferList;
} else {
pSendNetBufferListComplete = pNetBufferList;
}
}
pNetBufferList = pNextNetBufferList;
}
if (pSendNetBufferList != NULL) {
NdisFSendNetBufferLists(m_hFilter, pSendNetBufferList, PortNumber, SendFlags);
}
if (pSendNetBufferListComplete != NULL) {
NdisFSendNetBufferListsComplete(m_hFilter, pSendNetBufferListComplete, SendFlags & NDIS_SEND_FLAGS_DISPATCH_LEVEL ? NDIS_SEND_COMPLETE_FLAGS_DISPATCH_LEVEL : 0);
}
}
**********************************************************
and the SendBufferListComplete function :
*************************************************************
SendNetBufferListsComplete(
IN PNET_BUFFER_LIST NetBufferLists,
IN ULONG SendCompleteFlags )
{
PNET_BUFFER_LIST pNetBufferList = NULL ;
pNetBufferList = NetBufferLists;
PNET_BUFFER_LIST pNextNetBufferList = NULL;
while ( NULL != pNetBufferList) {
pNextNetBufferList = NET_BUFFER_LIST_NEXT_NBL(pNetBufferList);
NET_BUFFER_LIST_NEXT_NBL(pNetBufferList) = NULL;
PNET_BUFFER_LIST pParentNetBufferList = pNetBufferList->ParentNetBufferList;
if (pParentNetBufferList != NULL) {
NDIS_STATUS status = NET_BUFFER_LIST_STATUS(pNetBufferList);
if(NULL != pNetBufferList)
NdisFreeNetBufferList(pNetBufferList);
if (NdisInterlockedDecrement(&pParentNetBufferList->ChildRefCount) == 0) {
NET_BUFFER_LIST_STATUS(pParentNetBufferList) = status;
NdisFSendNetBufferListsComplete(m_hFilter, pParentNetBufferList, SendCompleteFlags);
}
} else {
if((pNetBufferList != NULL)&&((pNetBufferList->SourceHandle == m_hFilter)) ) {
PVOID pBuffer = NULL ;
ASSERT(*((PVOID*)NET_BUFFER_LIST_CONTEXT_DATA_START(pNetBufferList)) != NULL);
pBuffer = *((PVOID*) NET_BUFFER_LIST_CONTEXT_DATA_START(pNetBufferList));
PMDL pMdl = NET_BUFFER_FIRST_MDL(NET_BUFFER_LIST_FIRST_NB(pNetBufferList));
if(NULL != pMdl)
NdisFreeMdl(pMdl);
if(NULL != pBuffer)
delete (UCHAR*) pBuffer;
if(NULL != pNetBufferList)
NdisFreeNetBufferList(pNetBufferList);
}
else
{
NdisFSendNetBufferListsComplete(m_hFilter, pNetBufferList, SendCompleteFlags);
}
NdisInterlockedDecrement(&m_nSendNetBufferListCount);
pNetBufferList = NULL ;
pNetBufferList = pNextNetBufferList;
}
}
**************************************************************
and in packetoutput () function :
*************************************************
u32_t CFilter::PacketOutput(
IN u8_t* pBuffer,
IN u32_t nLength
) {
UCHAR* pPacket = new UCHAR[nLength];
NdisMoveMemory(pPacket, pBuffer, nLength);
PMDL pMdl = NdisAllocateMdl(m_hFilter, pPacket, nLength);
if (pMdl == NULL) {
delete pPacket;
DbgPrintEx(DPFLTR_IHVNETWORK_ID, DPFLTR_WARNING_LEVEL, “!!! [%p]
CFilter::PacketOutput(): NdisAllocateMdl(): failed\n”, this);
goto cfpoExit;
}
PNET_BUFFER_LIST pNetBufferList =
NdisAllocateNetBufferAndNetBufferList(m_hNetBufferListPool, sizeof(PVOID), 0,
pMdl, 0, nLength);
if (pNetBufferList != NULL) {
*((PVOID*) NET_BUFFER_LIST_CONTEXT_DATA_START(pNetBufferList)) = pPacket;
NdisInterlockedIncrement(&m_nSendNetBufferListCount);
NdisFSendNetBufferLists(m_hFilter, pNetBufferList, 0, 0);
} else {
NdisFreeMdl(pMdl);
delete pPacket;
DbgPrintEx(DPFLTR_IHVNETWORK_ID, DPFLTR_WARNING_LEVEL, “!!! [%p]
CFilter::PacketOutput(): NdisAllocateNetBufferAndNetBufferList(): failed\n”,
this);
goto cfpoExit;
}
}
****************************************
and packetoutput () is called by CFilter::Status() function ;
The debugger pointed to NET_BUFFER_LIST_CONTEXT_DATA_START . what is the problem ? Where is the memory corruption ? No problems in packetoutput function . same process there . When i done same process in " NdisSendNetBufferListComplete() " it causes bluescreen . Why ?
please help me