User buffer address in RDBSS read/write request

NTFSD
1

how does rdbss pass the buffer address to redirector in read/write?
I have seen below assert in write request:

PMDL OriginalDataMdl = LowIoContext->ParamsFor.ReadWrite.Buffer;
ASSERT(((OriginalDataMdl!=NULL) && (RxMdlIsLocked(OriginalDataMdl) ||
RxMdlSourceIsNonPaged(OriginalDataMdl)))
);

It means that the buffer is locked or nonpaged so I can use it directly.
But in read request the buffer address is obtained as:

rw->UserBufferBase = RxLowIoGetBufferAddress(RxContext);

Do I need to build an MDL to lock the buffer before pass it to other
driver?

Thanks for your help.