why crash OS when call KeWaitForSingleObject

NTFSD
1

Hi All:
I am developing a file system filter now, there is a puzzle problem:
I create thread in DriverEntry routine with thread function
‘AuditInfoWritingProc’. The details of this function as following:
VOID
AuditInfoWritingProc(PVOID Context)
{
while (1)
{
KeWaitForSingleObject(&AuditInfoQueEvent,Executive,KernelMode,TRUE,NUL);
//some other codes
…
KeSetEvent(&AuditInfoQueEvent, IO_NO_INCREMENT, FALSE);
}
}

It is working order as loading the driver, but it is crash OS at
KeWaitForSingleObject when reciving and finishing a device IO control, it is
said that IRQL_NOT_LESS_OR_EQUAL. but it is work well as I disable code line
of KeWaitForSingleObject

I don’t know why it is happened, is there any one the reason?
Any suggests are welcome!
Thanks a lot.

2

You should include the output from windbg “analyze -v” from the crash with
the correct symbols loaded.

On Tue, Jun 3, 2008 at 5:47 AM, liao_jh <liao_jh> wrote:

> Hi All:
> I am developing a file system filter now, there is a puzzle problem:
> I create thread in DriverEntry routine with thread function
> ‘AuditInfoWritingProc’. The details of this function as following:
> VOID
> AuditInfoWritingProc(PVOID Context)
> {
> while (1)
> {
> KeWaitForSingleObject(&AuditInfoQueEvent,Executive,KernelMode,TRUE,NUL);
> //some other codes
> …
> KeSetEvent(&AuditInfoQueEvent, IO_NO_INCREMENT, FALSE);
> }
> }
>
> It is working order as loading the driver, but it is crash OS at
> KeWaitForSingleObject when reciving and finishing a device IO control, it
> is
> said that IRQL_NOT_LESS_OR_EQUAL. but it is work well as I disable code
> line
> of KeWaitForSingleObject
>
> I don’t know why it is happened, is there any one the reason?
> Any suggests are welcome!
> Thanks a lot.
>
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: xxxxx@hollistech.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

–
Mark Roddy</liao_jh>

3

I am sorry.

I found the reason why there is a crash. My colleague modify some codes,
and he made a mistake for copying a little large memory block

to a small point variant so causing overload memory and destroying
AuditInfoQueEvent object . After that, every time when visit
AuditInfoQueEvent object,

so it cause a OS crash.

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Roddy
Sent: Tuesday, June 03, 2008 6:38 PM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] why crash OS when call KeWaitForSingleObject

You should include the output from windbg “analyze -v” from the crash with
the correct symbols loaded.

On Tue, Jun 3, 2008 at 5:47 AM, liao_jh <liao_jh> wrote:

Hi All:
I am developing a file system filter now, there is a puzzle problem:
I create thread in DriverEntry routine with thread function
‘AuditInfoWritingProc’. The details of this function as following:
VOID
AuditInfoWritingProc(PVOID Context)
{
while (1)
{
KeWaitForSingleObject(&AuditInfoQueEvent,Executive,KernelMode,TRUE,NUL);
//some other codes
…
KeSetEvent(&AuditInfoQueEvent, IO_NO_INCREMENT, FALSE);
}
}

It is working order as loading the driver, but it is crash OS at
KeWaitForSingleObject when reciving and finishing a device IO control, it is
said that IRQL_NOT_LESS_OR_EQUAL. but it is work well as I disable code line
of KeWaitForSingleObject

I don’t know why it is happened, is there any one the reason?
Any suggests are welcome!
Thanks a lot.

—
NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@hollistech.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

–
Mark Roddy — NTFSD is sponsored by OSR For our schedule debugging and file
system seminars (including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars You are currently subscribed to ntfsd as:
liao_jh@126.com To unsubscribe send a blank email to
xxxxx@lists.osr.com</liao_jh>