digging in the archives , I’ve found a thread from 2014 where Peter Scott mentions the following
“ The other point to note is that by manipulating the content directly in
the write buffer then you are modifying the buffers which describe the
file in the system cache, in the case of paging writes. Thus if there
happens to be a read of the system cache via memory mapped IO, that read
could result in retrieving corrupted data.”
could anyone elaborate why , for a paging write , the buffer the caller provided is the representation of the file in the cache? According to the “ Windows NT a developers guide “ book, page 253 , the cache manager will perform a copy from the user’s buffer to the view associated with the file , it will not use the pointer provided by the caller in some manner , so why modifying it directly affects the cached version of the file?
it makes sense that for cached I/O if I see the IRP and modify the buffer the cache representation will be affected too, but as paging I/O is noncached I struggle to make sense of the said statement