PFLT_DISCONNECT_NOTIFY is the notify callback for FltCreateCommunicationPort, my question is what is the IRQL for this callback?
I called ExAcquireResourceExclusiveLite( resource, TRUE ) in this callback routine and encounter a IRQL_NOT_LESS_OR_EQUAL, the said that <arg2: irql>.
I can not find any articles about the IRQL for PFLT_DISCONNECT_NOTIFY, shouldn’t I called ExAcquireResourceExclusiveLite in this callback routine? Any help will be appreciated!</arg2:>
From the FltCreateCommunicationPort documentation:
DisconnectNotifyCallback [in]
…This parameter is required and cannot be NULL. This routine is called at
IRQL = PASSIVE_LEVEL.
http://msdn.microsoft.com/en-us/library/windows/hardware/ff541931(v=vs.85).aspx
The crash could be due to your ERESOURCE being corrupted. Post the
!analyze -v output.
-scott
OSR
@OSRDrivers
wrote in message news:xxxxx@ntfsd…
PFLT_DISCONNECT_NOTIFY is the notify callback for
FltCreateCommunicationPort, my question is what is the IRQL for this
callback?
I called ExAcquireResourceExclusiveLite( resource, TRUE ) in this callback
routine and encounter a IRQL_NOT_LESS_OR_EQUAL, the said that
<arg2: irql>.
I can not find any articles about the IRQL for PFLT_DISCONNECT_NOTIFY,
shouldn’t I called ExAcquireResourceExclusiveLite in this callback routine?
Any help will be appreciated!</arg2:>
The memory for the ERESOURCE must be from nonpaged pool
Exactly. Even though this routine might be running at passive level, the dispatcher object will be accessed at SYNCH_LEVEL so if it isn’t in non-paged pool the system blows up.
Similarly, if the ERESOURCE is invalid (e.g., freed pool) it would also do this. Hence Scott’s suggestion to post the debugger output.
Tony
OSR
Thanks for all of your help.
I have fix this bug, it is because ERESOURCE being corrupt, I called KeEnterCriticalRegion & ExAcquireExclusiveResourceLite in anthoer routine and forget to do the Leave & Release operation.
It is really a bad program practice to write so many in a single function ;(