error C7- timer is invalid

NTDEV
1

I am running verifier on my driver, and I get this error TIMER_OR_DPC_INVALID
My KTIMER is declared global , and on driver entry I call KeInitializeTimer(&Timer);
I call this function only once when

when the verifier reboot I get this error , how can I solve this issue?

TIMER_OR_DPC_INVALID (c7)
Kernel timer or DPC used incorrectly.
Arguments:
Arg1: 0000000000000000, Timer object found in memory which must not contain such items.
Arg2: fffff80002230f60, Address of the timer object.
Arg3: fffff80002230f60, Start of memory range being checked.
Arg4: fffff80002230fa0, End of memory range being checked.

Debugging Details:

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

BUGCHECK_STR: 0xC7

PROCESS_NAME: System

CURRENT_IRQL: 2

ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre

LAST_CONTROL_TRANSFER: from fffff80391260f37 to fffff803911da0a0

STACK_TEXT:
ffffd000217577d8 fffff80391260f37 : 00000000000000c7 0000000000000000 fffff80002230f60 fffff80002230f60 : nt!KeBugCheckEx
ffffd000217577e0 fffff803916ffd86 : 0000000000000000 0000001800000030 0000000100000054 0000000000000000 : nt!KeCheckForTimer+0x187
ffffd00021757850 fffff80002202ba1 : 0000000000000000 ffff4fe600000001 00002ee006000000 ffffe00000005dc0 : nt!VerifierKeInitializeTimerEx+0x26

2

try moving your KTIMER not to be global.
move it to device extension.

3

Show us the declaration of the timer, and the code around the
KeInitializeTimer. I’ve seen this where a client accidently cut and pasted
a pointer to the timer as the timer definition in global memory.

Don Burn
Windows Driver Consulting
Website: http://www.windrvr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Thursday, February 11, 2016 6:00 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] error C7- timer is invalid

I am running verifier on my driver, and I get this error
TIMER_OR_DPC_INVALID My KTIMER is declared global , and on driver entry I
call KeInitializeTimer(&Timer); I call this function only once when

when the verifier reboot I get this error , how can I solve this issue?

TIMER_OR_DPC_INVALID (c7)
Kernel timer or DPC used incorrectly.
Arguments:
Arg1: 0000000000000000, Timer object found in memory which must not contain
such items.
Arg2: fffff80002230f60, Address of the timer object.
Arg3: fffff80002230f60, Start of memory range being checked.
Arg4: fffff80002230fa0, End of memory range being checked.

Debugging Details:

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

BUGCHECK_STR: 0xC7

PROCESS_NAME: System

CURRENT_IRQL: 2

ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre

LAST_CONTROL_TRANSFER: from fffff80391260f37 to fffff803911da0a0

STACK_TEXT:
ffffd000217577d8 fffff80391260f37 : 00000000000000c7 0000000000000000
fffff80002230f60 fffff80002230f60 : nt!KeBugCheckEx
ffffd000217577e0 fffff803916ffd86 : 0000000000000000 0000001800000030
0000000100000054 0000000000000000 : nt!KeCheckForTimer+0x187
ffffd00021757850 fffff80002202ba1 : 0000000000000000 ffff4fe600000001
00002ee006000000 ffffe00000005dc0 : nt!VerifierKeInitializeTimerEx+0x26

NTDEV is sponsored by OSR

Visit the list online at:
http:

MONTHLY seminars on crash dump analysis, WDF, Windows internals and software
drivers!
Details at http:

To unsubscribe, visit the List Server section of OSR Online at
http:</http:></http:></http:>

4

The timer may have gotten to discardable (INIT) data section, which is discarded after DriverEntry.

5

typedef struct
{
KTIMER Timer;
KEVENT PushButtonEvent;
KEVENT PressButtonEvent;
} DrvTimer

DrvTimer gTimer;

VOID InitializeTimer()
{
KeInitializeTimer(&gTimer.Timer);
KeInitializeEvent(&gTimer.PushButtonEvent, NotificationEvent, TRUE);
KeClearEvent(&gTimer.ShutdownEvent);
KeInitializeEvent(&gTimer.PressButtonEvent, NotificationEvent, TRUE);
KeClearEvent(&gTimer.CancelEvent);
}

6

Sorry update code
typedef struct
{
KTIMER Timer;
KEVENT PushButtonEvent;
KEVENT PressButtonEvent;
} DrvTimer

DrvTimer gTimer;

VOID InitializeTimer()
{
KeInitializeTimer(&gTimer.Timer);
KeInitializeEvent(&gTimer.PushButtonEvent, NotificationEvent, TRUE);
KeClearEvent(&gTimer.PushButtonEvent);
KeInitializeEvent(&gTimer.PressButtonEvent, NotificationEvent, TRUE);
KeClearEvent(&gTimer.PressButtonEvent);
}

7

Do you cancel your timer when you unload the driver?

8

Yes , I cancel the timer, when I unload the driver.
As I mentioned in my first post I would like to run verifier on my driver, but failed on TIMER_OR_DPC_INVALID

9

xxxxx@gmail.com wrote:

Sorry update code
typedef struct
{
KTIMER Timer;
KEVENT PushButtonEvent;
KEVENT PressButtonEvent;
} DrvTimer

DrvTimer gTimer;

VOID InitializeTimer()
{
KeInitializeTimer(&gTimer.Timer);
KeInitializeEvent(&gTimer.PushButtonEvent, NotificationEvent, TRUE);
KeClearEvent(&gTimer.PushButtonEvent);
KeInitializeEvent(&gTimer.PressButtonEvent, NotificationEvent, TRUE);
KeClearEvent(&gTimer.PressButtonEvent);
}

Is this just pseudo-code, or is this your actual code? If it is your
actual code, why do you have the timer in a global, instead of a device
extension, where it belongs? Where do you call InitializeTimer? Are
you absolutely sure InitializeTimer cannot be called more than once?

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

10

>Yes , I cancel the timer, when I unload the driver.

If it’s a periodic timer, you must call KeFlushQueuedDpcs to drain any
pending DPCs. Do you do that ?

//Daniel

11

Daniel thanks for the answer,
As i wrote in the beginning of the thread I am running verifier on my driver and when the driver load I get BSOD TIMER_OR_DPC_INVALID. I am trying to understand the problem " Message 6 " include my initialization code and declaration

12

>As i wrote in the beginning of the thread I am running verifier on my

driver and when the driver load I get BSOD TIMER_OR_DPC_INVALID. I am
trying to understand the problem " Message 6 " include my initialization
code and >declaration

You wrote “when the verifier reboot” before, not “when the driver load”. So
when are you getting the BSOD ?

//Daniel

13

I will try to clarify, I enabled verifier to test the driver, I get this BSOD when the driver is loaded

14

>I will try to clarify, I enabled verifier to test the driver, I get this

BSOD when the driver is loaded

So that’s weird. Try to look if your global gTimer does not reside in a
pageable data section, look for a line like

#pragma data_seg("PAGE…

Or like Grigora said, it may be in an INIT section too.

//Daniel