Initialize reflect subsystem before the device becomes openable (fixes #330 / #408) - #409
Open
chenmohan123 wants to merge 1 commit into
Open
Initialize reflect subsystem before the device becomes openable (fixes #330 / #408)#409chenmohan123 wants to merge 1 commit into
chenmohan123 wants to merge 1 commit into
Conversation
DriverEntry exposed the device and symbolic link before windivert_reflect_init() ran, so a WinDivertOpen() racing with driver load could hit zeroed reflect list heads at DISPATCH_LEVEL in windivert_reflect_open_event() (bugcheck 0xD1, WinDivert64+0xab69). Initialize the reflect subsystem right after WdfDriverCreate, with the work item parented to the driver object. Fixes basil00#330, see also basil00#408.
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the driver-load initialization race behind #330 and #408: bugcheck 0xD1 (
DRIVER_IRQL_NOT_LESS_OR_EQUAL) inwindivert_reflect_open_event()when a handle is opened concurrently with driver load.Bug.
DriverEntrycreates the device, symbolic link, and finishes initializing the control device (lines ~1036-1063) beforewindivert_reflect_init()runs at the very end ofDriverEntry. During that window the device is openable: a concurrentWinDivertOpen()succeeds atCreateFile(dll/WinDivert.c~531) and issuesIOCTL_WINDIVERT_STARTUP→windivert_reflect_open_event()→InsertTailList(&reflect_event_queue, ...)on still-zeroed list heads → read of NULL+8 at DISPATCH_LEVEL → 0xD1 atWinDivert64+0xab69. Five independent minidumps (and the one attached to #330) show the identical fault offset; all crashes occur ~25 s after boot in a multi-threaded client whose first open also installs/starts the service. Full analysis with disassembly: #408 and EasyTier/EasyTier#2487.Fix. Call
windivert_reflect_init()immediately afterWdfDriverCreate(), i.e. before the device becomes openable, parenting the reflect work item to the driver object instead of the device. The work item was never explicitly deleted anyway (windivert_reflect_close()has no callers); like the device-parented work item before, it is cleaned up implicitly when the parent object is deleted on driver unload, so lifetime semantics are unchanged.Notes. Not compile-tested (no WDK on the authoring machine); the change is intentionally minimal (one call moved, parent object changed). Happy to adjust to whatever variant you prefer (e.g. splitting list/lock init from work-item creation, or guarding the reflect event paths with
reflect_inited).