BSOD in afd!AfdBReceiveEventHandler

[Deneb]

Hello,

I have a BSOD on some computers occuring in afd!AfdBReceiveEventHandler which seems to be the upper driver’s ClientEventReceive handler. This bug occurs rarely and I suspect there is something wrong with my TDI_SET_EVENT_HANDLER processing.

So, my question is – before you get IRP_MJ_CLEANUP on a file object, does the upper client cleans all handlers passed via TDI_SET_EVENT_HANDLER, by calling you via TDI_SET_EVENT_HANDLER with NULL parameters, for the SAME file object?

[Vadim Smirnov]

So, my question is – before you get IRP_MJ_CLEANUP on a file object, does the upper client cleans all handlers passed via TDI_SET_EVENT_HANDLER, by calling you via TDI_SET_EVENT_HANDLER with NULL parameters, for the SAME file object?

Basically this depends from TDI client. In your case you have to check AFD behavior if you suspect it causing the crash. Though the exact reason can be figured out only from the crash dump…

[Deneb]

Well, I figured out some clients does not clean all event handlers on some objects before calling IRP_MJ_CLEANUP on those objects. I need to keep the upper clients handlers and contexts and figure out when can I delete them ( as I cannot delete them on IRP_MJ_CLEANUP ). If someone encountered this problem till now and solved it, it would deliver great deal of help.

[Deneb]

Hello,

after some more kernel debugging and research, I found out that IRP_MJ_CLOSE is a better place to delete all resources allocated for a PFILE_OBJECT than IRP_MJ_CLEANUP. I was deleting all resources allocated for a PFILE_OBJECT on IRP_MJ_CLEANUP, as inspired from tdi_fw sample. Can someone tell me his opinion on this?

[Author]

Posts