TDI & AFD.SYS crash

Hi,

I'm developing a TDI filter and I have this problem.
Sometime my filter crash in AFD.SYS when I call my function for send the at
callback ClientEventReceive that I hooked.
I read 8192 byte at once from a file and after call the old callback of
ClientEventReceive that I hooked.
Not always crash... sometime in the first call of my cycle.
This is my code:

ReceiveFlags = TDI_RECEIVE_ENTIRE_MESSAGE;

dwBytesRead = 1;

while (dwBytesRead != 0) {

ReadFile (hFile, (PVOID) &Message, 8192, &dwBytesRead, NULL);

if (dwBytesRead != 0) {

KeRaiseIrql ( DISPATCH_LEVEL, &oldirql);

ntStatus = ((PTDI_IND_RECEIVE) (ER_DinCallbackEvent)) (
(PVOID) ER_EVENTCONTEXT,
(CONNECTION_CONTEXT) ER_CONNECTIONCONTEXT,
ReceiveFlags,
dwBytesRead, //BytesIndicated
dwBytesRead, //BytesAvailable,
&TAKEN, //BytesTaken,
(PVOID)&Message, //Tsdu,
&IoRequestPacket);

KeLowerIrql (oldirql);

}

}

Do you know some bug in AFD.SYS ?


Best Regards
Gianfranco Tonello

Gian
Fri Aug 20 04:27:45 CDT 2004

My system is a Windows 2000 5.00.2195 with SP4
and the file AFD.SYS is 5.00.2195.6687

Bye gian

steve
Sun Aug 22 21:37:24 CDT 2004

What kind of crash do you get - what does the crash dump
look like? I have had problems with afd.sys in the past
but not the same as yours - when I uninstalled or stopped
my driver afd would crash because it was trying to use a
handle to one of my drivers device objects. My guess is
that when you call the callback you have passed afd some
invalid value!

steve

>-----Original Message-----
>Hi,
>
>I'm developing a TDI filter and I have this problem.
>Sometime my filter crash in AFD.SYS when I call my
function for send the at
>callback ClientEventReceive that I hooked.
>I read 8192 byte at once from a file and after call the
old callback of
>ClientEventReceive that I hooked.
>Not always crash... sometime in the first call of my
cycle.
>This is my code:
>
>ReceiveFlags = TDI_RECEIVE_ENTIRE_MESSAGE;
>
>dwBytesRead = 1;
>
>while (dwBytesRead != 0) {
>
> ReadFile (hFile, (PVOID) &Message, 8192,
&dwBytesRead, NULL);
>
> if (dwBytesRead != 0) {
>
> KeRaiseIrql ( DISPATCH_LEVEL, &oldirql);
>
> ntStatus = ((PTDI_IND_RECEIVE)
(ER_DinCallbackEvent)) (
> (PVOID) ER_EVENTCONTEXT,
> (CONNECTION_CONTEXT)
ER_CONNECTIONCONTEXT,
> ReceiveFlags,
> dwBytesRead, //BytesIndicated
> dwBytesRead, //BytesAvailable,
> &TAKEN, //BytesTaken,
> (PVOID)&Message, //Tsdu,
> &IoRequestPacket);
>
> KeLowerIrql (oldirql);
>
> }
>
>}
>
>Do you know some bug in AFD.SYS ?
>
>
>Best Regards
>Gianfranco Tonello
>
>
>.
>

Jeff
Mon Aug 23 08:40:45 CDT 2004

Earlier I was in Trouble with my TDI Filter too, crashing AFD.SYS.
Usually I got a IRP_NO_MORE_STACK_LOCATIONS.
If you get the same then do a search on dejanews.com for it, you will find
the solution there.
If not, then post the bug check details.

And then:

- why do you KeRaiseIrql ( DISPATCH_LEVEL, &oldirql);? This IMHO is not
necessary at all for the Handler Routines.

-Examining your code (even it is not complete) looks like you would crash
anytime your Loop would execute more than one time, since you cannot (and
should never in a filter) force a call to the client supplied routine. The
client may have cleared resources that you rely on by the first call.
IMHO you should rather sit and wait till the ClientEventReceive gets called
multiple times.




Kind Regards
Frank

"Gian" <gian@nospam.co.jp.invalid> wrote in message
news:t2jVc.49331$OH4.1549626@twister1.libero.it...
> Hi,
>
> I'm developing a TDI filter and I have this problem.
> Sometime my filter crash in AFD.SYS when I call my function for send the
at
> callback ClientEventReceive that I hooked.
> I read 8192 byte at once from a file and after call the old callback of
> ClientEventReceive that I hooked.
> Not always crash... sometime in the first call of my cycle.
> This is my code:
>
> ReceiveFlags = TDI_RECEIVE_ENTIRE_MESSAGE;
>
> dwBytesRead = 1;
>
> while (dwBytesRead != 0) {
>
> ReadFile (hFile, (PVOID) &Message, 8192, &dwBytesRead, NULL);
>
> if (dwBytesRead != 0) {
>
> KeRaiseIrql ( DISPATCH_LEVEL, &oldirql);
>
> ntStatus = ((PTDI_IND_RECEIVE) (ER_DinCallbackEvent)) (
> (PVOID) ER_EVENTCONTEXT,
> (CONNECTION_CONTEXT) ER_CONNECTIONCONTEXT,
> ReceiveFlags,
> dwBytesRead, //BytesIndicated
> dwBytesRead, //BytesAvailable,
> &TAKEN, //BytesTaken,
> (PVOID)&Message, //Tsdu,
> &IoRequestPacket);
>
> KeLowerIrql (oldirql);
>
> }
>
> }
>
> Do you know some bug in AFD.SYS ?
>
>
> Best Regards
> Gianfranco Tonello
>
>

Gian
Mon Aug 23 09:41:52 CDT 2004

Thanks Steve for your reply,

The crash is the blu screen of death...
Soft Ice tell me IRQ NOT LESS OR EQUAL in AFD.SYS.
I cannot repeat the crash always... is success sometime for example 1 on 50
time.
So is very difficult for me.

> My guess is that when you call the callback you have passed afd some
> invalid value!


There aere only 3 value that I passed:

1) ER_DinCallbackEvent is the callback handle (that is in AFD.SYS)
2) ER_EVENTCONTEXT
3) ER_CONNECTIONCONTEXT

I take this value from my SetEventHandler
I hope of post mu bug check details.

Thanks
Gian

Gian
Mon Aug 23 10:05:02 CDT 2004

Thanks Jeff Runaway,

> Earlier I was in Trouble with my TDI Filter too, crashing AFD.SYS.
> Usually I got a IRP_NO_MORE_STACK_LOCATIONS.
> If you get the same then do a search on dejanews.com for it, you will find
> the solution there.

My problem is when call the old callback handler (that is in AFD.SYS).. ans
is only sometiem and not always.

> If not, then post the bug check details.

I hope of receive another crash...

> And then:
>
> - why do you KeRaiseIrql ( DISPATCH_LEVEL, &oldirql);? This IMHO is not
> necessary at all for the Handler Routines.

Ok, I use ExWorkItem for be at PASSIVE_LEVEL for read and write in a file.
Whene I call my function ReadFile I'm at PASSIVE_LEVEL, so I thinked to be
at DISPATCH_LEVEL for call the old callback handler for AFD.SYS.

> -Examining your code (even it is not complete) looks like you would crash

Yes isn't complete my code...
I'm developing a filter for analyzer only email.
So I save the email in a file, analyze the email, and after I read the file
and send the data receive at the client.

> anytime your Loop would execute more than one time, since you cannot (and
> should never in a filter) force a call to the client supplied routine.

My code seem work fine, but sometime crash at first call old callback
handler of the first email received.

> The client may have cleared resources that you rely on by the first call.
> IMHO you should rather sit and wait till the ClientEventReceive gets
called
> multiple times.

The crash is type IRQ NOT LESS OR EQUAL in AFD.SYS

Thanks for your help.

Gian

Vijender
Wed Oct 27 05:57:03 CDT 2004

Hi all,

I am also having problems with AFd.SYS.

When I call AFD's ClientEventReceive, most of the times it returns
STATUS_SUCCESS. But sometimes it returns STATUS_MORE_PROCESSING_REQUIRED and
pass me a receiv irp .

I extract the buffer from associated MDL using MmGetMdlVirtualAddress. But
some times I get an invalid address here. On analyzing the irp, it seems AFD
is just locking the MDL and is not mapping it to system space. Since i get
the buffer in arbit thread context, my driver crashes when I try to access
it. And this happens very rarely.


Regards
Vijender

"Gian" wrote:

> Thanks Jeff Runaway,
>
> > Earlier I was in Trouble with my TDI Filter too, crashing AFD.SYS.
> > Usually I got a IRP_NO_MORE_STACK_LOCATIONS.
> > If you get the same then do a search on dejanews.com for it, you will find
> > the solution there.
>
> My problem is when call the old callback handler (that is in AFD.SYS).. ans
> is only sometiem and not always.
>
> > If not, then post the bug check details.
>
> I hope of receive another crash...
>
> > And then:
> >
> > - why do you KeRaiseIrql ( DISPATCH_LEVEL, &oldirql);? This IMHO is not
> > necessary at all for the Handler Routines.
>
> Ok, I use ExWorkItem for be at PASSIVE_LEVEL for read and write in a file.
> Whene I call my function ReadFile I'm at PASSIVE_LEVEL, so I thinked to be
> at DISPATCH_LEVEL for call the old callback handler for AFD.SYS.
>
> > -Examining your code (even it is not complete) looks like you would crash
>
> Yes isn't complete my code...
> I'm developing a filter for analyzer only email.
> So I save the email in a file, analyze the email, and after I read the file
> and send the data receive at the client.
>
> > anytime your Loop would execute more than one time, since you cannot (and
> > should never in a filter) force a call to the client supplied routine.
>
> My code seem work fine, but sometime crash at first call old callback
> handler of the first email received.
>
> > The client may have cleared resources that you rely on by the first call.
> > IMHO you should rather sit and wait till the ClientEventReceive gets
> called
> > multiple times.
>
> The crash is type IRQ NOT LESS OR EQUAL in AFD.SYS
>
> Thanks for your help.
>
> Gian
>
>
>
>

Gian
Thu Oct 28 09:36:50 CDT 2004


"Vijender Yadav" <Vijender Yadav@discussions.microsoft.com> ha scritto nel
messaggio news:604CFD78-EC5E-42FB-9CC7-EE3E4B26D169@microsoft.com...
> Hi all,
>
> I am also having problems with AFd.SYS.


My problem was sometime passed at afd some
invalid value...
Now work fine.
But I don't help your in your problem..., because ADS return to me
STATUS_SUCCESS or STATUS_DATA_NOT_ACPETED

Bye Gian