IrqlExAllocatePool rule (wdm)

The IrqlExAllocatePool rule specifies that the driver calls ExAllocatePoolWithTag and ExAllocatePoolWithTagPriority only when it is executing at IRQL<=DISPATCH_LEVEL.

A caller executing at DISPATCH_LEVEL must specify a NonPagedXxx value for PoolType. A caller executing at IRQL <= APC_LEVEL can specify any POOL_TYPE value.

Driver model: WDM

Bug check(s) found with this rule: Bug Check 0xC4: DRIVER_VERIFIER_DETECTED_VIOLATION (0x00020004), Bug Check 0xA: IRQL_NOT_LESS_OR_EQUAL

Example

In the following example, the ExAllocatePoolWithTag routine is called after the KeAcquireSpinLock routine, which sets IRQL to DISPATCH_LEVEL. The ExAllocatePoolWithTag routine is called with PagedPool, which violates the rule.

NTSTATUS
DispatchRequest (
    __in PDEVICE_REQUEST DeviceRequest
    )
{  
    KIRQL OldIrql;
    KSPIN_LOCK SpinLock;
    NTSTATUS Status;
    ...

    KeInitializeSpinLock(&SpinLock);

    //
    // KeAcquireSpinLock sets IRQL to DISPATCH_LEVEL and the previous IRQL is 
    // written to OldIrql after the lock is acquired.
    //

    KeAcquireSpinLock(&SpinLock, &OldIrql);
    ...

    Status = ProcessRequest(DeviceRequest);

    //
    // KeReleaseSpinLock sets IRQL to the OldIrql returned by KeAcquireSpinLock.
    //

    KeReleaseSpinLock(&SpinLock, &OldIrql);
    ...
}

NTSTATUS
ProcessRequest (
    __in PDEVICE_REQUEST DeviceRequest
    )
{
    NTSTATUS Status;
    ...

    //
    // RULE VIOLATION! - IrqlExAllocatePool executing at DISPATCH_LEVEL must specify 
    //                   a NonPagedXxx value for PoolType. 
    //

    DeviceRequest->Context = ExAllocatePool(PagedPool, sizeof(REQUEST_CONTEXT));
    if (DeviceRequest->Context == NULL) {
        Status = STATUS_INSUFFICIENT_RESOURCES;
    }
    ...

    return Status;
}

How to test

Applies to

ExAllocatePoolWithTag ExAllocatePoolWithTagPriority

See also

Managing Hardware Priorities Preventing Errors and Deadlocks While Using Spin Locks