none
Debug KERNEL_SECURITY_CHECK_FAILURE (BSOD 0x139) in KeSetEvent

    Question

  • I got a KERNEL_SECURITY_CHECK_FAILURE bugcheck in my driver in Windows 8 8370.
    The bugcheck happens in KeSetEvent call after S3/S4 resume.
    I'm sure that the event has been initialized in WDF prepare hardware dispatch.
    The event pointer passed to KeSetEvent is valid when the driver calls KeSetEvent.
    The contents of the event object (_KEVENT) looks same before and after S3/S4 resume.
    The IRQL is PASSIVE_LEVEL when the driver calls KeSetEvent and Wait flag is FALSE.

    Looks like KERNEL_SECURITY_CHECK_FAILURE is new bugcheck in Windows 8 for LIST_ENTRY operation checking.
    I didn't get this BSOD in Windows 7.
    The only LIST_ENTRY field of _KEVENT is WaitListHead.
    I don't think my codes touch WaitListHead to corrupt the link list.
    I also enable driver verifier, but it didn't catch other errors.

    Is there any debug suggestion I can try for debugging this issue?

    Friday, June 01, 2012 2:55 AM

Answers

  • EEAP drops of the OS are not supported in this forum, please send the output of !analyze -v to your hw eco system PM partner at microsoft. One guess could be that you are initializing the event while you are waiting on it in another thread, thus corrupting the wait list

    d -- This posting is provided "AS IS" with no warranties, and confers no rights.

    Friday, June 01, 2012 3:27 AM
    Owner

All replies

  • EEAP drops of the OS are not supported in this forum, please send the output of !analyze -v to your hw eco system PM partner at microsoft. One guess could be that you are initializing the event while you are waiting on it in another thread, thus corrupting the wait list

    d -- This posting is provided "AS IS" with no warranties, and confers no rights.

    Friday, June 01, 2012 3:27 AM
    Owner
  • Thanks for replying!

    The event is only initialized in WDF prepare hardware function.
    It's not called during S3/S4 resume.
    The situation you mentioned won't happen.

    Do I need to prevent multiple threads from calling KeSetEvent on the same event object simultaneously?

    I have tried to use mutex or spinlock to guarantee only one thread can call KeSetEvent at one time.
    But it didn't help.


    huangjj

    Friday, June 01, 2012 6:37 AM
  • Thanks for help!

    I have solved the problem.
    The root cause is what you mentioned.

    The thread waits for multiple events.
    The driver reinitialized one event while the other thread is still waiting.
    However, the driver got BSOD 0x139 while calling KeSetEvent on the other event.
    This leads me to check the wrong event in the beginning.


    huangjj

    Friday, June 01, 2012 12:19 PM