WdfRequestUnmarkCancelable call is causing 0x10D WDF_VIOLATION bugcheck

Question

I am working on a WDF driver, where an IOCTL is sent from user app for retrieving some event based info. Details are as below, thanks in advance for your help.

UserApp -> Driver1 -> Driver 2

Driver1:

• Provides cancelation routine & marks the WDFREQUEST as cancelable,
• Saves the WDFREQUEST in its device context
• Sets completion routine and forwards the WDFREQUEST to Driver2 using WdfIoTargetFormatRequestForIoctl/WdfRequestSend

Driver2:

• Pends the request in manual power managed WDFQueue and waits for the event

--------> Event Occurs

Driver2 dequeues the WDFREQUEST, processes the event and completes the WDFREQUST Driver1's completion event gets called. It calls WdfRequestUnmarkCancelable before completing the request where the bugcheck occurs.

Driver Verifier:

************************************************************
Driver Verifier detected violation:

A driver has called IoCallDriver without setting the CancelRoutine in
the Irp to NULL.
************************************************************

-----------BugCheck Details------------------

WDF_VIOLATION (10d) The Kernel-Mode Driver Framework was notified that Windows detected an error in a framework-based driver. In general, the dump file will yield additional information about the driver that caused this bug check.

Arguments: Arg1: 0000000000000006, A fatal error was made in handling a WDF request. In this case, Parameter 2 further specifies the type of fatal error that has been made, as defined by the enumeration WDF_REQUEST_FATAL_ERROR.

Arg2: 0000000000000005, An attempt was made to retrieve a request from the wrong queue.

Arg3: ffffb08a7b558e38, A pointer to an IO_CSQ_IRP_CONTEXT structure, which contains a pointer to the IRP and a pointer to the IRP's queue. The structure belongs to a WDF request object. Please see the driver's WDF logs for more information.

Arg4: ffffb08a7a9d3de0, Reserved.

Answer 1

You cannot send a request to another driver with a cancel routine set (wdm rule as well). You must mark it as uncancelable before sending it to another driver

---

d -- This posting is provided "AS IS" with no warranties, and confers no rights.

Answer 2

Thank you for pointing it out Doran. It was helpful as I could not find this restriction on MSDN. Are you aware what could be the possible reason for putting this restriction?

Also, since the request is driver owned for Driver1(as it is in its device context), what could be recommended way to handle the cancellation, in case UserApp cancels the request. Should request be queued in WDFQUEUE, for framework to handle it? Or explicit handling is not required since framework knows that the request has been forwarded.

Answer 3

The driver which owns the request (the last one to receive it from IoCallDriver) is the one that can mark it cancelable as it is the driver that be able to queue the IRP. Think through what it would mean for an upper layer driver to process the cancel in a cancel routine without any knowledge of the how the irp has been queued by the lower driver. It is up to the driver which received the IRP to handle the cancelation after your driver has forwarded the request.

---

d -- This posting is provided "AS IS" with no warranties, and confers no rights.