none
what happens to I/O presented to driver when application crashes RRS feed

  • Question

  • I have a user application that crashes for some reason after sending an IOCTL and before the request is completed by the driver.

    After the application crash , I expected a BSOD when I assigned some value to the IOCTL's output buffer .

    But the driver didnt panic . 

    Can someone let me know the sequence of events that happen to an I/O presented to the driver by the framework , after the application crash ?

    or point me to a resource explaining this ..

    TIA !


    RJ

    Tuesday, October 1, 2019 9:40 AM

Answers

  • Basically, an application crash will at some point be seen as an application termination.  At that point the system will cancel the I/O requests that have not been completed.


    Don Burn Windows Driver Consulting Website: http://www.windrvr.com

    Tuesday, October 1, 2019 6:03 PM
  • ... or Windows will wait for some time for outstanding canceled I/Os to complete. If the driver completes them until the timeout, then OK. Especially, if the I/O is buffered, the buffer is allocated in the kernel so it does not pin the app address space down.

    -- pa


    Tuesday, October 1, 2019 6:47 PM
  • If you are using METHOD_BUFFERED, then the I/O system has allocated a kernel-mode buffer for you to fill.  It doesn't matter that the application has gone away.  When you complete the ioctl, the system will notice the app is gone, and just won't copy it back.

    If you are using METHOD_IN_DIRECT or METHOD_OUT_DIRECT, then the system has locked all of the pages in the output buffer.  Even if the application goes away, those pages will remain available.  When you complete the ioctl. the pages are unlocked and freed.


    Tim Roberts | Driver MVP Emeritus | Providenza & Boekelheide, Inc.

    Wednesday, October 2, 2019 4:33 AM

All replies

  • Basically, an application crash will at some point be seen as an application termination.  At that point the system will cancel the I/O requests that have not been completed.


    Don Burn Windows Driver Consulting Website: http://www.windrvr.com

    Tuesday, October 1, 2019 6:03 PM
  • ... or Windows will wait for some time for outstanding canceled I/Os to complete. If the driver completes them until the timeout, then OK. Especially, if the I/O is buffered, the buffer is allocated in the kernel so it does not pin the app address space down.

    -- pa


    Tuesday, October 1, 2019 6:47 PM
  • If you are using METHOD_BUFFERED, then the I/O system has allocated a kernel-mode buffer for you to fill.  It doesn't matter that the application has gone away.  When you complete the ioctl, the system will notice the app is gone, and just won't copy it back.

    If you are using METHOD_IN_DIRECT or METHOD_OUT_DIRECT, then the system has locked all of the pages in the output buffer.  Even if the application goes away, those pages will remain available.  When you complete the ioctl. the pages are unlocked and freed.


    Tim Roberts | Driver MVP Emeritus | Providenza & Boekelheide, Inc.

    Wednesday, October 2, 2019 4:33 AM