BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 0000000000000007, Attempt to free pool which was already freed
Arg2: 0000000000001200, (reserved)
Arg3: 000000001526d768, Memory contents of the pool block
Arg4: ffffe0011526d638, Address of the block of pool being deallocated
Debugging Details:
------------------
POOL_ADDRESS: ffffe0011526d638
FREED_POOL_TAG: Mdl
BUGCHECK_STR: 0xc2_7_Mdl
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff802784590ba to fffff802783cb590
哎,工作需要啊,领导已经下了死令,要跟QQ管家兼容才行,毕竟人家QQ管家财大气粗用户多啊,我好像定位到了一个错误,在TLInspectInjectComplete函数里,但是不是很肯定,WDK里面说这个completionFn里可以释放NET_BUFFER_LIST的啊,微软也是这么写的,真不知道这个完成函数里怎么写好了.
WDK:
The FWPS_INJECT_COMPLETE0 type is defined as a pointer to the completionFn function as follows:
The Status member of the NET_BUFFER_LIST structure pointed to by netBufferList indicates the result of the injection operation.
After packet data in a cloned or created NET_BUFFER_LIST structure chain has successfully been injected into the network stack by one of the packet injection functions, completionFn is called.
If the FwpsStreamInjectAsync0 function is called to inject a chain of NET_BUFFER_LIST structures, completionFn will be called once for each NET_BUFFER_LIST in the chain, each time using the same completionContext parameter specified in FwpsStreamInjectAsync0. In this case, the callout driver’s completionFn implementation should call FwpsFreeCloneNetBufferList0 to free the currently indicated NET_BUFFER_LIST.
The filter engine calls a callout's completionFn callout function at IRQL <= DISPATCH_LEVEL.
