WskSocketConnect - 可能的内存损坏问题？

Question

我正在尝试使用驱动程序中的WinSock API连接到另一台计算机。问题是，WskSocketConnect（如果我沿着那条路线行进，则WskConnect）会因STATUS_INVALID_ADDRESS而失败。我的代码是：

#pragma warning(push)
#pragma warning(disable:4510)
#pragma warning(disable:4512)
#pragma warning(disable:4610)

#include <ntddk.h>
#include <wsk.h>

#pragma warning(pop)

const WSK_CLIENT_DISPATCH WskClientDispatch = {
    MAKE_WSK_VERSION(1, 0),
    0,
    NULL
};

WSK_REGISTRATION WskRegistration;

typedef struct _ASYNCHRONOUS_OPERATION_CONTEXT {
    KEVENT Event;
    PIRP Irp;
} ASYNCHRONOUS_OPERATION_CONTEXT, *PASYNCHRONOUS_OPERATION_CONTEXT;

extern "C" DRIVER_INITIALIZE DriverEntry;
extern "C" DRIVER_UNLOAD DriverUnload;
extern "C" KSTART_ROUTINE WorkerThread;
extern "C" IO_COMPLETION_ROUTINE SyncIrpCompletionRoutine;
extern "C" NTSTATUS WorkerThreadImpl();
extern "C" NTSTATUS InitializeAsynchronousOperationContext(PASYNCHRONOUS_OPERATION_CONTEXT Context);
extern "C" void FreeAsynchronousOperationContext(PASYNCHRONOUS_OPERATION_CONTEXT Context);
extern "C" void ReuseAsynchronousOperationContext(PASYNCHRONOUS_OPERATION_CONTEXT Context);
extern "C" NTSTATUS WaitForOperation(PASYNCHRONOUS_OPERATION_CONTEXT Context, NTSTATUS DispatchStatus);

NTSTATUS
    DriverEntry(
    __in PDRIVER_OBJECT DriverObject,
    __in PUNICODE_STRING RegistryPath
    );

VOID
    WorkerThread(
    __in PVOID Context
    );

VOID
    DriverUnload(
    __in PDRIVER_OBJECT DriverObject
    );

#ifdef ALLOC_PRAGMA

#pragma alloc_text(INIT, DriverEntry)
#pragma alloc_text(PAGE, DriverUnload)
#pragma alloc_text(PAGE, WorkerThread)
#pragma alloc_text(PAGE, WorkerThreadImpl)
#pragma alloc_text(PAGE, InitializeAsynchronousOperationContext)
#pragma alloc_text(PAGE, FreeAsynchronousOperationContext)
#pragma alloc_text(PAGE, ReuseAsynchronousOperationContext)
#pragma alloc_text(PAGE, WaitForOperation)

#endif

#define DATA_BUFFER_POOL_TAG 'wskt'

NTSTATUS
    DriverEntry(
    __in PDRIVER_OBJECT DriverObject,
    __in PUNICODE_STRING RegistryPath
    )
{
    NTSTATUS status;
    HANDLE threadHandle;
    WSK_CLIENT_NPI wskClientNpi;

    UNREFERENCED_PARAMETER(RegistryPath);

    PAGED_CODE();

    DbgPrint("Loading");

    wskClientNpi.ClientContext = NULL;
    wskClientNpi.Dispatch = &WskClientDispatch;
    status = WskRegister(&wskClientNpi, &WskRegistration);

    if (!NT_SUCCESS(status)) {
        return status;
    }

    status = PsCreateSystemThread(
        &threadHandle, THREAD_ALL_ACCESS, NULL, NULL, NULL,
        WorkerThread, NULL);

    if (!NT_SUCCESS(status)) {
        WskDeregister(&WskRegistration);
        return status;
    }

    ZwClose(threadHandle);

    DriverObject->DriverUnload = DriverUnload;

    DbgPrint("Loaded");

    return STATUS_SUCCESS;
}

VOID
    DriverUnload(
    __in PDRIVER_OBJECT DriverObject
    )
{  
    UNREFERENCED_PARAMETER(DriverObject);

    PAGED_CODE();

    DbgPrint("Unloading");
    WskDeregister(&WskRegistration);
    DbgPrint("Unloaded");
}

WSK_PROVIDER_NPI wskProviderNpi;
//CHAR Foo[10]; // padding
PCHAR DataBuffer;

USHORT htons(USHORT value)
{
    return value >> 8 | ((value & 0xff) << 8);
}

NTSTATUS InitializeAsynchronousOperationContext(PASYNCHRONOUS_OPERATION_CONTEXT Context)
{
    PAGED_CODE();

    Context->Irp = IoAllocateIrp(1, FALSE);
    if (Context->Irp == NULL) {
        return STATUS_INSUFFICIENT_RESOURCES;
    }

    KeInitializeEvent(&Context->Event, SynchronizationEvent, FALSE);

    IoSetCompletionRoutine(Context->Irp,
        SyncIrpCompletionRoutine,
        &Context->Event, TRUE, TRUE, TRUE);

    return STATUS_SUCCESS;
}

void FreeAsynchronousOperationContext(PASYNCHRONOUS_OPERATION_CONTEXT Context)
{
    PAGED_CODE();

    IoFreeIrp(Context->Irp);
}

void ReuseAsynchronousOperationContext(PASYNCHRONOUS_OPERATION_CONTEXT Context)
{
    PAGED_CODE();

    IoReuseIrp(Context->Irp, STATUS_UNSUCCESSFUL);
    IoSetCompletionRoutine(Context->Irp,
        SyncIrpCompletionRoutine,
        &Context->Event, TRUE, TRUE, TRUE);
}

NTSTATUS WaitForOperation(PASYNCHRONOUS_OPERATION_CONTEXT Context, NTSTATUS DispatchStatus)
{
    PAGED_CODE();

    if (DispatchStatus == STATUS_PENDING) {
        KeWaitForSingleObject(&Context->Event, Executive, KernelMode, FALSE, NULL);
    }

    return Context->Irp->IoStatus.Status;
}

NTSTATUS WorkerThreadImpl()
{
    PAGED_CODE();

    NTSTATUS status;

    status = WskCaptureProviderNPI(
        &WskRegistration, 
        WSK_INFINITE_WAIT,
        &wskProviderNpi);

    if (!NT_SUCCESS(status)) {
        DbgPrint("WskCaptureProviderNPI FAIL");
        return status;
    }

    DataBuffer = (PCHAR) ExAllocatePoolWithTag(NonPagedPool, PAGE_SIZE, DATA_BUFFER_POOL_TAG);
    if (DataBuffer == NULL) {
        WskReleaseProviderNPI(&WskRegistration);
        return STATUS_INSUFFICIENT_RESOURCES;
    }

    ASYNCHRONOUS_OPERATION_CONTEXT OperationContext;
    status = InitializeAsynchronousOperationContext(&OperationContext);
    if (!NT_SUCCESS(status)) {
        WskReleaseProviderNPI(&WskRegistration);
        ExFreePoolWithTag(DataBuffer, DATA_BUFFER_POOL_TAG);
        return status;
    }

    SOCKADDR_IN localAddr  = { AF_INET, 0, IN4ADDR_ANY_INIT };
    SOCKADDR_IN remoteAddr = { AF_INET, htons(7777), IN4ADDR_LOOPBACK_INIT };
    DbgPrint("%p", DataBuffer);

    status = wskProviderNpi.Dispatch->WskSocketConnect(&wskProviderNpi.Client,
        SOCK_STREAM, IPPROTO_TCP,
        (PSOCKADDR) &localAddr, (PSOCKADDR) &remoteAddr, 0,
        NULL, NULL, NULL, NULL, NULL,
        OperationContext.Irp);
    // BUGBUG here, DataBuffer has changed since the previous DbgPrint()
    DbgPrint("%p", DataBuffer);
    status = WaitForOperation(&OperationContext, status);

    if (NT_SUCCESS(status)) {
        PWSK_SOCKET socket = (PWSK_SOCKET) OperationContext.Irp->IoStatus.Information;
        PWSK_PROVIDER_CONNECTION_DISPATCH connectionDispatch = (PWSK_PROVIDER_CONNECTION_DISPATCH) socket->Dispatch;
        ReuseAsynchronousOperationContext(&OperationContext);
        status = connectionDispatch->Basic.WskCloseSocket(socket, OperationContext.Irp);
        status = WaitForOperation(&OperationContext, status);
    }

    FreeAsynchronousOperationContext(&OperationContext);

    WskReleaseProviderNPI(&WskRegistration);
    ExFreePoolWithTag(DataBuffer, DATA_BUFFER_POOL_TAG);
    return STATUS_SUCCESS;
}

VOID
    WorkerThread(
    __in PVOID Context
    )
{
    UNREFERENCED_PARAMETER(Context);

    PAGED_CODE();

    PsTerminateSystemThread(WorkerThreadImpl());
}

NTSTATUS
    SyncIrpCompletionRoutine(
    __in PDEVICE_OBJECT Reserved,
    __in PIRP Irp,
    _In_reads_opt_(_Inexpressible_("varies")) PVOID Context
    )
{    
    UNREFERENCED_PARAMETER(Reserved);
    UNREFERENCED_PARAMETER(Irp);

    ASSERT(Context != NULL);

    if (Irp->PendingReturned) {
        KeSetEvent((PKEVENT) Context, 2, FALSE);
    }

    return STATUS_MORE_PROCESSING_REQUIRED;
}

通话与0xc0000141（STATUS_INVALID_ADDRESS）同步失败。我确实有一个应用程序在localhost上侦听该端口，它的行为方式与远程计算机相同。

任何提示都将不胜感激！

编辑现在事情变得越来越怪异了。我用完整的文件更新了源代码。

我发现了WskSocketConnect的问题：我正在重构事情，我试图将WskCaptureProviderNPI和WskReleaseProviderNPI移动到另一个函数，我开始收到另一个错误。这很奇怪，所以我让WSK_PROVIDER_NPI全局 - 它有效。

稍后，我尝试在该套接字上发送消息，但我之前收到了两个字节的垃圾。经过几个小时和一些调试消息后，我注意到WskSocketConnect调用后缓冲区地址发生了变化。现在，缓冲区地址也是一个全局变量，在我的WSK_PROVIDER_NPI结构之后立即声明。添加一些填充（搜索“Foo”和“WorkerThread()”）会修复它。

现在怎么办？我对此完全不熟悉，但看起来内存损坏是由Wsk函数引起的，特别是因为我的代码不会在DriverEntry和WskSocketConnect调用之间运行。有什么想法吗？

这是在Windows 7 x64上。

更新2 我在代码开头禁用的编译警告如下：

warning C4510: '_WSK_TDI_MAP_INFO' : default constructor could not be generated
warning C4512: '_WSK_TDI_MAP_INFO' : assignment operator could not be generated
warning C4610: struct '_WSK_TDI_MAP_INFO' can never be instantiated - user defined constructor required

我想将文件编译为C会修复它们。

关于我的WSK_CLIENT_NPI，WskRegister的文档没有提到它应该保持有效（就像它对另一个参数一样）并且DDK中的echosrv样本也是如此事情。可以肯定的是，我尝试将其设为全局，但我也有同样的行为。

Answer 1

我不建议忽略或禁用警告，因为警告可以很好地指示可能无法按照您的意愿执行的代码。自豪地炫耀您的警告，我们将帮助您以标准方式删除它们。确保向我们显示警告所在的行以及警告消息。在我看来，好像你可能正在调用未定义的行为，警告可能会强调这一点。

带有前导下划线的标识符也可能很麻烦，因为此格式是为OS API，编译器和标准库保留的。请重命名_ASYNCHRONOUS_OPERATION_CONTEXT。

％p告诉DbgPrint（使用printf格式说明符）需要哪种指针？无效*。我建议做一些演员，以处理printf导致问题的不太可能的情况。

好像＆amp; wskProviderNpi.Client意味着引用与＆amp; wskClientNpi相同的对象。这里的问题是当DriverEntry返回时，wskClientNpi将被销毁，导致你提到的“STATUS_INVALID_ADDRESS”错误（以某种方式）。您是否尝试将wskClientNpi声明直接放在wskRegistration声明下面？