passthru发送原始帧，NdisFreeBuffer蓝屏

vv2007

passthru发送原始帧，NdisFreeBuffer蓝屏 [复制链接]

改写的passthru 在ndis5.1下实现发送原始帧，出现一个奇怪的问题。

PtDispatch中调用发送函数SendRawData，里面给自己的包做了一个标记，

完了以后在PtSendComplete里释放自己申请的内存。结果在调用NdisFreeBuffer的时候蓝屏。

具体描述如下：

1. 
   
2. NDIS_STATUS SendRawData(PADAPT adapt, PVOID buffer, ULONG length)
   
3. {
   
4.     NDIS_STATUS     status;
   
5.     PNDIS_PACKET    ndisPacket = NULL;
   
6.     PNDIS_BUFFER    ndisBuffer = NULL;
   
7.     PUCHAR          sendBuffer = NULL;
   
8. 
   
9.     PSEND_RSVD      sendRsvd = NULL;
   
10.     NDIS_PHYSICAL_ADDRESS highestAcceptableAddress;
    
11.     highestAcceptableAddress.QuadPart = -1;
    
12. 
    
13.     ASSERT(buffer != NULL);
    
14.     ASSERT(length >= ETH_MIN_PACKET_SIZE && length <= ETH_MAX_PACKET_SIZE);
    
15. 
    
16.     status = NdisAllocateMemory(&sendBuffer, length, 0, highestAcceptableAddress);
    
17.     //status = NdisAllocateMemoryWithTag (&sendBuffer, length, TAG);
    
18.     if (status != NDIS_STATUS_SUCCESS)
    
19.     {
    
20.         return status;
    
21.     }
    
22. 
    
23.     RtlZeroMemory(sendBuffer, length);
    
24.     RtlMoveMemory(sendBuffer, buffer, length);
    
25. 
    
26.     NdisAllocatePacket(&status, &ndisPacket, adapt->SendPacketPoolHandle);
    
27.     if (status != NDIS_STATUS_SUCCESS)
    
28.     {
    
29.         NdisFreeMemory(sendBuffer, length, 0);
    
30.         return status;
    
31.     }
    
32. 
    
33.     [color=#FF0000]NdisAllocateBuffer(&status, &ndisBuffer, adapt->SendPacketPoolHandle, &sendBuffer, length); [/color]
    
34.     //这里调试结果为SendRawData -> Allocate return: 0x81a2d6d8, 60
    
35.     // 马上QuerySafe一下结果返回值也是0xf????，跟下面崩溃前的数字一样
    
36. 
    
37.     DBGPRINT(("SendRawData -> Allocate return: 0x%x, %d\n", sendBuffer, length));
    
38. 
    
39.     if (status != NDIS_STATUS_SUCCESS)
    
40.     {
    
41.         NdisFreeMemory(sendBuffer, length, 0);
    
42.         NdisFreePacket(ndisPacket);
    
43.         return status;
    
44.     }
    
45. 
    
46.     NdisChainBufferAtFront(ndisPacket, ndisBuffer);
    
47. 
    
48.     sendRsvd = (PSEND_RSVD)(ndisPacket->ProtocolReserved);
    
49.     sendRsvd->OriginalPkt = (PNDIS_PACKET)1; //标记自己
    
50. 
    
51.     ndisPacket->Private.Head->Next = NULL;
    
52.     ndisPacket->Private.Tail = NULL;
    
53. 
    
54.     NdisSetPacketFlags(ndisPacket, NDIS_FLAGS_DONT_LOOPBACK);
    
55.     DBGPRINT(("SendRawData -> Now send!\n"));
    
56.     NdisSend(&status, adapt->BindingHandle, ndisPacket);
    
57.     if (status != STATUS_PENDING)
    
58.     {
    
59.         NdisUnchainBufferAtFront(ndisPacket, &ndisBuffer);
    
60.         NdisQueryBufferSafe(ndisBuffer, &sendBuffer, &length, NormalPagePriority);
    
61.         NdisFreeBuffer(ndisBuffer);
    
62.         NdisFreeMemory(sendBuffer, length, 0);
    
63.         NdisFreePacket(ndisPacket);
    
64.         DBGPRINT(("SendRawData -> Released!\n"));
    
65.     }
    
66. 
    
67.     DBGPRINT(("SendRawData -> Send succeeded!\n"));
    
68.     return status;
    
69. }
    
70. 
    
71. VOID
    
72. PtSendComplete(
    
73.     IN  NDIS_HANDLE            ProtocolBindingContext,
    
74.     IN  PNDIS_PACKET           Packet,
    
75.     IN  NDIS_STATUS            Status
    
76.     )
    
77. {
    
78.     PADAPT            pAdapt = (PADAPT)ProtocolBindingContext;
    
79.     PNDIS_PACKET      Pkt;
    
80.     NDIS_HANDLE       PoolHandle;
    
81. 
    
82.     // -------------------------------------------------------------------------
    
83.     PNDIS_BUFFER    ndisBuffer = NULL;
    
84.     PUCHAR          sendBuffer = NULL;
    
85.     ULONG           length;
    
86. 
    
87.     Pkt = ((PSEND_RSVD)(Packet->ProtocolReserved))->OriginalPkt;
    
88.     if ((int)Pkt == 1) // 是自己构建的包
    
89.     {
    
90.         DBGPRINT(("PtSendComplete -> Now free!\n"));
    
91.         NdisUnchainBufferAtFront(Packet, &ndisBuffer);
    
92. 
    
93.         NdisQueryBufferSafe(ndisBuffer, &sendBuffer, &length, NormalPagePriority);
    
94.         DBGPRINT(("PtSendComplete -> Query return: 0x%x, %d\n", sendBuffer, length));
    
95.         // 这里很奇怪，结果为PtSendComplete -> Query return: 0xf0f01b38, 60
    
96.         // 大小没错，问题是指向0x8???的变成了0xF?????
    
97. 
    
98.         NdisFreeBuffer(ndisBuffer);
    
99.         [color=#FF0000]NdisFreeMemory(sendBuffer, length, 0); //这里就蓝屏了[/color]
    
100.         // 注释掉这里就没问题了，问题是不是意味着内存泄漏了吧？NDIS 5.1
     
101. 
     
102.         NdisDprFreePacket(Packet);
     
103.         DBGPRINT(("PtSendComplete -> Free successed!\n"));
     
104.         return;
     
105.     }
     
106.     // -------------------------------------------------------------------------
     
107. 
     
108. #ifdef NDIS51
     
109.     //
     
110.     // Packet stacking:
     
111.     //
     
112.     // Determine if the packet we are completing is the one we allocated. If so, then
     
113.     // get the original packet from the reserved area and completed it and free the
     
114.     // allocated packet. If this is the packet that was sent down to us, then just
     
115.     // complete it
     
116.     //
     
117.     PoolHandle = NdisGetPoolFromPacket(Packet);
     
118.     if (PoolHandle != pAdapt->SendPacketPoolHandle)
     
119.     {
     
120.         //
     
121.         // We had passed down a packet belonging to the protocol above us.
     
122.         //
     
123.         // DBGPRINT(("PtSendComp: Adapt %p, Stacked Packet %p\n", pAdapt, Packet));
     
124. 
     
125.         NdisMSendComplete(pAdapt->MiniportHandle,
     
126.                           Packet,
     
127.                           Status);
     
128.     }
     
129.     else
     
130. #endif // NDIS51
     
131.     {
     
132.         PSEND_RSVD        SendRsvd;
     
133. 
     
134.         SendRsvd = (PSEND_RSVD)(Packet->ProtocolReserved);
     
135.         Pkt = SendRsvd->OriginalPkt;
     
136.    
     
137. #ifndef WIN9X
     
138.         NdisIMCopySendCompletePerPacketInfo (Pkt, Packet);
     
139. #endif
     
140.    
     
141.         NdisDprFreePacket(Packet);
     
142. 
     
143.         NdisMSendComplete(pAdapt->MiniportHandle,
     
144.                                  Pkt,
     
145.                                  Status);
     
146.     }
     
147.     //
     
148.     // Decrease the outstanding send count
     
149.     //
     
150.     ADAPT_DECR_PENDING_SENDS(pAdapt);
     
151. }
     

复制代码

很伤脑筋。希望各位大侠能指点一下，谢谢。

mymehis

NdisAllocateBuffer(&status, &ndisBuffer, adapt->SendPacketPoolHandle, &sendBuffer, length);

&sendBuffer应该是 sendBuffer 手抖了一下。。。调试了2天。郁闷