Repository navigation
driver: look up registry redirects at PASSIVE_LEVEL - #155
Draft
eiz-claude wants to merge 2 commits into
Draft
eiz-claude wants to merge 2 commits into
eiz-claude wants to merge 2 commits into
Conversation
Adds an app-routing scenario to the issues group: SarAsio's COM classes registered and a loopback run whose configuration turns application routing on. That starts the driver's registry filter, which then sees every registry value query on the machine, and sends the harness's own WASAPI client through SarAsio's device enumerator wrapper. SarTest gains --app-routing for the configuration it writes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
With application routing on, the driver's registry callback runs for every registry value query on the machine. It looked the key up in the redirect tables under a spin lock, at DISPATCH_LEVEL, but the table's comparison routine calls RtlCompareUnicodeString, which is pageable (and the key was copied to nonpaged memory first only because of the lock). When that code was paged out, the lookup bugchecked with IRQL_NOT_LESS_OR_EQUAL. Under Driver Verifier it happens on the first registry query after a host turns application routing on: IRQL_NOT_LESS_OR_EQUAL (a), process taskhostw.exe nt!RtlCompareUnicodeString SynchronousAudioRouter!SarCompareStringTableEntry+0x16 nt!RtlLookupElementGenericTableAvl+0xec SynchronousAudioRouter!SarGetStringTableEntry+0x21 SynchronousAudioRouter!SarFilterMatchesPath+0x7a SynchronousAudioRouter!SarRegistryCallback+0x6d nt!CmpCallCallBacksEx+0x283 Guard the tables with an ERESOURCE instead, as the old TODO suggested, and look up the configuration manager's path directly. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
eiz-claude
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
With per-app routing on, SAR's registry filter bugchecks the machine under Driver Verifier. Without Verifier it can crash whenever the code involved happens to be paged out.
Once a host starts with
enableApplicationRouting, the driver's registry callback runs for every registry value query on the machine.SarFilterMatchesPathlooked the key up in the redirect tables under anEX_SPIN_LOCK, which raises IRQL to DISPATCH_LEVEL. The table's compare routine callsRtlCompareUnicodeString, which is pageable. The key was copied to nonpaged memory first, but only to work around the spin lock; a TODO there already suggested an ERESOURCE. With Verifier on, the first registry query after the host starts crashed the test VM:The fix guards the tables with an ERESOURCE: shared for lookups, exclusive at unload. The configuration manager's path is now used directly.
I haven't matched this against any open issue. Bugcheck 0xA in
SarCompareStringTableEntrywould be the signature in a reporter's dump.Test
New
app-routingscenario in the issues group:The suite never turned application routing on before this, which is why it never hit this.
🤖 Generated with Claude Code