windows - BSOD with Bug Check 0x139 in RemoveEntryList -

we have developed wdm serial port driver based on (winddk 6) native serial com port driver.

but our customer has application triggering bsod when using our driver.

this application calls irp_mj_read continuously when button on program turned on, , bsod happened when program being closed without turning off button.

we have debugged windbg , found root cause removeentrylist , bug check code tells have called removeentrylist twice. see bug check 0x139.

after analyzing, can't see differences codes between our driver , winddk, native com1 not trigger bsod when runing application.

the related codes followings:

when program being closed, system call serialkillallreadsorwrites kill pending irps in readqueue.

void serialkillallreadsorwrites(     in pdevice_object deviceobject,     in plist_entry queuetoclean,     in pirp *currentopirp     ) {      kirql cancelirql;     pdriver_cancel cancelroutine;      ioacquirecancelspinlock(&cancelirql);      //     // clean list front.     //     while (!islistempty(queuetoclean)) {          pirp currentlastirp = containing_record(                                   queuetoclean->blink,                                   irp,                                   tail.overlay.listentry                                   );          removeentrylist(queuetoclean->blink);          cancelroutine = currentlastirp->cancelroutine;         currentlastirp->cancelirql = cancelirql;         currentlastirp->cancelroutine = null;         currentlastirp->cancel = true;          cancelroutine(             deviceobject,             currentlastirp             );               // <- call serialcancelqueued()          ioacquirecancelspinlock(&cancelirql);      }      .     .     . } void serialcancelqueued(     pdevice_object deviceobject,     pirp irp     ) {      pserial_device_extension extension = deviceobject->deviceextension;     pio_stack_location irpsp = iogetcurrentirpstacklocation(irp);      serial_locked_paged_code();      irp->iostatus.status = status_cancelled;     irp->iostatus.information = 0;     removeentrylist(&irp->tail.overlay.listentry); // <- bsod happened here!     .     .     . } 

we found first call of removeentrylist in serialkillallreadsorwrites , second call in serialcancelqueued going remove same entry.

and have tested if mark first removeentrylist, passed, no longer bsod.

but why native com doesn't trigger bsod calling removeentrylist twice remove same entry?

could me understand why? thanks.

i found removeentrylist in wdk8.1 different in wdk6. if build driver wdk6, windows not trigger bsod when call removeentrylist twice. however, if driver built wdk8.1, windows trigger bsod when call removeentrylist twice. so, maybe original codes in serialkillallreadsorwrites should modified avoid calling removeentrylist twice if want build driver wdk8.1.

// wdk6: forceinline boolean removeentrylist(     _in_ plist_entry entry     )  {      plist_entry blink;     plist_entry flink;      flink = entry->flink;     blink = entry->blink;     blink->flink = flink;     flink->blink = blink;     return (boolean)(flink == blink); }  // wdk 8.1 forceinline boolean removeentrylist(     _in_ plist_entry entry     )  {      plist_entry preventry;     plist_entry nextentry;      nextentry = entry->flink;     preventry = entry->blink;     if ((nextentry->blink != entry) || (preventry->flink != entry)) {         fatallistentryerror((pvoid)preventry,                             (pvoid)entry,                             (pvoid)nextentry);     }      preventry->flink = nextentry;     nextentry->blink = preventry;     return (boolean)(preventry == nextentry); }