From 5778c65af08b68ef4cce309212926dfcebc73d89 Mon Sep 17 00:00:00 2001 From: David Spruill Date: Thu, 8 Jan 2026 17:39:13 -0500 Subject: [PATCH 1/4] Correct a buggy sample --- video/KMDOD/bdd.hxx | 12 +++--------- video/KMDOD/bdd_ddi.cxx | 2 +- video/KMDOD/blthw.cxx | 2 +- video/KMDOD/memory.cxx | 14 ++++---------- 4 files changed, 9 insertions(+), 21 deletions(-) diff --git a/video/KMDOD/bdd.hxx b/video/KMDOD/bdd.hxx index 61c40e034..7ea38b349 100644 --- a/video/KMDOD/bdd.hxx +++ b/video/KMDOD/bdd.hxx @@ -626,18 +626,12 @@ IsEdidChecksumValid(_In_reads_bytes_(EDID_V1_BLOCK_SIZE) const BYTE* pEdid); // Memory handling // -// Defaulting the value of PoolType means that any call to new Foo() +// Requiring POOL_FLAGS means that any call to new Foo() // will raise a compiler error for being ambiguous. This is to help keep // any calls to allocate memory from accidentally NOT going through // these functions. -_When_((PoolType & NonPagedPoolMustSucceed) != 0, - __drv_reportError("Must succeed pool allocations are forbidden. " - "Allocation failures cause a system crash")) -void* __cdecl operator new(size_t Size, POOL_TYPE PoolType = PagedPool); -_When_((PoolType & NonPagedPoolMustSucceed) != 0, - __drv_reportError("Must succeed pool allocations are forbidden. " - "Allocation failures cause a system crash")) -void* __cdecl operator new[](size_t Size, POOL_TYPE PoolType = PagedPool); +void* __cdecl operator new(size_t Size, POOL_FLAGS Flags); +void* __cdecl operator new[](size_t Size, POOL_FLAGS Flags); void __cdecl operator delete(void* pObject); void __cdecl operator delete(void* pObject, size_t s); void __cdecl operator delete[](void* pObject); diff --git a/video/KMDOD/bdd_ddi.cxx b/video/KMDOD/bdd_ddi.cxx index 5a53a3be6..924758c55 100644 --- a/video/KMDOD/bdd_ddi.cxx +++ b/video/KMDOD/bdd_ddi.cxx @@ -103,7 +103,7 @@ BddDdiAddDevice( } *ppDeviceContext = NULL; - BASIC_DISPLAY_DRIVER* pBDD = new(NonPagedPoolNx) BASIC_DISPLAY_DRIVER(pPhysicalDeviceObject); + BASIC_DISPLAY_DRIVER* pBDD = new(POOL_FLAG_NON_PAGED) BASIC_DISPLAY_DRIVER(pPhysicalDeviceObject); if (pBDD == NULL) { BDD_LOG_LOW_RESOURCE0("pBDD failed to be allocated"); diff --git a/video/KMDOD/blthw.cxx b/video/KMDOD/blthw.cxx index 2e6d2e5d8..b2f824927 100644 --- a/video/KMDOD/blthw.cxx +++ b/video/KMDOD/blthw.cxx @@ -282,7 +282,7 @@ BDD_HWBLT::ExecutePresentDisplayOnly( SIZE_T size = sizeof(DoPresentMemory) + sizeMoves + sizeRects; DoPresentMemory* ctx = reinterpret_cast - (new (PagedPool) BYTE[size]); + (new (POOL_FLAG_PAGED) BYTE[size]); if (!ctx) { diff --git a/video/KMDOD/memory.cxx b/video/KMDOD/memory.cxx index aae795dfb..73dabcf8b 100644 --- a/video/KMDOD/memory.cxx +++ b/video/KMDOD/memory.cxx @@ -14,16 +14,13 @@ // // New and delete operators // -_When_((PoolType & NonPagedPoolMustSucceed) != 0, - __drv_reportError("Must succeed pool allocations are forbidden. " - "Allocation failures cause a system crash")) -void* __cdecl operator new(size_t Size, POOL_TYPE PoolType) +void* __cdecl operator new(size_t Size, POOL_FLAGS Flags) { PAGED_CODE(); Size = (Size != 0) ? Size : 1; - void* pObject = ExAllocatePoolWithTag(PoolType, Size, BDDTAG); + void* pObject = ExAllocatePool2(Flags, Size, BDDTAG); #if DBG if (pObject != NULL) @@ -35,16 +32,13 @@ void* __cdecl operator new(size_t Size, POOL_TYPE PoolType) return pObject; } -_When_((PoolType & NonPagedPoolMustSucceed) != 0, - __drv_reportError("Must succeed pool allocations are forbidden. " - "Allocation failures cause a system crash")) -void* __cdecl operator new[](size_t Size, POOL_TYPE PoolType) +void* __cdecl operator new[](size_t Size, POOL_FLAGS Flags) { PAGED_CODE(); Size = (Size != 0) ? Size : 1; - void* pObject = ExAllocatePoolWithTag(PoolType, Size, BDDTAG); + void* pObject = ExAllocatePool2(Flags, Size, BDDTAG); #if DBG if (pObject != NULL) From f88e4fbbd4d2671e5cd77e4f60be7a235326797e Mon Sep 17 00:00:00 2001 From: David Spruill Date: Thu, 8 Jan 2026 17:48:46 -0500 Subject: [PATCH 2/4] Restore the default parameter entries on the new calls to cause compiler errors for ambiguous allocations --- video/KMDOD/bdd.hxx | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/video/KMDOD/bdd.hxx b/video/KMDOD/bdd.hxx index 7ea38b349..5bfcb6f41 100644 --- a/video/KMDOD/bdd.hxx +++ b/video/KMDOD/bdd.hxx @@ -626,12 +626,12 @@ IsEdidChecksumValid(_In_reads_bytes_(EDID_V1_BLOCK_SIZE) const BYTE* pEdid); // Memory handling // -// Requiring POOL_FLAGS means that any call to new Foo() +// Defaulting the value of Flags means that any call to new Foo() // will raise a compiler error for being ambiguous. This is to help keep // any calls to allocate memory from accidentally NOT going through // these functions. -void* __cdecl operator new(size_t Size, POOL_FLAGS Flags); -void* __cdecl operator new[](size_t Size, POOL_FLAGS Flags); +void* __cdecl operator new(size_t Size, POOL_FLAGS Flags = POOL_FLAG_PAGED); +void* __cdecl operator new[](size_t Size, POOL_FLAGS Flags = POOL_FLAG_PAGED); void __cdecl operator delete(void* pObject); void __cdecl operator delete(void* pObject, size_t s); void __cdecl operator delete[](void* pObject); From 612387cd2ed425dc873b269f2e945633b8cd7119 Mon Sep 17 00:00:00 2001 From: David Spruill Date: Mon, 20 Jul 2026 17:32:08 -0400 Subject: [PATCH 3/4] fix memory allocation --- video/KMDOD/bdd_ddi.cxx | 3 ++- video/KMDOD/blthw.cxx | 3 +-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/video/KMDOD/bdd_ddi.cxx b/video/KMDOD/bdd_ddi.cxx index 924758c55..cdbe8594b 100644 --- a/video/KMDOD/bdd_ddi.cxx +++ b/video/KMDOD/bdd_ddi.cxx @@ -103,7 +103,8 @@ BddDdiAddDevice( } *ppDeviceContext = NULL; - BASIC_DISPLAY_DRIVER* pBDD = new(POOL_FLAG_NON_PAGED) BASIC_DISPLAY_DRIVER(pPhysicalDeviceObject); + void* pBDDMemory = operator new(sizeof(BASIC_DISPLAY_DRIVER), POOL_FLAG_NON_PAGED); + BASIC_DISPLAY_DRIVER* pBDD = pBDDMemory ? new(pBDDMemory) BASIC_DISPLAY_DRIVER(pPhysicalDeviceObject) : NULL; if (pBDD == NULL) { BDD_LOG_LOW_RESOURCE0("pBDD failed to be allocated"); diff --git a/video/KMDOD/blthw.cxx b/video/KMDOD/blthw.cxx index b2f824927..0b1ff0b18 100644 --- a/video/KMDOD/blthw.cxx +++ b/video/KMDOD/blthw.cxx @@ -281,8 +281,7 @@ BDD_HWBLT::ExecutePresentDisplayOnly( SIZE_T sizeRects = NumDirtyRects*sizeof(RECT); SIZE_T size = sizeof(DoPresentMemory) + sizeMoves + sizeRects; - DoPresentMemory* ctx = reinterpret_cast - (new (POOL_FLAG_PAGED) BYTE[size]); + DoPresentMemory* ctx = reinterpret_cast(operator new[](size, POOL_FLAG_PAGED)); if (!ctx) { From 47e616d951b7a5aa379d7727d394d9ddc08ebd3b Mon Sep 17 00:00:00 2001 From: David Spruill Date: Mon, 20 Jul 2026 17:46:19 -0400 Subject: [PATCH 4/4] Fix memory tagging part 2 --- video/KMDOD/bdd.hxx | 14 +++++++++++--- video/KMDOD/bdd_ddi.cxx | 3 +-- video/KMDOD/blthw.cxx | 3 ++- video/KMDOD/memory.cxx | 24 ++++++++++++++++++++++-- 4 files changed, 36 insertions(+), 8 deletions(-) diff --git a/video/KMDOD/bdd.hxx b/video/KMDOD/bdd.hxx index 5bfcb6f41..8fd3cdbb0 100644 --- a/video/KMDOD/bdd.hxx +++ b/video/KMDOD/bdd.hxx @@ -626,12 +626,20 @@ IsEdidChecksumValid(_In_reads_bytes_(EDID_V1_BLOCK_SIZE) const BYTE* pEdid); // Memory handling // -// Defaulting the value of Flags means that any call to new Foo() +enum class BDD_POOL_TYPE +{ + Paged, + NonPaged +}; + +// Defaulting the value of PoolType means that any call to new Foo() // will raise a compiler error for being ambiguous. This is to help keep // any calls to allocate memory from accidentally NOT going through // these functions. -void* __cdecl operator new(size_t Size, POOL_FLAGS Flags = POOL_FLAG_PAGED); -void* __cdecl operator new[](size_t Size, POOL_FLAGS Flags = POOL_FLAG_PAGED); +void* __cdecl operator new(size_t Size, BDD_POOL_TYPE PoolType = BDD_POOL_TYPE::Paged); +void* __cdecl operator new[](size_t Size, BDD_POOL_TYPE PoolType = BDD_POOL_TYPE::Paged); +void __cdecl operator delete(void* pObject, BDD_POOL_TYPE PoolType); +void __cdecl operator delete[](void* pObject, BDD_POOL_TYPE PoolType); void __cdecl operator delete(void* pObject); void __cdecl operator delete(void* pObject, size_t s); void __cdecl operator delete[](void* pObject); diff --git a/video/KMDOD/bdd_ddi.cxx b/video/KMDOD/bdd_ddi.cxx index cdbe8594b..f5f51cf88 100644 --- a/video/KMDOD/bdd_ddi.cxx +++ b/video/KMDOD/bdd_ddi.cxx @@ -103,8 +103,7 @@ BddDdiAddDevice( } *ppDeviceContext = NULL; - void* pBDDMemory = operator new(sizeof(BASIC_DISPLAY_DRIVER), POOL_FLAG_NON_PAGED); - BASIC_DISPLAY_DRIVER* pBDD = pBDDMemory ? new(pBDDMemory) BASIC_DISPLAY_DRIVER(pPhysicalDeviceObject) : NULL; + BASIC_DISPLAY_DRIVER* pBDD = new(BDD_POOL_TYPE::NonPaged) BASIC_DISPLAY_DRIVER(pPhysicalDeviceObject); if (pBDD == NULL) { BDD_LOG_LOW_RESOURCE0("pBDD failed to be allocated"); diff --git a/video/KMDOD/blthw.cxx b/video/KMDOD/blthw.cxx index 0b1ff0b18..f9e8a51bb 100644 --- a/video/KMDOD/blthw.cxx +++ b/video/KMDOD/blthw.cxx @@ -281,7 +281,8 @@ BDD_HWBLT::ExecutePresentDisplayOnly( SIZE_T sizeRects = NumDirtyRects*sizeof(RECT); SIZE_T size = sizeof(DoPresentMemory) + sizeMoves + sizeRects; - DoPresentMemory* ctx = reinterpret_cast(operator new[](size, POOL_FLAG_PAGED)); + DoPresentMemory* ctx = reinterpret_cast + (new (BDD_POOL_TYPE::Paged) BYTE[size]); if (!ctx) { diff --git a/video/KMDOD/memory.cxx b/video/KMDOD/memory.cxx index 49e565531..54f6a6dc0 100644 --- a/video/KMDOD/memory.cxx +++ b/video/KMDOD/memory.cxx @@ -14,11 +14,12 @@ // // New and delete operators // -void* __cdecl operator new(size_t Size, POOL_FLAGS Flags) +void* __cdecl operator new(size_t Size, BDD_POOL_TYPE PoolType) { PAGED_CODE(); Size = (Size != 0) ? Size : 1; + POOL_FLAGS Flags = PoolType == BDD_POOL_TYPE::NonPaged ? POOL_FLAG_NON_PAGED : POOL_FLAG_PAGED; // Note that ExAllocatePool2 replaces ExAllocatePool* APIs in OS's starting // with Windows 10, version 2004. If your driver targets previous versions it @@ -35,11 +36,12 @@ void* __cdecl operator new(size_t Size, POOL_FLAGS Flags) return pObject; } -void* __cdecl operator new[](size_t Size, POOL_FLAGS Flags) +void* __cdecl operator new[](size_t Size, BDD_POOL_TYPE PoolType) { PAGED_CODE(); Size = (Size != 0) ? Size : 1; + POOL_FLAGS Flags = PoolType == BDD_POOL_TYPE::NonPaged ? POOL_FLAG_NON_PAGED : POOL_FLAG_PAGED; void* pObject = ExAllocatePool2(Flags, Size, BDDTAG); @@ -53,6 +55,24 @@ void* __cdecl operator new[](size_t Size, POOL_FLAGS Flags) return pObject; } +void __cdecl operator delete(void* pObject, BDD_POOL_TYPE PoolType) +{ + PAGED_CODE(); + + UNREFERENCED_PARAMETER(PoolType); + + ::operator delete(pObject); +} + +void __cdecl operator delete[](void* pObject, BDD_POOL_TYPE PoolType) +{ + PAGED_CODE(); + + UNREFERENCED_PARAMETER(PoolType); + + ::operator delete[](pObject); +} + void __cdecl operator delete(void* pObject) { PAGED_CODE();