From msdn:
Drivers that run in kernel mode must be very careful about directly reading from or writing to addresses in user space. This scenario illustrates why.
- A user-mode program initiates a request to read some data from a device. The program supplies the starting address of a buffer to receive the data.
- A device driver routine, running in kernel mode, starts the read operation and returns control to its caller.
- Later the device interrupts whatever thread is currently running to say that the read operation is complete. The interrupt is handled by kernel-mode driver routines running on this arbitrary thread, which belongs to an arbitrary process.
- At this point, the driver must not write the data to the starting address that the user-mode program supplied in Step 1. This address is in the virtual address space of the process that initiated the request, which is most likely not the same as the current process.
Can anybody explain this in other words? Points 2, 3, 4 are not very clear. Thanks.