Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTFSD

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

ExAllocatePool cause deadlock?

jgh0721jgh0721 Member Posts: 5

i'm developing minfilter driver( Isolation and Shadow FileObject ). but, currently in IRP_MJ_CLEANUP leads to deadlock.

------ windbg output, below print is summary

https://pastebin.com/HxDh2KCh

0: kd> !locks
**** DUMP OF ALL RESOURCE OBJECTS ****
KD: Scanning for held

Resource @ 0xffff9b88c1c27d80 Exclusively owned
Threads: ffff9b88beb24080-01<*>

0:kd> !stacks 2 imonfsd

                        [ffff9b88c1eef080 iMonFTS-SVC.ex]

13cc.0013e8 ffff9b88c20da080 00000ca READY nt!KxDispatchInterrupt+0x144
nt!KiDpcInterruptBypass+0x25
nt!KiInterruptDispatch+0xb1
nt!KeContextFromKframes+0x2f1
nt!KiDispatchException+0x127
nt!KiExceptionDispatch+0x12c
nt!KiPageFault+0x443
nt!ExpInterlockedPopEntrySListFault
iMonFSDd!ExAllocateFromNPagedLookasideList+0x29
iMonFSDd!CreateIrpContext+0x9d
iMonFSDd!FilterPreDisOwnCleanup+0x4e
iMonFSDd!FilterPreCleanup+0x76
FLTMGR!FltpPerformPreCallbacksWorker+0x36b
FLTMGR!FltpPassThroughInternal+0xc7
FLTMGR!FltpPassThrough+0x1d6
FLTMGR!FltpDispatch+0x8b
nt!IofCallDriver+0x55
nt!IopCloseFile+0x17a
nt!ObCloseHandleTableEntry+0x24c
nt!NtClose+0xec
nt!KiSystemServiceCopyEnd+0x28
nt!KiServiceLinkage
FLTMGR!FltpGetNormalizedFileNameWorker+0x261
FLTMGR!FltpCreateFileNameInformation+0x2eb
FLTMGR!HandleStreamListNotSupported+0x134
FLTMGR!FltpGetFileNameInformation+0x5c4
FLTMGR!FltGetFileNameInformation+0x101
WdFilter+0x27565
WdFilter+0x23ef0
FLTMGR!FltpPerformPreCallbacksWorker+0x36b
FLTMGR!FltpPassThroughInternal+0xc7
FLTMGR!FltpCreate+0x310
nt!IofCallDriver+0x55
nt!IoCallDriverWithTracing+0x34
nt!IopParseDevice+0x117d
nt!ObpLookupObjectName+0x3fe
nt!ObOpenObjectByNameEx+0x1fa
nt!IopCreateFile+0x40f
nt!NtCreateFile+0x79
nt!KiSystemServiceCopyEnd+0x28
ntdll!NtCreateFile+0x14

                        [ffff9b88c1f1f080 EXCEL.EXE]

21e0.0001c4 ffff9b88bedb0080 00000bc READY nt!KxDispatchInterrupt+0x144
nt!KiDpcInterrupt+0x2ee
nt!KeContextToKframes+0x68
nt!KiDispatchException+0x1a6
nt!KiExceptionDispatch+0x12c
nt!KiPageFault+0x443
nt!ExpInterlockedPopEntrySListFault
iMonFSDd!ExAllocateFromNPagedLookasideList+0x29
iMonFSDd!CommonPreCleanup+0x43
iMonFSDd!FilterPreCleanup+0xe5
FLTMGR!FltpPerformPreCallbacksWorker+0x36b
FLTMGR!FltpPassThroughInternal+0xc7
FLTMGR!FltpPassThrough+0x1d6
FLTMGR!FltpDispatch+0x8b
nt!IofCallDriver+0x55
nt!IopCloseFile+0x17a
nt!ObCloseHandleTableEntry+0x24c
nt!NtClose+0xec
nt!KiSystemServiceCopyEnd+0x28
ntdll!NtClose+0x14

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Writing WDF Drivers 24 January 2022 Live, Online
Internals & Software Drivers 7 February 2022 Live, Online
Kernel Debugging 21 March 2022 Live, Online
Developing Minifilters 23 May 2022 Live, Online