Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
Hi, I observe a hang when executing FltClose
To close, I create a WorkItem (I need IRQL = PASSIVE_LEVEL), where I call FltClose
This happens when the computer is turned off. If I unload the driver, then there is no problem
Has anyone encountered such a thing?
The stack is next:
Not impersonating
DeviceMap ffff9c8a73e35960
Owning Process ffff85066707e040 Image: System
Attached Process N/A Image: N/A
Wait Start TickCount 26915 Ticks: 212 (0:00:00:03.312)
Context Switch Count 74 IdealProcessor: 3 NoStackSwap
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address nt!ExpWorkerThread (0xfffff8060a2b8410)
Stack Init ffffac8e53756c90 Current ffffac8e53755770
Base ffffac8e53757000 Limit ffffac8e53751000 Call 0000000000000000
Priority 8 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP RetAddr Call Site
ffffac8e537557b0 fffff806
0a20c800 nt!KiSwapContext+0x76
ffffac8e537558f0 fffff806
0a20bd2f nt!KiSwapThread+0x500
ffffac8e537559a0 fffff806
0a20b5d3 nt!KiCommitThreadWait+0x14f
ffffac8e53755a40 fffff806
0a20e4ad nt!KeWaitForSingleObject+0x233
ffffac8e53755b30 fffff806
0a20968a nt!ExpWaitForResource+0x6d
ffffac8e53755bb0 fffff806
0a2090f4 nt!ExpAcquireResourceSharedLite+0x4da
ffffac8e53755c70 fffff806
0ea9fe9d nt!ExAcquireResourceSharedLite+0x44
ffffac8e53755cb0 fffff806
0ea5e6f4 Ntfs!NtfsAcquireSharedVcb+0x3d
ffffac8e53755cf0 fffff806
0ea5540d Ntfs!NtfsCommonCleanup+0x2e4
ffffac8e537561a0 fffff806
0a28f6f5 Ntfs!NtfsFsdCleanup+0x1bd
ffffac8e537564f0 fffff806
0dd46c5f nt!IofCallDriver+0x55
ffffac8e53756530 fffff806
0dd44673 FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x28f
ffffac8e537565a0 fffff806
0a28f6f5 FLTMGR!FltpDispatch+0xa3
ffffac8e53756600 fffff806
0a675d4a nt!IofCallDriver+0x55
ffffac8e53756640 fffff806
0a5f39cf nt!IopCloseFile+0x17a
ffffac8e537566d0 fffff806
0a5f79ac nt!ObCloseHandleTableEntry+0x51f
ffffac8e53756810 fffff806
0a408bb5 nt!NtClose+0xec
ffffac8e53756880 fffff806
0a3fb010 nt!KiSystemServiceCopyEnd+0x25 (TrapFrame @ ffffac8e53756880) ffffac8e
53756a18 fffff8060dd84cf0 nt!KiServiceLinkage ffffac8e
53756a20 fffff806116e79e7 FLTMGR!FltClose+0x10 ffffac8e
53756a50 fffff806116e792b MyDriver!FreeResources+0x77 ffffac8e
53756aa0 fffff8060dd80567 MyDriver!FreeResourceWorkItemRoutine+0x9b ffffac8e
53756ae0 fffff8060a2b8515 FLTMGR!FltpProcessGenericWorkItem+0xa7 ffffac8e
53756b70 fffff8060a355855 nt!ExpWorkerThread+0x105 ffffac8e
53756c10 fffff8060a3fe808 nt!PspSystemThreadStartup+0x55 ffffac8e
53756c60 00000000`00000000 nt!KiStartSystemThread+0x28
Upcoming OSR Seminars | ||
---|---|---|
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead! | ||
Kernel Debugging | 9-13 Sept 2024 | Live, Online |
Developing Minifilters | 15-19 July 2024 | Live, Online |
Internals & Software Drivers | 11-15 Mar 2024 | Live, Online |
Writing WDF Drivers | 20-24 May 2024 | Live, Online |
Comments
Run !locks and see which thread currently owns the VCB resource.
-scott
OSR