Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTFSD

Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


FltClose hangs

MariushZdrabazdanskiMariushZdrabazdanski Member Posts: 9

Hi, I observe a hang when executing FltClose

To close, I create a WorkItem (I need IRQL = PASSIVE_LEVEL), where I call FltClose
This happens when the computer is turned off. If I unload the driver, then there is no problem

Has anyone encountered such a thing?
The stack is next:

Not impersonating
DeviceMap ffff9c8a73e35960
Owning Process ffff85066707e040 Image: System
Attached Process N/A Image: N/A
Wait Start TickCount 26915 Ticks: 212 (0:00:00:03.312)
Context Switch Count 74 IdealProcessor: 3 NoStackSwap
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address nt!ExpWorkerThread (0xfffff8060a2b8410)
Stack Init ffffac8e53756c90 Current ffffac8e53755770
Base ffffac8e53757000 Limit ffffac8e53751000 Call 0000000000000000
Priority 8 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP RetAddr Call Site
ffffac8e537557b0 fffff8060a20c800 nt!KiSwapContext+0x76
ffffac8e537558f0 fffff8060a20bd2f nt!KiSwapThread+0x500
ffffac8e537559a0 fffff8060a20b5d3 nt!KiCommitThreadWait+0x14f
ffffac8e53755a40 fffff8060a20e4ad nt!KeWaitForSingleObject+0x233
ffffac8e53755b30 fffff8060a20968a nt!ExpWaitForResource+0x6d
ffffac8e53755bb0 fffff8060a2090f4 nt!ExpAcquireResourceSharedLite+0x4da
ffffac8e53755c70 fffff8060ea9fe9d nt!ExAcquireResourceSharedLite+0x44
ffffac8e53755cb0 fffff8060ea5e6f4 Ntfs!NtfsAcquireSharedVcb+0x3d
ffffac8e53755cf0 fffff8060ea5540d Ntfs!NtfsCommonCleanup+0x2e4
ffffac8e537561a0 fffff8060a28f6f5 Ntfs!NtfsFsdCleanup+0x1bd
ffffac8e537564f0 fffff8060dd46c5f nt!IofCallDriver+0x55
ffffac8e53756530 fffff8060dd44673 FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x28f
ffffac8e537565a0 fffff8060a28f6f5 FLTMGR!FltpDispatch+0xa3
ffffac8e53756600 fffff8060a675d4a nt!IofCallDriver+0x55
ffffac8e53756640 fffff8060a5f39cf nt!IopCloseFile+0x17a
ffffac8e537566d0 fffff8060a5f79ac nt!ObCloseHandleTableEntry+0x51f
ffffac8e53756810 fffff8060a408bb5 nt!NtClose+0xec
ffffac8e53756880 fffff8060a3fb010 nt!KiSystemServiceCopyEnd+0x25 (TrapFrame @ ffffac8e53756880) ffffac8e53756a18 fffff8060dd84cf0 nt!KiServiceLinkage ffffac8e53756a20 fffff806116e79e7 FLTMGR!FltClose+0x10 ffffac8e53756a50 fffff806116e792b MyDriver!FreeResources+0x77 ffffac8e53756aa0 fffff8060dd80567 MyDriver!FreeResourceWorkItemRoutine+0x9b ffffac8e53756ae0 fffff8060a2b8515 FLTMGR!FltpProcessGenericWorkItem+0xa7 ffffac8e53756b70 fffff8060a355855 nt!ExpWorkerThread+0x105 ffffac8e53756c10 fffff8060a3fe808 nt!PspSystemThreadStartup+0x55 ffffac8e53756c60 00000000`00000000 nt!KiStartSystemThread+0x28

Comments

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 30 January 2023 Live, Online
Developing Minifilters 20 March 2023 Live, Online
Writing WDF Drivers TBD 2023 Live, Online
Internals & Software Drivers 17 April 2023 Live, Online