BugCheck CE in Mini Filter

I am getting the bug check
DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS (ce) when stopping a
mini filter! I thought this was not supposed to happen!

The stack trace only indicates the call to the driver and the exception
following. To my knowledge I have no outstanding operations, how can I
determine what operation was actually pending?

I am running XP with sp2.

Thanks,

Ken

Ken,

You are correct; this is not supposed to happen. Are you able to
consistently reproduce this?

I will have to look at the verifier code to see how they are detecting
this situation before I can give you and idea on how to track this down.

Neal Christiansen
Microsoft File System Filter Group Lead
This posting is provided “AS IS” with no warranties, and confers no
Rights


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ken Galipeau
Sent: Wednesday, April 13, 2005 6:14 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] BugCheck CE in Mini Filter

I am getting the bug check
DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS (ce) when stopping
a mini filter! I thought this was not supposed to happen!

The stack trace only indicates the call to the driver and the exception
following. To my knowledge I have no outstanding operations, how can I
determine what operation was actually pending?

I am running XP with sp2.

Thanks,
Ken


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

I met and fixed such stop error several days before. I hooked/substituted a system function and accidently commented out unhook in the unload routine. Once unhook got back; the error gone.

Best Regards
Raymond Zhang
xxxxx@intel.com

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Neal Christiansen
Sent: 2005??4??14?? 15:29
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] BugCheck CE in Mini Filter

Ken,

You are correct; this is not supposed to happen. Are you able to
consistently reproduce this?

I will have to look at the verifier code to see how they are detecting
this situation before I can give you and idea on how to track this down.

Neal Christiansen
Microsoft File System Filter Group Lead
This posting is provided “AS IS” with no warranties, and confers no
Rights


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ken Galipeau
Sent: Wednesday, April 13, 2005 6:14 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] BugCheck CE in Mini Filter

I am getting the bug check
DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS (ce) when stopping
a mini filter! I thought this was not supposed to happen!

The stack trace only indicates the call to the driver and the exception
following. To my knowledge I have no outstanding operations, how can I
determine what operation was actually pending?

I am running XP with sp2.

Thanks,
Ken


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

You cannot unload any driver which have installed hooks. You cannot unhook.
The thing is that there is no ways of preventing the driver unload while
the hook code is executing inside it.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Zhang, Raymond”
To: “Windows File Systems Devs Interest List”
Sent: Thursday, April 14, 2005 11:42 AM
Subject: RE: [ntfsd] BugCheck CE in Mini Filter

I met and fixed such stop error several days before. I hooked/substituted a
system function and accidently commented out unhook in the unload routine. Once
unhook got back; the error gone.

Best Regards
Raymond Zhang
xxxxx@intel.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Neal Christiansen
Sent: 2005Äê4ÔÂ14ÈÕ 15:29
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] BugCheck CE in Mini Filter

Ken,

You are correct; this is not supposed to happen. Are you able to
consistently reproduce this?

I will have to look at the verifier code to see how they are detecting
this situation before I can give you and idea on how to track this down.

Neal Christiansen
Microsoft File System Filter Group Lead
This posting is provided “AS IS” with no warranties, and confers no
Rights
________________________________________
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ken Galipeau
Sent: Wednesday, April 13, 2005 6:14 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] BugCheck CE in Mini Filter

I am getting the bug check
DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS (ce) when stopping
a mini filter! I thought this was not supposed to happen!

The stack trace only indicates the call to the driver and the exception
following. To my knowledge I have no outstanding operations, how can I
determine what operation was actually pending?

I am running XP with sp2.

Thanks,
Ken


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Agree. Bur for my driver is to hook a function exported by KS (not as busy as FSD). I can unhook, stop, and hook again without error so far.

Best Regards
Raymond

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Maxim S. Shatskih
Sent: 2005??4??14?? 16:27
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] BugCheck CE in Mini Filter

You cannot unload any driver which have installed hooks. You cannot unhook.
The thing is that there is no ways of preventing the driver unload while
the hook code is executing inside it.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Zhang, Raymond”
To: “Windows File Systems Devs Interest List”
Sent: Thursday, April 14, 2005 11:42 AM
Subject: RE: [ntfsd] BugCheck CE in Mini Filter

I met and fixed such stop error several days before. I hooked/substituted a
system function and accidently commented out unhook in the unload routine. Once
unhook got back; the error gone.

Best Regards
Raymond Zhang
xxxxx@intel.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Neal Christiansen
Sent: 2005??4??14?? 15:29
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] BugCheck CE in Mini Filter

Ken,

You are correct; this is not supposed to happen. Are you able to
consistently reproduce this?

I will have to look at the verifier code to see how they are detecting
this situation before I can give you and idea on how to track this down.

Neal Christiansen
Microsoft File System Filter Group Lead
This posting is provided “AS IS” with no warranties, and confers no
Rights
________________________________________
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ken Galipeau
Sent: Wednesday, April 13, 2005 6:14 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] BugCheck CE in Mini Filter

I am getting the bug check
DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS (ce) when stopping
a mini filter! I thought this was not supposed to happen!

The stack trace only indicates the call to the driver and the exception
following. To my knowledge I have no outstanding operations, how can I
determine what operation was actually pending?

I am running XP with sp2.

Thanks,
Ken


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@intel.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

>Agree. Bur for my driver is to hook a function exported by KS

(not as busy as FSD). I can unhook, stop, and hook again

Why ever unload? The memory footprint is tiny, and unload reduces the
reliability.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

This will work just great until some other product
hooks the same function. Think about this scenario:

  • Your driver loads, saves origPtr, puts myPtr
  • Another driver loads, saves myPtr, puts theirPtr
  • Your driver unloads, puts origPtr

2nd driver is now bypassed. If the 2nd driver is
passive, the system may appear to continue to function
normally. Most likely the system is toast at this
point. Consider further:

  • 2nd driver now decides to unload, puts myPtr

myPtr is a pointer to your function which is no longer
loaded. The system will crash the next time this
function is called.

Bottom line is you cannot unload if you hook. Don’t
think that this scenario doesn’t happen in real life,
it does.

Perfectly fine to unhook in your debug driver though.

— “Zhang, Raymond” wrote:
> Agree. Bur for my driver is to hook a function
> exported by KS (not as busy as FSD). I can unhook,
> stop, and hook again without error so far.
>
> Best Regards
> Raymond
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf
> Of Maxim S. Shatskih
> Sent: 2005Äê4ÔÂ14ÈÕ 16:27
> To: Windows File Systems Devs Interest List
> Subject: Re: [ntfsd] BugCheck CE in Mini Filter
>
> You cannot unload any driver which have
> installed hooks. You cannot unhook.
> The thing is that there is no ways of preventing
> the driver unload while
> the hook code is executing inside it.
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
> ----- Original Message -----
> From: “Zhang, Raymond”
> To: “Windows File Systems Devs Interest List”
>
> Sent: Thursday, April 14, 2005 11:42 AM
> Subject: RE: [ntfsd] BugCheck CE in Mini Filter
>
>
> I met and fixed such stop error several days before.
> I hooked/substituted a
> system function and accidently commented out unhook
> in the unload routine. Once
> unhook got back; the error gone.
>
> Best Regards
> Raymond Zhang
> xxxxx@intel.com
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf
> Of Neal Christiansen
> Sent: 2005Äê4ÔÂ14ÈÕ 15:29
> To: Windows File Systems Devs Interest List
> Subject: RE: [ntfsd] BugCheck CE in Mini Filter
>
> Ken,
>
> You are correct; this is not supposed to happen.
> Are you able to
> consistently reproduce this?
>
> I will have to look at the verifier code to see how
> they are detecting
> this situation before I can give you and idea on how
> to track this down.
>
> Neal Christiansen
> Microsoft File System Filter Group Lead
> This posting is provided “AS IS” with no warranties,
> and confers no
> Rights
> ________________________________________
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf
> Of Ken Galipeau
> Sent: Wednesday, April 13, 2005 6:14 AM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] BugCheck CE in Mini Filter
>
> I am getting the bug check
>
DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS
> (ce) when stopping
> a mini filter! I thought this was not supposed to
> happen!
>
> The stack trace only indicates the call to the
> driver and the exception
> following. To my knowledge I have no outstanding
> operations, how can I
> determine what operation was actually pending?
>
> I am running XP with sp2.
>
> Thanks,
> Ken
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: unknown
> lmsubst tag argument:
> ‘’
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: unknown
> lmsubst tag argument: ‘’
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: unknown
> lmsubst tag argument: ‘’
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as:
> xxxxx@intel.com
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: unknown
> lmsubst tag argument: ‘’
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>

Yes, for the most part.

-----Original Message-----
From: Neal Christiansen [mailto:xxxxx@windows.microsoft.com]
Sent: Thursday, April 14, 2005 3:29 AM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] BugCheck CE in Mini Filter

Ken,

You are correct; this is not supposed to happen. Are you able to
consistently reproduce this?

I will have to look at the verifier code to see how they are detecting
this situation before I can give you and idea on how to track this down.

Neal Christiansen
Microsoft File System Filter Group Lead
This posting is provided “AS IS” with no warranties, and confers no
Rights


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ken Galipeau
Sent: Wednesday, April 13, 2005 6:14 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] BugCheck CE in Mini Filter

I am getting the bug check
DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS (ce) when stopping
a mini filter! I thought this was not supposed to happen!

The stack trace only indicates the call to the driver and the exception
following. To my knowledge I have no outstanding operations, how can I
determine what operation was actually pending?

I am running XP with sp2.

Thanks,
Ken


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

I did unload mainly to ease development and test (avoid restart). Sorry if I confused you. By this way I can make driver change and debug very quickly.

Best Regards
Raymond Zhang

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Maxim S. Shatskih
Sent: 2005??4??14?? 17:01
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] BugCheck CE in Mini Filter

Agree. Bur for my driver is to hook a function exported by KS
(not as busy as FSD). I can unhook, stop, and hook again

Why ever unload? The memory footprint is tiny, and unload reduces the
reliability.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com


Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@intel.com
To unsubscribe send a blank email to xxxxx@lists.osr.com