1st,this should be a bug in microsoft,I think.
In win2K rollup 1,everything is OK.
In winxp sp1,sp2,it will crash.But in winxp sp3,everything is OK.
I don’t test win2K3,but I think sp2 should be OK.
In vista,everything is OK.
In winxp sp2,the details about the crash:
1.the IRP_MJ_CREATE for opening \192.168.1.1\test\1.txt ,is coming.
2.in the postcreate,I call FltCancelFileOpen,and set ACCESS_DENY.
everything is OK.
3.But if I returned in my postcreate,the system crash:
DFS_FILE_SYSTEM (82)
Arguments:
Arg1: f96b0ea2
Arg2: f96af93f
Arg3: 00000000
Arg4: 00000000
Debugging Details:
PEB is paged out (Peb.Ldr = 7ffde00c). Type “.hh dbgerr001” for details
PEB is paged out (Peb.Ldr = 7ffde00c). Type “.hh dbgerr001” for details
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x82
PROCESS_NAME: explorer.exe
LAST_CONTROL_TRANSFER: from f96b729c to 804f9925
STACK_TEXT:
f79b38e4 f96b729c 00000082 f96b0ea2 f96af93f nt!KeBugCheckEx+0x1b
f79b3908 f96b0ea2 81585a18 81585b08 ff723cb8 Mup!DfsBugCheck+0x2a
f79b3944 f96af93f 8143e310 81585a08 81585a18 Mup!DfsCommonClose+0x4f
f79b3988 f96afaac 8172ec88 81585a08 81585a18 Mup!DfsFsdClose+0xf8
f79b39d4 804eedf9 8172ec88 81585a08 81585a08 Mup!MupClose+0x223
f79b39e4 80578c8c ff723ca0 00000000 00000000 nt!IopfCallDriver+0x31
f79b3a1c 805b0563 00723cb8 ff723ca0 00000000 nt!IopDeleteFile+0x132
f79b3a38 80522e47 ff723cb8 00000000 00000000 nt!ObpRemoveObjectRoutine+0xdf
f79b3a5c 80578470 8172ec70 814ef0ac f79b3c04 nt!ObfDereferenceObject+0x5f
f79b3b3c 805b465e 8172ec88 00000000 814ef008 nt!IopParseDevice+0xb0c
f79b3bc4 805b0b3f 00000000 f79b3c04 00000040 nt!ObpLookupObjectName+0x56a
f79b3c18 8056b133 00000000 00000000 00010001 nt!ObOpenObjectByName+0xeb
f79b3c94 8056baaa 02d3dbb0 00100080 02d3db50 nt!IopCreateFile+0x407
f79b3cf0 8056e17c 02d3dbb0 00100080 02d3db50 nt!IoCreateFile+0x8e
f79b3d30 8053d808 02d3dbb0 00100080 02d3db50 nt!NtCreateFile+0x30
f79b3d30 7c92eb94 02d3dbb0 00100080 02d3db50 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
02d3dba8 00000000 00000000 00000000 00000000 0x7c92eb94
STACK_COMMAND: kb
FOLLOWUP_IP:
Mup!DfsBugCheck+2a
f96b729c 90 nop
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: Mup!DfsBugCheck+2a
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Mup
IMAGE_NAME: Mup.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 41107ef8
FAILURE_BUCKET_ID: 0x82_Mup!DfsBugCheck+2a
BUCKET_ID: 0x82_Mup!DfsBugCheck+2a
Followup: MachineOwner
And,notice that lines:
f79b3bc4 805b0b3f 00000000 f79b3c04 00000040 nt!ObpLookupObjectName+0x56a
kd> dt nt!_UNICODE_STRING 0xf79b3c04
“\Device\WinDfs\Root\192.168.1.108\test\test\1.txt”
+0x000 Length : 0x62
+0x002 MaximumLength : 0xf8
+0x004 Buffer : 0xe1133328 “\Device\WinDfs\Root\192.168.1.108\test\test\1.txt”