CreateFile does not return

NTFSD
1

Hi all,

I had written about this problem with the title “Filter driver hangs …”
recently and a couple of good suggessions came in. I implemented them but
the problem still persists. Anyways, continuing with it, I will put it in
front of you again in brief.
When a req. for a file comes in my filter, I block it in the dispatch
routine and signal my user mode app. (which is a service) to open the
file. But under heavy load, after some time the system freezes. I noticed
that the call to open the file in the user mode app. does not return. I
open it with CreateFile. I tried to dig into the situation with SoftIce
and looked at the IRP that was generated because of the CreateFile call.
The details that I got are as follows,

The fields in the IRP itself:
MdlAddress *: 0
Flags: 84 (IRP_SYNCHRONOUS_API | IRP_CREATE_OPERATION |
IRP_DEFER_IO_COMPLETION)
Associated Irp: 0
&ThreadListEntry: ff35eeb8
IoStatus.Status: 0
IoStatus.Information: e1969508
Requestor Mode: 01
Pending Returned: False
Stack Count: 04
CurrentLocation: 03
Cancel: False
CancelIrql: 0
ApcEnvironment: 0
UserIosb *: f540a75c
UserEvent *: 0
Overlays: 0
CancelRoutine *: 8011040c
UserBuffer *: 0
TailOverlay:
&DeviceQueueEntry: ff35eeef
Thread *: fb201900
Auxillary Buffer *: 0
CurrentStackLocation : ff35ef60
&ListEntry: ff35ef60
OrigFileObject * : fb0a328
TailApc * : ff35eee8

Can you guys please tell me that can this info. be of any help to solve
the problem?

Regards.
Vikrant.

2

I believe IRP -r can be used to also obtain the stack location
information. I think it will be more useful than the IRP info below.
What is it you want to accomplish? There might be an easier/alternate
way.

xxxxx@yahoo.com wrote:

Hi all,

I had written about this problem with the title “Filter driver hangs …”
recently and a couple of good suggessions came in. I implemented them but
the problem still persists. Anyways, continuing with it, I will put it in
front of you again in brief.
When a req. for a file comes in my filter, I block it in the dispatch
routine and signal my user mode app. (which is a service) to open the
file. But under heavy load, after some time the system freezes. I noticed
that the call to open the file in the user mode app. does not return. I
open it with CreateFile. I tried to dig into the situation with SoftIce
and looked at the IRP that was generated because of the CreateFile call.
The details that I got are as follows,

The fields in the IRP itself:
MdlAddress *: 0
Flags: 84 (IRP_SYNCHRONOUS_API | IRP_CREATE_OPERATION |
IRP_DEFER_IO_COMPLETION)
Associated Irp: 0
&ThreadListEntry: ff35eeb8
IoStatus.Status: 0
IoStatus.Information: e1969508
Requestor Mode: 01
Pending Returned: False
Stack Count: 04
CurrentLocation: 03
Cancel: False
CancelIrql: 0
ApcEnvironment: 0
UserIosb *: f540a75c
UserEvent *: 0
Overlays: 0
CancelRoutine *: 8011040c
UserBuffer *: 0
TailOverlay:
&DeviceQueueEntry: ff35eeef
Thread *: fb201900
Auxillary Buffer *: 0
CurrentStackLocation : ff35ef60
&ListEntry: ff35ef60
OrigFileObject * : fb0a328
TailApc * : ff35eee8

Can you guys please tell me that can this info. be of any help to solve
the problem?

Regards.
Vikrant.

You are currently subscribed to ntfsd as: xxxxx@alfasp.com
To unsubscribe send a blank email to %%email.unsub%%

–
Kind regards, Dejan M. www.alfasp.com
E-mail: xxxxx@alfasp.com ICQ#: 56570367
Alfa File Monitor - File monitoring library for Win32 developers.
Alfa File Protector - File protection and hiding library for Win32
developers.

3

Hi,

I did not find any “IRP -r” command. What stack info are you referring to?
I have a file system filter driver where in I block the IRP_MJ_CREATE and
IRP_MJ_CLEANUP major functions in the dispatch routine and signal my user
mode app. to do some processing on the file. Now even if I dont do any
processing in the user mode app.and just open/close the file, the system
freezes. When the I am done with the processing, I signal the filter
driver so that the blocked req. comes out of the wait state and proceeds.
Thats what I do.

Regards.
Vikrant.

4

IRP -f or -n, actually - sorry, I didn’t check which exactly.

I did not find any “IRP -r” command. What stack info are you referring to?

IO_STACK_LOCATION of the IRP.

I have a file system filter driver where in I block the IRP_MJ_CREATE and
IRP_MJ_CLEANUP major functions in the dispatch routine and signal my user
mode app. to do some processing on the file. Now even if I dont do any
processing in the user mode app.and just open/close the file, the system
freezes. When the I am done with the processing, I signal the filter
driver so that the blocked req. comes out of the wait state and proceeds.
Thats what I do.

Seems easy, but it’s not that simple. You actually try to wait for a
user mode event, which is enough! Why not do the processing in the driver?

–
Kind regards, Dejan M. www.alfasp.com
E-mail: xxxxx@alfasp.com ICQ#: 56570367
Alfa File Monitor - File monitoring library for Win32 developers.
Alfa File Protector - File protection and hiding library for Win32 developers.

5

Hi,

Actually the processing part cant be done in the driver because this is a
part of the specifications. Here are the details of the IO_STACK_LOCATION
of the IRP:

CurrentStackLocation is at: fb130fa0
Major Function: IRP_MJ_CREATE
Minor Function: 0
Control: 01
flags: 0
SecurityContext: f55eb744
Options: 01000060
FileAttributes: 80
ShareAccess: 0
DeviceObject *: fb5cc2c0
FileObject *: fb2e11368
CompletionRoutine *: f58a4590
Context *: 0

Regards.
Vikrant.

6

Break into debugger and see if a thread of your service that called is
blocked. If it is, switch thread context to it and see where exactly it is
blocked. That will be more useful to my mind.

I believe you block your own call. How do you separate files opened by your
service from all other files?

-htfv

----- Original Message -----
From:
To: “File Systems Developers”
Sent: Saturday, August 10, 2002 8:46 AM
Subject: [ntfsd] Re: CreateFile does not return

> Hi,
>
> Actually the processing part cant be done in the driver because this is a
> part of the specifications. Here are the details of the IO_STACK_LOCATION
> of the IRP:
>
> CurrentStackLocation is at: fb130fa0
> Major Function: IRP_MJ_CREATE
> Minor Function: 0
> Control: 01
> flags: 0
> SecurityContext: f55eb744
> Options: 01000060
> FileAttributes: 80
> ShareAccess: 0
> DeviceObject *: fb5cc2c0
> FileObject *: fb2e11368
> CompletionRoutine *: f58a4590
> Context *: 0
>
> Regards.
> Vikrant.
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to %%email.unsub%%
>

7

Hello,

I skip the calls generated by my app. by checking the process id. If the
pid of the thread is the same as the pid of my app. then I skip it.

Regards.
Vikrant.

8

How do you get current thread id. Don’t use PsGetCurrentProcessId. Under
heavy conditions you may get IRP in system process context. Use
IoGetRequestorProcess instead.

However, this may not be an issue in your occasion. As I said, find the
reason for blocking.

-htfv

----- Original Message -----
From:
To: “File Systems Developers”
Sent: Saturday, August 10, 2002 11:07 AM
Subject: [ntfsd] Re: CreateFile does not return

> Hello,
>
> I skip the calls generated by my app. by checking the process id. If the
> pid of the thread is the same as the pid of my app. then I skip it.
>
> Regards.
> Vikrant.
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to %%email.unsub%%
>

9

Hi,

One important thing to mention here is that the bug comes up when some
files are being opened through the network. i.e. if a file on a shared
drive/folder is being accessed. If files on local system are accessed,
then the bug does’nt seem to be coming.

Is it ok to block a req. that is being genrated from a remote machine and
let it proceed only after I have finished processing it? Ofcourse the bug
comes up only after some time and under heavy load.

Regards.
Vikrant.

10

Vikrant -

You cannot block the create in your dispatch and wait for user mode to
signal you when the flag FILE_COMPLETE_IF_OPLOCKED is supplied as part
of the create options. The Windows file server (SRV) holds a lock when
it sends down creates to indicate that the create should be
non-blocking.
If that thread is blocked, it blocks oplock breaks, due to the lock that
SRV held. This can cause SRV threads to be completely saturated (and
blocked) leading to the deadlock you are seeing below, and of course it
happens normally only when you see files that are accessed remotely,
when SRV comes into play.

Fix your code to not block in this case.

Actually, if at all possible actually, don’t block creates indefinitely.
NT isn’t geared to handle high latency creates very well.
Ravi

This posting is provided “AS IS” with no warranties, and confers no
rights.

-----Original Message-----
From: xxxxx@yahoo.com [mailto:xxxxx@yahoo.com]
Sent: Tuesday, August 13, 2002 1:50 AM
To: File Systems Developers
Subject: [ntfsd] Re: CreateFile does not return

Hi,

One important thing to mention here is that the bug comes up when some
files are being opened through the network. i.e. if a file on a shared
drive/folder is being accessed. If files on local system are accessed,
then the bug does’nt seem to be coming.

Is it ok to block a req. that is being genrated from a remote machine
and let it proceed only after I have finished processing it? Ofcourse
the bug comes up only after some time and under heavy load.

Regards.
Vikrant.

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to %%email.unsub%%

11

How one handles such occasions. I mean for AV filter we have to block
IRP_MJ_CREATE somehow until file is checked. What if I pass the request down
then return STATUS_MORE_PROCESSING_REQUIRED in completion routine then do
whatever I need with the FILE_OBJECT?

-htfv

----- Original Message -----
From: “Ravisankar Pudipeddi”
To: “File Systems Developers”
Sent: Wednesday, August 14, 2002 4:34 AM
Subject: [ntfsd] Re: CreateFile does not return

Vikrant -

You cannot block the create in your dispatch and wait for user mode to
signal you when the flag FILE_COMPLETE_IF_OPLOCKED is supplied as part
of the create options. The Windows file server (SRV) holds a lock when
it sends down creates to indicate that the create should be
non-blocking.
If that thread is blocked, it blocks oplock breaks, due to the lock that
SRV held. This can cause SRV threads to be completely saturated (and
blocked) leading to the deadlock you are seeing below, and of course it
happens normally only when you see files that are accessed remotely,
when SRV comes into play.

Fix your code to not block in this case.

Actually, if at all possible actually, don’t block creates indefinitely.
NT isn’t geared to handle high latency creates very well.
Ravi

-
This posting is provided “AS IS” with no warranties, and confers no
rights.

-----Original Message-----
From: xxxxx@yahoo.com [mailto:xxxxx@yahoo.com]
Sent: Tuesday, August 13, 2002 1:50 AM
To: File Systems Developers
Subject: [ntfsd] Re: CreateFile does not return

Hi,

One important thing to mention here is that the bug comes up when some
files are being opened through the network. i.e. if a file on a shared
drive/folder is being accessed. If files on local system are accessed,
then the bug does’nt seem to be coming.

Is it ok to block a req. that is being genrated from a remote machine
and let it proceed only after I have finished processing it? Ofcourse
the bug comes up only after some time and under heavy load.

Regards.
Vikrant.

—
You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to %%email.unsub%%

—
You are currently subscribed to ntfsd as: xxxxx@vba.com.by
To unsubscribe send a blank email to %%email.unsub%%