Does ZwClose bugcheck in NT4?

OSR_Community_User · May 14, 2002, 9:18am

I know that ZwClose will bugcheck in W2K if the handle is invalid. I’m
assuming this is case for NT4 as well. Does anyone know for sure that it
does?

And on that subject, does anyone else agree that bugchecking on the
close of an invalid handle is a rather harsh action to take? IMHO,
ZwClose should just return STATUS_INVALID_HANDLE instead of bringing the
whole system down. Now, I’m not saying that we should be sloppy with
handles. A driver should still carefully manage them and be responsible
for their state. However, I have seen cases where errant applications
have closed handles at will and inadvertently closed one that a driver
was using and was carefully tracking. Then when the driver correctly
called ZwClose - bugcheck.

The race conditions where this has happened have been tight and hard to
duplicate, but it can be done.

Jerry

OSR_Community_User · May 14, 2002, 10:33am

If your driver creates its handles in the system process’s context, you’re safe from this problem.

Another solution would be to have the application close the handle, rather than your driver. This is easy if it’s your application. It’s still possible using APC’s, even if it’s not your application, but I don’t recommend that.

-----Original Message-----
From: Kelley, Jerry [mailto:xxxxx@nsisoftware.com]
Sent: Tuesday, May 14, 2002 8:15 AM
To: File Systems Developers
Subject: [ntfsd] Does ZwClose bugcheck in NT4?

I know that ZwClose will bugcheck in W2K if the handle is invalid. I’m assuming this is case for NT4 as well. Does anyone know for sure that it does?

And on that subject, does anyone else agree that bugchecking on the close of an invalid handle is a rather harsh action to take? IMHO, ZwClose should just return STATUS_INVALID_HANDLE instead of bringing the whole system down. Now, I’m not saying that we should be sloppy with handles. A driver should still carefully manage them and be responsible for their state. However, I have seen cases where errant applications have closed handles at will and inadvertently closed one that a driver was using and was carefully tracking. Then when the driver correctly called ZwClose - bugcheck.

The race conditions where this has happened have been tight and hard to duplicate, but it can be done.

Jerry

You are currently subscribed to ntfsd as: xxxxx@inin.com
To unsubscribe send a blank email to %%email.unsub%%

OSR_Community_User · May 14, 2002, 11:31am

Ah yes, but if it were that simple. It’s not always convenient,
quick, or efficient to be in the system process context. For this case,
it’s in an arbitrary context. Attaching to the system process would be
too expensive and queuing it to a worker would add undesirable delays.

-----Original Message-----
From: Fuller, Rob [mailto:xxxxx@inin.com]
Sent: Tuesday, May 14, 2002 9:30 AM
To: File Systems Developers
Subject: [ntfsd] RE: Does ZwClose bugcheck in NT4?

If your driver creates its handles in the system process’s context,
you’re safe from this problem.

Another solution would be to have the application close the handle,
rather than your driver. This is easy if it’s your application. It’s
still possible using APC’s, even if it’s not your application, but I
don’t recommend that.

-----Original Message-----
From: Kelley, Jerry [mailto:xxxxx@nsisoftware.com]
Sent: Tuesday, May 14, 2002 8:15 AM
To: File Systems Developers
Subject: [ntfsd] Does ZwClose bugcheck in NT4?

I know that ZwClose will bugcheck in W2K if the handle is
invalid. I’m assuming this is case for NT4 as well. Does anyone know for
sure that it does?

And on that subject, does anyone else agree that bugchecking on
the close of an invalid handle is a rather harsh action to take? IMHO,
ZwClose should just return STATUS_INVALID_HANDLE instead of bringing the
whole system down. Now, I’m not saying that we should be sloppy with
handles. A driver should still carefully manage them and be responsible
for their state. However, I have seen cases where errant applications
have closed handles at will and inadvertently closed one that a driver
was using and was carefully tracking. Then when the driver correctly
called ZwClose - bugcheck.

The race conditions where this has happened have been tight and
hard to duplicate, but it can be done.

Jerry

You are currently subscribed to ntfsd as: xxxxx@inin.com
To unsubscribe send a blank email to %%email.unsub%%

You are currently subscribed to ntfsd as: xxxxx@nsisoftware.com
To unsubscribe send a blank email to %%email.unsub%%

OSR_Community_User · May 14, 2002, 2:07pm

After further testing, it appears that NT4 does not bugcheck in ZwClose
on NT4. Evidently, this was a feature added in W2K to aid debugging.

-----Original Message-----
From: Kelley, Jerry
Sent: Tuesday, May 14, 2002 8:15 AM
To: File Systems Developers
Subject: [ntfsd] Does ZwClose bugcheck in NT4?

I know that ZwClose will bugcheck in W2K if the handle is invalid. I’m
assuming this is case for NT4 as well. Does anyone know for sure that it
does?

And on that subject, does anyone else agree that bugchecking on the
close of an invalid handle is a rather harsh action to take? IMHO,
ZwClose should just return STATUS_INVALID_HANDLE instead of bringing the
whole system down. Now, I’m not saying that we should be sloppy with
handles. A driver should still carefully manage them and be responsible
for their state. However, I have seen cases where errant applications
have closed handles at will and inadvertently closed one that a driver
was using and was carefully tracking. Then when the driver correctly
called ZwClose - bugcheck.

The race conditions where this has happened have been tight and hard to
duplicate, but it can be done.

Jerry

You are currently subscribed to ntfsd as: xxxxx@nsisoftware.com
To unsubscribe send a blank email to %%email.unsub%%

OSR_Community_User · May 14, 2002, 2:22pm

Does ZwClose bugcheck in NT4?>I know that ZwClose will bugcheck in W2K if the handle is invalid. I’m assuming this is case for NT4 as well.

Does anyone know for sure that it does?

This protects your code from severe bugs.

applications have closed handles at will and inadvertently closed one that a driver was using and was
carefully tracking.

Never track app’s handles in the driver. Use ObReferenceObjectByHandle, possibly followed by ObOpenObjectByPointer in System process context.
Tracking app’s handles in the driver is exactly the OS misuse which ZwClose bugcheck catches.

Max

OSR_Community_User · May 14, 2002, 2:22pm

MessageThen dereference the handle to the pointer and use the pointer.

Max
----- Original Message -----
From: Kelley, Jerry
To: File Systems Developers
Sent: Tuesday, May 14, 2002 7:28 PM
Subject: [ntfsd] RE: Does ZwClose bugcheck in NT4?

Ah yes, but if it were that simple. It’s not always convenient, quick, or efficient to be in the system process context. For this case, it’s in an arbitrary context. Attaching to the system process would be too expensive and queuing it to a worker would add undesirable delays.

-----Original Message-----
From: Fuller, Rob [mailto:xxxxx@inin.com]
Sent: Tuesday, May 14, 2002 9:30 AM
To: File Systems Developers
Subject: [ntfsd] RE: Does ZwClose bugcheck in NT4?

If your driver creates its handles in the system process’s context, you’re safe from this problem.

Another solution would be to have the application close the handle, rather than your driver. This is easy if it’s your application. It’s still possible using APC’s, even if it’s not your application, but I don’t recommend that.
-----Original Message-----
From: Kelley, Jerry [mailto:xxxxx@nsisoftware.com]
Sent: Tuesday, May 14, 2002 8:15 AM
To: File Systems Developers
Subject: [ntfsd] Does ZwClose bugcheck in NT4?

I know that ZwClose will bugcheck in W2K if the handle is invalid. I’m assuming this is case for NT4 as well. Does anyone know for sure that it does?

And on that subject, does anyone else agree that bugchecking on the close of an invalid handle is a rather harsh action to take? IMHO, ZwClose should just return STATUS_INVALID_HANDLE instead of bringing the whole system down. Now, I’m not saying that we should be sloppy with handles. A driver should still carefully manage them and be responsible for their state. However, I have seen cases where errant applications have closed handles at will and inadvertently closed one that a driver was using and was carefully tracking. Then when the driver correctly called ZwClose - bugcheck.

The race conditions where this has happened have been tight and hard to duplicate, but it can be done.

Jerry

You are currently subscribed to ntfsd as: xxxxx@inin.com
To unsubscribe send a blank email to %%email.unsub%%

You are currently subscribed to ntfsd as: xxxxx@nsisoftware.com
To unsubscribe send a blank email to %%email.unsub%% —
You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
To unsubscribe send a blank email to %%email.unsub%%

OSR_Community_User · May 14, 2002, 2:56pm

I’m not tracking app handles in the driver. The driver opens a file,
gets a handle, uses it to get the object pointer, then closes the handle
to properly clean up the reference counting. It’s that close that
bugchecks the system because it thinks the handle is invalid.

Here’s the pseudocode:

Status = ZwCreateFile(&hFile …)

if (!NT_SUCCESS(Status)) handle the error and bail

Status = ObReferenceObjectByHandle(hFile, … , &pFileObject);

ZwClose(hFile)

if (!NT_SUCCESS(Status)) handle the error and bail

… use pFileObject

These operations are sequential and the ZwCreateFile status code was
checked for failure. The goal is to get the FO pointer from the handle.
Now, I’ve seen cases where the ZwClose bugchecks on an invalid handle.
Somehow, the handle that the driver thought was valid has become
invalid. There could be a check after the ObReferenceObjectByHandle to
see if the handle is now invalid and not perform the close. That’s
actually one bit of defensive coding that has been done.

-----Original Message-----
From: Maxim S. Shatskih [mailto:xxxxx@storagecraft.com]
Sent: Tuesday, May 14, 2002 1:03 PM
To: File Systems Developers
Subject: [ntfsd] Re: Does ZwClose bugcheck in NT4?

I know that ZwClose will bugcheck in W2K if the handle is invalid. I’m
assuming this is case for NT4 as well.
Does anyone know for sure that it does?

This protects your code from severe bugs.

applications have closed handles at will and inadvertently closed one
that a driver was using and was
carefully tracking.

Never track app’s handles in the driver. Use ObReferenceObjectByHandle,
possibly followed by ObOpenObjectByPointer in System process context.
Tracking app’s handles in the driver is exactly the OS misuse which
ZwClose bugcheck catches.

Max

You are currently subscribed to ntfsd as: xxxxx@nsisoftware.com
To unsubscribe send a blank email to %%email.unsub%%

OSR_Community_User · May 14, 2002, 2:56pm

It does.

-----Original Message-----
From: Maxim S. Shatskih [mailto:xxxxx@storagecraft.com]
Sent: Tuesday, May 14, 2002 1:12 PM
To: File Systems Developers
Subject: [ntfsd] RE: Does ZwClose bugcheck in NT4?

Then dereference the handle to the pointer and use the pointer.

Max

----- Original Message -----
From: Kelley, Jerry mailto:xxxxx
To: File Systems Developers mailto:xxxxx
Sent: Tuesday, May 14, 2002 7:28 PM
Subject: [ntfsd] RE: Does ZwClose bugcheck in NT4?

Ah yes, but if it were that simple. It’s not always
convenient, quick, or efficient to be in the system process context. For
this case, it’s in an arbitrary context. Attaching to the system process
would be too expensive and queuing it to a worker would add undesirable
delays.

-----Original Message-----
From: Fuller, Rob [mailto:xxxxx@inin.com]
Sent: Tuesday, May 14, 2002 9:30 AM
To: File Systems Developers
Subject: [ntfsd] RE: Does ZwClose bugcheck in NT4?

If your driver creates its handles in the system process’s
context, you’re safe from this problem.

Another solution would be to have the application close the
handle, rather than your driver. This is easy if it’s your application.
It’s still possible using APC’s, even if it’s not your application, but
I don’t recommend that.

-----Original Message-----
From: Kelley, Jerry [mailto:xxxxx@nsisoftware.com]
Sent: Tuesday, May 14, 2002 8:15 AM
To: File Systems Developers
Subject: [ntfsd] Does ZwClose bugcheck in NT4?

I know that ZwClose will bugcheck in W2K if the handle
is invalid. I’m assuming this is case for NT4 as well. Does anyone know
for sure that it does?

And on that subject, does anyone else agree that
bugchecking on the close of an invalid handle is a rather harsh action
to take? IMHO, ZwClose should just return STATUS_INVALID_HANDLE instead
of bringing the whole system down. Now, I’m not saying that we should be
sloppy with handles. A driver should still carefully manage them and be
responsible for their state. However, I have seen cases where errant
applications have closed handles at will and inadvertently closed one
that a driver was using and was carefully tracking. Then when the driver
correctly called ZwClose - bugcheck.

The race conditions where this has happened have been
tight and hard to duplicate, but it can be done.

Jerry

—
You are currently subscribed to ntfsd as:
xxxxx@inin.com
To unsubscribe send a blank email to %%email.unsub%%

—
You are currently subscribed to ntfsd as:
xxxxx@nsisoftware.com
To unsubscribe send a blank email to %%email.unsub%% —
You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
To unsubscribe send a blank email to %%email.unsub%%

—
You are currently subscribed to ntfsd as: xxxxx@nsisoftware.com
To unsubscribe send a blank email to %%email.unsub%%</mailto:xxxxx></mailto:xxxxx>

OSR_Community_User · May 14, 2002, 3:00pm

Let me be a bit clearer. We have to decrement the handle count and that
is being done via ZwClose. Whenever you receive a handle, e.g., through
ZwCreateFile, the handle count gets incremented and the object
referenced. If I just dereference the object, the handle count is not
taken care of. Is there a documented way to decrement the handle count
without calling ZwClose? If so, we could just decrement the handle count
and decrement the reference count on the object.

-----Original Message-----
From: Maxim S. Shatskih [mailto:xxxxx@storagecraft.com]
Sent: Tuesday, May 14, 2002 1:12 PM
To: File Systems Developers
Subject: [ntfsd] RE: Does ZwClose bugcheck in NT4?

Then dereference the handle to the pointer and use the pointer.

Max

----- Original Message -----
From: Kelley, Jerry mailto:xxxxx
To: File Systems Developers mailto:xxxxx
Sent: Tuesday, May 14, 2002 7:28 PM
Subject: [ntfsd] RE: Does ZwClose bugcheck in NT4?

Ah yes, but if it were that simple. It’s not always
convenient, quick, or efficient to be in the system process context. For
this case, it’s in an arbitrary context. Attaching to the system process
would be too expensive and queuing it to a worker would add undesirable
delays.

-----Original Message-----
From: Fuller, Rob [mailto:xxxxx@inin.com]
Sent: Tuesday, May 14, 2002 9:30 AM
To: File Systems Developers
Subject: [ntfsd] RE: Does ZwClose bugcheck in NT4?

If your driver creates its handles in the system process’s
context, you’re safe from this problem.

Another solution would be to have the application close the
handle, rather than your driver. This is easy if it’s your application.
It’s still possible using APC’s, even if it’s not your application, but
I don’t recommend that.

-----Original Message-----
From: Kelley, Jerry [mailto:xxxxx@nsisoftware.com]
Sent: Tuesday, May 14, 2002 8:15 AM
To: File Systems Developers
Subject: [ntfsd] Does ZwClose bugcheck in NT4?

I know that ZwClose will bugcheck in W2K if the handle
is invalid. I’m assuming this is case for NT4 as well. Does anyone know
for sure that it does?

And on that subject, does anyone else agree that
bugchecking on the close of an invalid handle is a rather harsh action
to take? IMHO, ZwClose should just return STATUS_INVALID_HANDLE instead
of bringing the whole system down. Now, I’m not saying that we should be
sloppy with handles. A driver should still carefully manage them and be
responsible for their state. However, I have seen cases where errant
applications have closed handles at will and inadvertently closed one
that a driver was using and was carefully tracking. Then when the driver
correctly called ZwClose - bugcheck.

The race conditions where this has happened have been
tight and hard to duplicate, but it can be done.

Jerry

—
You are currently subscribed to ntfsd as:
xxxxx@inin.com
To unsubscribe send a blank email to %%email.unsub%%

—
You are currently subscribed to ntfsd as:
xxxxx@nsisoftware.com
To unsubscribe send a blank email to %%email.unsub%% —
You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
To unsubscribe send a blank email to %%email.unsub%%

—
You are currently subscribed to ntfsd as: xxxxx@nsisoftware.com
To unsubscribe send a blank email to %%email.unsub%%</mailto:xxxxx></mailto:xxxxx>

OSR_Community_User · May 14, 2002, 3:10pm

>>I know that ZwClose will bugcheck in W2K if the handle is invalid. I’m
assuming this is case for

>NT4 as well. Does anyone know for sure that it does?

This protects your code from severe bugs.

I think it might be sufficient to return STATUS_INVALID_HANDLE, as Jerry
suggested, and to ASSERT in the checked build. This would catch actual
driver errors in testing, but not crash the system in production because
of the actions of a badly coded application.

>applications have closed handles at will and inadvertently closed one
that a driver was using
>and was carefully tracking.

Never track app’s handles in the driver. Use ObReferenceObjectByHandle,
possibly followed by
ObOpenObjectByPointer in System process context.
Tracking app’s handles in the driver is exactly the OS misuse which
ZwClose bugcheck catches.

This isn’t really the issue. The issue is that a driver can create a
handle to some object in kernel mode, intended to be for the driver’s
own exclusive use, in kernel mode, and the unprivileged process can, in
another thread in user mode, close the driver’s handle. I’ve seen this
happen when an application issues a double close on a handle.
ObReferenceing the handle doesn’t really help, because it still leaves a
window between the handle creation and the the ObReference.

VMS (in addition to having clusters that work, but that’s another ntfsd
thread from hell) associates the processor mode with a channel (the VMS
word for handle), and a kernel mode channel cannot be accessed from user
mode. It would have been nice if this had been designed into NT, but
it’s probably too late now.

Dan.

OSR_Community_User · May 14, 2002, 3:37pm

My comments below.

-----Original Message-----
From: Dan Kyler [mailto:xxxxx@privtek.com]
Sent: Tuesday, May 14, 2002 2:08 PM
To: File Systems Developers
Subject: [ntfsd] Re: Does ZwClose bugcheck in NT4?

>I know that ZwClose will bugcheck in W2K if the handle is invalid. I’m
assuming this is case for
>NT4 as well. Does anyone know for sure that it does?

This protects your code from severe bugs.

I think it might be sufficient to return STATUS_INVALID_HANDLE, as Jerry
suggested, and to ASSERT in the checked build. This would catch actual
driver errors in testing, but not crash the system in production because
of the actions of a badly coded application.

>applications have closed handles at will and inadvertently closed one
that a driver was using
>and was carefully tracking.

Never track app’s handles in the driver. Use ObReferenceObjectByHandle,
possibly followed by
ObOpenObjectByPointer in System process context.
Tracking app’s handles in the driver is exactly the OS misuse which
ZwClose bugcheck catches.

This isn’t really the issue. The issue is that a driver can create a
handle to some object in kernel mode, intended to be for the driver’s
own exclusive use, in kernel mode, and the unprivileged process can, in
another thread in user mode, close the driver’s handle. I’ve seen this
happen when an application issues a double close on a handle.
ObReferenceing the handle doesn’t really help, because it still leaves a
window between the handle creation and the the ObReference.

This is exactly what I’ve seen as well and was trying to say. I didn’t
do a very good job of explaining it though.

VMS (in addition to having clusters that work, but that’s another ntfsd
thread from hell) associates the processor mode with a channel (the VMS
word for handle), and a kernel mode channel cannot be accessed from user
mode. It would have been nice if this had been designed into NT, but
it’s probably too late now.

Dan.

You are currently subscribed to ntfsd as: xxxxx@nsisoftware.com
To unsubscribe send a blank email to %%email.unsub%%

OSR_Community_User · May 14, 2002, 5:39pm

How do you know using a worker thread is too expensive? Did you measure this? Many components of the operating system use worker threads, especially in the realm of file systems.

-----Original Message-----
From: Kelley, Jerry [mailto:xxxxx@nsisoftware.com]
Sent: Tuesday, May 14, 2002 10:28 AM
To: File Systems Developers
Subject: [ntfsd] RE: Does ZwClose bugcheck in NT4?