File Objects

NTFSD
1

Hi,
I see lot of FileObjects using !poolused command in Windbg. Who/How does
these FileObjects get cleaned-up. If the count is high then can it be
considered as Memory Leak.

Thanks
Ashish

2

!poolused will only tell you at this point of time these all memory allocation with this tags are available.

>ho/How does these FileObjects get cleaned-up.
When reference count for that object will reach zero.

>If the count is high then can it be considered as Memory Leak.
No, not generically. Extremely high nuber could a alarming but I never rely on this.

to detect memory leak enable verifier on your driver and verifier will bug check at the time of your driver unload if it has leaked some resources.

Thanks
Aditya

3

> I see lot of FileObjects using !poolused command in Windbg. Who/How does these FileObjects get

cleaned-up.

File objects are reference-counted. Usually, the object which holds a strong ref on the file object is Cc’s Shared Cache Map (CcSc).

To allow retaining the cache for the possible quick reopen of the just-closed file, CcSc is not immediately destroyed when the file handle is closed. Instead, it is put to some garbage collector list within Cc and can remain there for hours, being actually destroyed only due to memory pressure, or CcPurgeCacheSection called by the FSD (in file deletion or volume remount paths or such).

So, this is OK if you see lots of surviving file objects and lots of surviving CcSc’s and MmCa’s (Mm’s data structure which underlies both the MMFs and CcSc - the so-called “data control area”).

If the count is high then can it be considered as Memory Leak.

Not necessary. But, if the count does not drop on volume remount (chkdsk /f is the simplest way) - then this is a reference leak somewhere.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com