Hi, I observe a hang when executing FltClose
To close, I create a WorkItem (I need IRQL = PASSIVE_LEVEL), where I call FltClose
This happens when the computer is turned off. If I unload the driver, then there is no problem
Has anyone encountered such a thing?
The stack is next:
Not impersonating
DeviceMap ffff9c8a73e35960
Owning Process ffff85066707e040 Image: System
Attached Process N/A Image: N/A
Wait Start TickCount 26915 Ticks: 212 (0:00:00:03.312)
Context Switch Count 74 IdealProcessor: 3 NoStackSwap
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address nt!ExpWorkerThread (0xfffff8060a2b8410)
Stack Init ffffac8e53756c90 Current ffffac8e53755770
Base ffffac8e53757000 Limit ffffac8e53751000 Call 0000000000000000
Priority 8 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP RetAddr Call Site
ffffac8e537557b0 fffff8060a20c800 nt!KiSwapContext+0x76
ffffac8e537558f0 fffff8060a20bd2f nt!KiSwapThread+0x500
ffffac8e537559a0 fffff8060a20b5d3 nt!KiCommitThreadWait+0x14f
ffffac8e53755a40 fffff8060a20e4ad nt!KeWaitForSingleObject+0x233
ffffac8e53755b30 fffff8060a20968a nt!ExpWaitForResource+0x6d
ffffac8e53755bb0 fffff8060a2090f4 nt!ExpAcquireResourceSharedLite+0x4da
ffffac8e53755c70 fffff8060ea9fe9d nt!ExAcquireResourceSharedLite+0x44
ffffac8e53755cb0 fffff8060ea5e6f4 Ntfs!NtfsAcquireSharedVcb+0x3d
ffffac8e53755cf0 fffff8060ea5540d Ntfs!NtfsCommonCleanup+0x2e4
ffffac8e537561a0 fffff8060a28f6f5 Ntfs!NtfsFsdCleanup+0x1bd
ffffac8e537564f0 fffff8060dd46c5f nt!IofCallDriver+0x55
ffffac8e53756530 fffff8060dd44673 FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x28f
ffffac8e537565a0 fffff8060a28f6f5 FLTMGR!FltpDispatch+0xa3
ffffac8e53756600 fffff8060a675d4a nt!IofCallDriver+0x55
ffffac8e53756640 fffff8060a5f39cf nt!IopCloseFile+0x17a
ffffac8e537566d0 fffff8060a5f79ac nt!ObCloseHandleTableEntry+0x51f
ffffac8e53756810 fffff8060a408bb5 nt!NtClose+0xec
ffffac8e53756880 fffff8060a3fb010 nt!KiSystemServiceCopyEnd+0x25 (TrapFrame @ ffffac8e53756880) ffffac8e53756a18 fffff8060dd84cf0 nt!KiServiceLinkage ffffac8e53756a20 fffff806116e79e7 FLTMGR!FltClose+0x10 ffffac8e53756a50 fffff806116e792b MyDriver!FreeResources+0x77 ffffac8e53756aa0 fffff8060dd80567 MyDriver!FreeResourceWorkItemRoutine+0x9b ffffac8e53756ae0 fffff8060a2b8515 FLTMGR!FltpProcessGenericWorkItem+0xa7 ffffac8e53756b70 fffff8060a355855 nt!ExpWorkerThread+0x105 ffffac8e53756c10 fffff8060a3fe808 nt!PspSystemThreadStartup+0x55 ffffac8e53756c60 00000000`00000000 nt!KiStartSystemThread+0x28