FltCompletePendedPreOperation!!

NTFSD
1

Hi!
I am implementing a Minifilter in which i am pending IRPs from my precallback routines and processing them in a worker thread. I then call FltCompletPendedPreOperation to send that IRP for further processing.
I have implemented the worker thread using PsCreateSystemThread. There is a worker thread per instance. I have not used Work Items.
In my pre rouitne, i insert the callback data in the cancelsafe queue and mark it as pending. i dequeue the callback data in my worker thread.
After performing the processing i call FltCompletPendedPreOperation.
Sometimes the minifilter hangs after callin FltCompletPendedPreOperation. The control does not return to the worker thread and the system hangs.
I have printed a debug message before and after the call to FltCompletPendedPreOperation.
At the time when system hangs, i can c the first one, but not the second one.
What might be the problem?

Thanks!
Ayush

2

From what you wrote, I can’t say more than
“You have bug in your filter”.

Configure manual system crash (Ctrl+Scroll lock).
Configure kernel memory dump.
Configure downloading symbols from symbol server.
Let your system run to invoke the hang.
Use Ctrl + ScrollLock to manually crash it and invoke
crash dump creation.
Then analyze the crash dump. Find a thread which hung,
and try to find out why.

L.

3

Thanks!
From the debugger itself i have come to know that my worker thread has made a blocking FltCompletPendedPreOperation call which is not returning control to the worker thread.

4

xxxxx@yahoo.com wrote:

Thanks!
From the debugger itself i have come to know that my worker thread has made a blocking FltCompletPendedPreOperation call which is not returning control to the worker thread.

Identify the resource on which it is blocking.
Repro the block. Crash the system, analyze the crash, identify the cause.
This is exactly what Ladislav was telling you in his reply.
Simplest way is to follow the steps given by him.

Happy hacking.
Uv