fltmc assertion on checked version

NTFSD
1

Hello,
If I try to run fltmc on windows 2003 checked version, it breaks into
debugger with following message:
EX: resource: APCs still enabled before resource 811978C0 acquire !!!
Is it some sort of unintended behavior?

Best Regards,
Katrin

2

You are not calling KeEnterCriticalRegion or FsRtlEnterFileSystem before
acquiring the ERESOURCE and thus you are creating a situation that might
introduce deadlock (because APCs could call back into your driver and
acquire locks in a different order.)

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Katrin Shechtman
Sent: Monday, 21 August 2006 1:26 AM
To: ntfsd redirect
Subject: [ntfsd] fltmc assertion on checked version

Hello,
If I try to run fltmc on windows 2003 checked version, it breaks into
debugger with following message:
EX: resource: APCs still enabled before resource 811978C0 acquire !!!
Is it some sort of unintended behavior?

Best Regards,
Katrin

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Thank you for a clarification, but there is no third party minifilter on the
system. It is fltmc that breaks into debugger.

Best Regards,
Katrin

“Tony Mason” wrote in message news:xxxxx@ntfsd…
You are not calling KeEnterCriticalRegion or FsRtlEnterFileSystem before
acquiring the ERESOURCE and thus you are creating a situation that might
introduce deadlock (because APCs could call back into your driver and
acquire locks in a different order.)

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Katrin Shechtman
Sent: Monday, 21 August 2006 1:26 AM
To: ntfsd redirect
Subject: [ntfsd] fltmc assertion on checked version

Hello,
If I try to run fltmc on windows 2003 checked version, it breaks into
debugger with following message:
EX: resource: APCs still enabled before resource 811978C0 acquire !!!
Is it some sort of unintended behavior?

Best Regards,
Katrin

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

> Thank you for a clarification, but there is no third party minifilter on

the system. It is fltmc that breaks into debugger.

Can you post stack from Windbg ?

L.

5

Sure, here it is:

ChildEBP RetAddr Args to Child
ba42ca40 8115e2cc ba42ca74 811601e8 8110b800 nt!DbgBreakPoint
ba42ca48 811601e8 8110b800 811978c0 85beab98
nt!ExCheckIfKernelApcsShouldBeDisabled+0x3a
ba42ca74 812f3652 811978c0 00000001 00000000
nt!ExAcquireResourceSharedLite+0x58
ba42ca94 f71f12a1 ba42cab4 00000020 ba42caf8
nt!IoEnumerateRegisteredFiltersList+0x1a
ba42cb20 f71f1a49 00000000 00000001 85b6e1b0
fltMgr!FltpEnumerateAggregateFilterInformation+0x8b
ba42cb3c f71e94bd 00000000 00000001 85b6e1b0
fltMgr!FltEnumerateFilterInformation+0x61
ba42cb64 f71f7cab 86945228 85b6e1b0 00000004 fltMgr!FltpFindFirst+0xf3
ba42cb8c f71c8bec 86945228 40000001 85b6e1b0
fltMgr!FltpCommonDeviceControl+0x103
ba42cbcc f71cac6b 860d4618 86f5af68 86f5af68 fltMgr!FltpControlDispatch+0x88
ba42cc04 8148154a 860d4618 86f5af68 860d4618 fltMgr!FltpDispatch+0x6b
ba42cc34 81029de4 813033e7 86f5afd8 86f5af68 nt!IovCallDriver+0x150
ba42cc4c 813033e7 86f5afd8 86945228 86f5af68 nt!IofCallDriver+0x1c
ba42cc60 813043d1 860d4618 86f5af68 86945228
nt!IopSynchronousServiceTail+0x1f3
ba42cd00 812f9874 00000760 00000000 00000000 nt!IopXxxControlFile+0x663
ba42cd34 8116fdb5 00000760 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
ba42cd34 7c9497c4 00000760 00000000 00000000 nt!KiFastCallEntry+0x135
0007f604 7c91ee30 5b121bc8 00000760 00000000 ntdll!KiFastSystemCallRet
0007f608 5b121bc8 00000760 00000000 00000000 ntdll!ZwDeviceIoControlFile+0xc
0007f66c 5b12258c 00000760 00084024 0007f6b0
fltlib!FilterpDeviceIoControl+0xcc
0007f6d4 01001b6a 00000001 0007f718 00000800 fltlib!FilterFindFirst+0xa3

Best Regards,
Katrin

“Ladislav Zezula” wrote in message news:xxxxx@ntfsd…
>> Thank you for a clarification, but there is no third party minifilter on
>> the system. It is fltmc that breaks into debugger.
>
> Can you post stack from Windbg ?
>
> L.
>