I found a very strange problem.
my filter will work well in many WinXP,but in some WinXP(maybe add some
hotfix),my filter will hang in IopParseDevice for my IoCreateFileSpecifyDeviceObjectHint.
anybody can clear it?Thanks!
I will describe it by the following example:
1.explorer.exe (PID 5ec,TID 750) open D:\1.txt
in my filter,I meet a IRP_MJ_CREATE for D:\1.txt
2.In this IRP_MJ_CREATE,I will call IoCreateFileSpecifyDeviceObjectHint for
D:\1.txt ,
I issue it in the same thread context(PID 5ec,TID 750).
3.that’s all OK!my IoCreateFileSpecifyDeviceObjectHint will return.
4.explorer.exe (PID 5ec,TID 750) open D:\1.txt again in my filter,I meet a IRP_MJ_CREATE for D:\1.txt
5.In this IRP_MJ_CREATE,I will call IoCreateFileSpecifyDeviceObjectHint for
D:\1.txt ,
I issue it in the same thread context(PID 5ec,TID 750).
6.hanged!the IoCreateFileSpecifyDeviceObjectHint can’t return!
in stack trace,it hanged in IopParseDevice .
please refer my code and windbg’s out.
In my filter IRP_MJ_CREATE handler:
my test code is following:
{
…if szFileName is not D:\1.xt,just pass through it…
KeWaitForSingleObject(g_pSyn_SF,Executive,KernelMode,FALSE,NULL);
KdPrint((“\r\n—before Open :%x,%x,%ws”,nThisPID,nThisTID,szFileName));
HandleSmart(pDevObj,szFileName);//my call FSD
nRet=KfCallFileSystem(pDevObj,Irp);
KdPrint((“\r\n!!!after Open :%x,%x,%ws”,nThisPID,nThisTID,szFileName));
IoCompleteRequest(Irp,IO_NO_INCREMENT);
KdPrint((“\r\n^^^complete Open :%x,%x,%ws”,nThisPID,nThisTID,szFileName));
KeReleaseSemaphore(g_pSyn_Test,0,1,FALSE);
return nRet;
}
the function HandleSmart is:
void HandleSmart(PDEVICE_OBJECT pDevObj,PWCHAR fullpathname)
{
PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)pDevObj->DeviceExtension;
UNICODE_STRING FileName;
OBJECT_ATTRIBUTES ObjectAttributes;
IO_STATUS_BLOCK IoStatus;
NTSTATUS Status = STATUS_SUCCESS;
HANDLE hFile;
PWCHAR fullpathnameIO=NULL;
fullpathnameIO=(PWCHAR)ExAllocatePool(NonPagedPool,MAX_PATH_LEN*sizeof(WCHAR));
memset(fullpathnameIO,0,MAX_PATH_LEN*sizeof(WCHAR));
wcscpy(fullpathnameIO,L"\??\“);
wcscat(fullpathnameIO,fullpathname);
KdPrint((”\r\nMy FileName:%ws",fullpathnameIO));
RtlInitUnicodeString(&FileName, fullpathnameIO);
InitializeObjectAttributes(&ObjectAttributes, // ptr to structure
&FileName, // ptr to file spec
OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE, // attributes
NULL, // root directory handle
NULL ); // ptr to security descriptor
KdPrint((“\r\nOpeExistSmart Create 1 before:%ws”,fullpathname));
Status= IoCreateFileSpecifyDeviceObjectHint(
&hFile,
(SYNCHRONIZE | FILE_READ_DATA|FILE_READ_ATTRIBUTES),
&ObjectAttributes,
&IoStatus,
NULL,
FILE_ATTRIBUTE_NORMAL,
0,
FILE_OPEN,
FILE_SYNCHRONOUS_IO_NONALERT,
NULL,
0,
CreateFileTypeNone,
NULL,
IO_IGNORE_SHARE_ACCESS_CHECK,
pDevExt->pFileSystemDeviceObject
);
KdPrint((“\r\nOpeExistSmart Create 2 after:%ws”,fullpathname));
if(!NT_SUCCESS(Status))
{
ExFreePool(fullpathnameIO);
return ;
}
ExFreePool(fullpathnameIO);
KdPrint((“\r\nOpeExistSmart Create close before:%ws”,fullpathname));
ZwClose(hFile);
KdPrint((“\r\nOpeExistSmart Create close after:%ws”,fullpathname));
}
When I single-click the D:\1.txt in Explorer.exe,the windbg’s output is:
—before Open :5ec,750,D:\1.txt
My FileName:??\D:\1.txt
OpeExistSmart Create 1 before:D:\1.txt
OpeExistSmart Create 2 after:D:\1.txt
OpeExistSmart Create close before:D:\1.txt
OpeExistSmart Create close after:D:\1.txt
!!!after Open :5ec,750,D:\1.txt
^^^complete Open :5ec,750,D:\1.txt
—before Open :5ec,750,D:\1.txt
My FileName:??\D:\1.txt
OpeExistSmart Create 1 before:D:\1.txt
OK,hanged!
the stack:
f6908524 80501346 81f5ec38 81f5ebc8 804fabb0 nt!KiSwapContext+0x2e (FPO: [Uses EBP] [0,0,4])
f6908530 804fabb0 00000000 81f4b008 82042a88 nt!KiSwapThread+0x46 (FPO: [0,0,0])
f6908558 8057868b 00000000 00000000 00000000 nt!KeWaitForSingleObject+0x1c2 (FPO: [Non-Fpo])
f690864c 805b490a 82075648 00000000 820003a0 nt!IopParseDevice+0xa2b (FPO: [Non-Fpo])
f69086d4 805b0deb 00000000 f6908714 00000240 nt!ObpLookupObjectName+0x56a (FPO: [Non-Fpo])
f6908728 8056b3b1 00000000 00000000 6d78a800 nt!ObOpenObjectByName+0xeb (FPO: [Non-Fpo])
f69087a4 8056bd28 f690894c 00100081 f6908928 nt!IopCreateFile+0x407 (FPO: [Non-Fpo])
f6908800 8056e3fa f690894c 00100081 f6908928 nt!IoCreateFileSpecifyDeviceObjectHint
…
