Thank you for the responses, and my apologies for not getting back to this
for so long.
Here are some quick answers to some of the questions:
Are you holding any locks when you send the irp down?
No.
Can you find the irp via the !irp command in WinDbg (and observe its state)?
See Below.
Are all of your ‘InvokeOn…’ flags in IoSetCompletionRoutine TRUE?
Yes.
Are you stepping on your completion routine registration?
No.
What IRP MajorFunction is this occurring on?
Read IRP is hanging during handling of Create IRP.
Are you changing anything in the IRP?
I’m rolling my own Read IRP, and not currently modifying the Create IRP.
OS Version?
Win2k.
Here’s a more detailed description of what the filter create dispatch
routine is doing:
- Detect an IRP_MJ_CREATE of interest
- Using ZwOpenFile, open the file about to be opened,
ZwQueryInformationFile to get file attributes, leave the file open
- Using ZwCreateFile, open a second file
- Get the file object from the handle of file opened in step #2
- Rolling my own read IRPs, attempt to read data from the file object from
step#4, IRP_MJ_READ never completes.
As previously mentioned, the READ not completing only occurs when the file
access is coming via srv.sys. This sequence works fine when the file access
is initiated at the local machine via explorer or some other application.
I have also learned that this problem occurs when the client is NT4 SP5, but
does not occur when the client is NT4 SP6 or Win2k. The filter is running on
Win2k. Let me know if there is some additional information that is needed to
determine why the READ is not completing.
I’m beginning to suspect that the read IRP isn’t completing because it is
queued to the same thread that is processing the original create IRP (and of
course the filter is blocking the create IRP from completing), but this
simple explanation doesn’t seem to account for the observed client dependent
differences.
Thanks again for the help.
Brad
Here’s what the debugger is telling me about the IRP that is not completing.
** READ IRP prior to IoCallDriver **
kd> !irp fca13e90
Irp is active with 7 stacks 8 is current (= 0xfca13ffc)
No Mdl Thread 87fa6da0: Irp is completed.
cmd flg cl Device File Completion-Context
[0, 0] 0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[3, 0] 0 e0 00000000 81158768 eed89cd0-00000000 Success Error Cancel
c0000005 Exception in kdextx86.irp debugger extension.
PC: 00491b3b VA: 00157817 R/W: 1 Parameter: 0001003f
** READ IRP after call to IoCallDriver returns STATUS_PENDING **
kd> !irp fca13e90 1
Irp is active with 7 stacks 7 is current (= 0xfca13fd8)
Mdl = 8116b7e8 Thread 87fa6da0: Irp stack trace.
Flags = 40000000
ThreadListEntry.Flink = fca13ea0
ThreadListEntry.Blink = fca13ea0
IoStatus.Status = 00000000
IoStatus.Information = e1c55a08
RequestorMode = 00000000
Cancel = 00
CancelIrql = 0
ApcEnvironment = 00
UserIosb = eefde478
UserEvent = eefde420
Overlay.AsynchronousParameters.UserApcRoutine = 00000000
Overlay.AsynchronousParameters.UserApcContext = 00000000
Overlay.AllocationSize = 00000000 - 00000000
CancelRoutine = 8041d713
UserBuffer = ff8ad000
&Tail.Overlay.DeviceQueueEntry = 00e6d6fc
Tail.Overlay.Thread = 87fa6da0
Tail.Overlay.AuxiliaryBuffer = 00000000
Tail.Overlay.ListEntry.Flink = 00000000
Tail.Overlay.ListEntry.Blink = 00000000
Tail.Overlay.CurrentStackLocation = fca13fd8
Tail.Overlay.OriginalFileObject = 81158768
Tail.Apc = 00000000
Tail.CompletionKey = 00000000
cmd flg cl Device File Completion-Context
[0, 0] 0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[0, 0] 0 10 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[3, 0] 0 e1 81318400 81158768 eed89cd0-00000000 Success Error Cancel
pending
Name paged outc0000005 Exception in kdextx86.irp debugger extension.
PC: 00491b3b VA: 01206007 R/W: 1 Parameter: 0001003f
** Information about the associated FileObject (target of READ IRP) **
kd> !object 81158768
Object: 81158768 Type: (814229a0) File
ObjectHeader: 81158750
HandleCount: 1 PointerCount: 2
Directory Object: 00000000 Name: (*** Name not accessable ***)
{(e1305e68: name not accessable)}
** CREATE IRP info - after call to IoCallDriver returns STATUS_PENDING for
the READ IRP **
kd> !irp f9997e70 1
Irp is active with 8 stacks 8 is current (= 0xf9997fdc)
No Mdl Thread 87fa6da0: Irp stack trace.
Flags = 40000884
ThreadListEntry.Flink = 87fa6fac
ThreadListEntry.Blink = 87fa6fac
IoStatus.Status = 00000000
IoStatus.Information = 00000000
RequestorMode = 00000000
Cancel = 00
CancelIrql = 0
ApcEnvironment = 00
UserIosb = eefde8b4
UserEvent = 00000000
Overlay.AsynchronousParameters.UserApcRoutine = 00000000
Overlay.AsynchronousParameters.UserApcContext = 00000000
Overlay.AllocationSize = 00000000 - 00000000
CancelRoutine = 00000000
UserBuffer = 00000000
&Tail.Overlay.DeviceQueueEntry = 00e6d6fc
Tail.Overlay.Thread = 87fa6da0
Tail.Overlay.AuxiliaryBuffer = 00000000
Tail.Overlay.ListEntry.Flink = 00000000
Tail.Overlay.ListEntry.Blink = 00000000
Tail.Overlay.CurrentStackLocation = f9997fdc
Tail.Overlay.OriginalFileObject = 811baba8
Tail.Apc = 00000000
Tail.CompletionKey = 00000000
cmd flg cl Device File Completion-Context
[0, 0] 0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[0, 0] 1 0 811db3e0 811baba8 00000000-00000000
Name paged out
Args: eefde8f4 05000144 00000020 00000000
[0, 0] 1 0 811db3e0 811baba8 00000000-00000000
Name paged out
Args: eefde8f4 05000144 00000020 00000000
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com