I wonder if anyone has seen something like this…
Minifilter (mine) in post-create callback does something like
PFLT_FILE_NAME_INFORMATION pFileName = NULL;
status = FltGetFileNameInformation(Data, FLT_FILE_NAME_SHORT|FLT_FILE_NAME_QUERY_DEFAULT, &pFileName);
if (!NT_SUCCESS(status))
{
goto Error;
}
… and crashes spectacularly with bugcheck 0x24. All this happens when the system is being upgraded from XP2 to XP3. 4 cores
2: kd> lmvm ntfs
start end module name
ba635000 ba6c1400 Ntfs (no symbols)
Loaded symbol image file: Ntfs.sys
Image path: Ntfs.sys
Image name: Ntfs.sys
Timestamp: Fri Feb 09 03:10:31 2007 (45CC56A7)
CheckSum: 00096DF9
ImageSize: 0008C400
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
2: kd> !analyze -v
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 001902fe
Arg2: b593b3a8
Arg3: b593b0a4
Arg4: ba66e123
<…>
2: kd> .cxr 0xffffffffb593b0a4
eax=b593b4cc ebx=b593b5c0 ecx=00000000 edx=00000000 esi=e6d4dd20 edi=891c5ab4
eip=ba66e123 esp=b593b470 ebp=b593b4dc iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
Ntfs!NtfsQueryAlternateNameInfo+0xf:
ba66e123 8b8280000000 mov eax,dword ptr [edx+80h] ds:0023:00000080=???
2: kd> kn
*** Stack trace for last set context - .thread/.cxr resets it
ChildEBP RetAddr
00 b593b4dc ba66e10a Ntfs!NtfsQueryAlternateNameInfo+0xf
01 b593b548 ba65b29c Ntfs!NtfsCommonQueryInformation+0x214
02 b593b5ac ba65b2d5 Ntfs!NtfsFsdDispatchSwitch+0x12a
03 b593b6d0 804ef095 Ntfs!NtfsFsdDispatchWait+0x1c
04 b593b6e0 ba6d9459 nt!IopfCallDriver+0x31
05 b593b6e8 804ef095 sr!SrPassThrough+0x31
06 b593b6f8 ba6fd433 nt!IopfCallDriver+0x31
07 b593b724 ba7012fb fltMgr!FltpQueryInformationFile+0x99
08 b593b74c ba6ff96a fltMgr!FltpGetShortFileName+0x5b
09 b593b760 ba6fff2e fltMgr!FltpCallShortFileNameHandler+0x44
0a b593b778 ba700001 fltMgr!FltpCreateFileNameInformation+0x74
0b b593b788 ba6f0aac fltMgr!CreateTemporaryFileNameInformation+0xf
0c b593b7b4 ba6f1008 fltMgr!FltpGetFileNameInformation+0xaa
0d b593b7dc b4cc51e8 fltMgr!FltGetFileNameInformation+0x114
WARNING: Stack unwind information not available. Following frames may be wrong.
0e b593b820 b4cc53e9 +0x21e8
file object in question is \Windows\Temp. IO’s initiator is update.exe, looks like it is renaming something by calling MoveFileEx.
Overall it looks suspiciously similar to http://support.microsoft.com/default.aspx/kb/954495
Any advise? Yes, I can try getting normalized file name instead of the short file name.