nested open/close of a mem-mapped file in XP

NTFSD
1

Hi,

I have a weird behavior of memory-mapped file read in XP.

When I run an EXE file off my FSD in XP, Explorer nests open/close of the
EXE file as it issues the following FSD requests:

  • open EXE (create handle 1)
  • read first 4K from the EXE (using handle 1)
    — open the same EXE (handle 2)
    — read file attributes (handle 2)
    — cleanup+close (handle 2)
  • read from a different location in the EXE (using handle 1)

The FSD implements file I/O by mapping the incoming FSD requests to file
I/O in a cache directory. When executing the last read in the list above,
the cached file’s handle (derived from handle 2’s data structure) becomes
invalid, i.e., ZwReadFile() returns STATUS_INVALID_HANDLE.

In general nested open/close work fine with my FSD, plus I never had any
problem in NT4 and 2000. I am assuming that there is a bug in my FSD
which was never triggered before XP, and which has to do with nesting
open/close of a memory-mapped file.

Does any of this make sense to anyone?

Thanks
Chuck Shavit