NPFS CreateNamedPipe handler

NTFSD
1

Hi guys,

I faced a very strange Windows 7 x86 hang during boot (right before login screen, system remains responsive but shows a black desktop only and sometimes crashes in LSASS if I do several mouse clicks over that black desktop). I have some legacy filter which attaches to NPFS and hooks some FS requests including IRP_MJ_CREATE_NAMED_PIPE. The latter is only processed in its pre-processing phase, i.e. my filter simply gathers some info and calls IoSkipCurrentStackLocation and IoCallDriver without setting any completion routine and without changing a status which IoCallDriver returns. In other words, this handler behaves as a simple pass-thru. The problem is that when I turn on “Force pending I/O requests” option in Driver Verifier for my filter, this hang begins to occur stably each time I restart Windows 7. I checked all thread stacks but I didn’t find any with something related to IRP processing or to my filter driver. It’s worth to notice that with “Force pending I/O requests” option turned off this issue is not reproduced at all and OS seems to be stable, but of course, I’d like to check my filter with all DV options to get assured that everything is OK with my code. :slight_smile: I’m really stuck, I don’t know what piece of my code may potentially force this OS behavior. Thanks a lot in advance, any advice and suggestions will be highly appreciated.

Best regards,
Konstantin Manurin

2

>The problem is that when I turn on “Force pending I/O requests” option in

Driver Verifier for my filter, this hang begins to occur stably >each time
I restart Windows 7.

Have you tried removing your filter entirely and turning this Verifier
option on for NPFS? It could very well be a bug in a user mode component
that has never had to deal with STATUS_PENDING being returned before. It
wouldn’t be the first time that I’ve seen this…

-scott

–
Scott Noone
Consulting Associate and Chief System Problem Analyst
OSR Open Systems Resources, Inc.
http://www.osronline.com

Hope to see you at the next OSR kernel debugging class February 14th in
Columbia, MD!

3

Scott, thank you very much for this point. I also reminisce Sysinternals PageDefrag utility which magically fails to fill in a list of files in question in case there’s at least one minifilter in the system with active IRP_MJ_FILE_SYSTEM_CONTROL handler.

Best regards,
Konstantin Manurin