Hi,
I’ve a pseudo file system driver which sits on top of NTFS.
On one of the deployments, I’m getting a crash in NTFS while trying to
access a particular directory when my driver queries the alternate
name information. The system crashes in NTFS with following bug check
0: kd> .bugcheck
Bugcheck code 00000024
Arguments 0019033c f652b918 f652b614 f728ec5d
Here is the call stack: (the third party AV filter is acting as a
passthru and doesn’t seem to be the problem).
f652ba4c f7281d10 f652bb30 e31c70d0 00000000
Ntfs!NtfsQueryAlternateNameInfo+0xf (FPO: [Non-Fpo])
f652bab8 f725b4cc f652bb30 84a4b430 85e56020
Ntfs!NtfsCommonQueryInformation+0x219 (FPO: [Non-Fpo])
f652bb1c f725b505 f652bb30 84a4b430 00000001
Ntfs!NtfsFsdDispatchSwitch+0x12a (FPO: [Non-Fpo])
f652bc38 8083f9d0 85f5c718 84a4b430 862af030
Ntfs!NtfsFsdDispatchWait+0x1c (FPO: [Non-Fpo])
f652bc4c f730dc53 862af030 8082b0b9 85fe52c4 nt!IofCallDriver+0x45
(FPO: [Non-Fpo])
f652bc74 8083f9d0 85e56020 84a4b430 f652bcd0 fltmgr!FltpDispatch+0x6f
(FPO: [Non-Fpo])
f652bc88 f6df5fd4 00000000 f652bcd0 85fccdf8 nt!IofCallDriver+0x45
(FPO: [Non-Fpo])
f652bd00 8092f7f6 f652bda4 f652be30 8092f5f0 third-party-AV-filter
f652bd88 80834d3f 80003688 f652be68 84cb6da0
nt!NtQueryInformationFile+0x489 (FPO: [Non-Fpo])
f652bd88 8083cb39 80003688 f652be68 84cb6da0 nt!KiFastCallEntry+0xfc
(FPO: [0,0] TrapFrame @ f652bda4)
f652be14 f689a822 80003688 f652be68 84cb6da0
nt!ZwQueryInformationFile+0x11 (FPO: [5,0,0])
The system crash while trying to access some member of the structure
passed as third parameter to NtfsQueryAlternateNameInfo, which is
NULL.
Note that prior to calling the ZwQueryInformationFile with
FileAlternateNameInformation, I’ve successfully queried the same
object handle with StandardInformation and InternalInformation, and
have confirmed there is no memory / handle corruption etc.
I’ve ran chkdsk and it has not reported any problems. The disk and
RAID diagnostics don’t report any problems (no corruption etc.).
Deleting and recreating the folder works for a while, but after some
time (around 24 hours) the problem occurs again for this exact same
folder.
My question is has anyone seen this type of problem? Any thoughts on
how to find out the reason for this crash?
Thanks in advance,
- Hrishikesh.