Overuse of FMfn pool on vista (vanilla install)

NTFSD
1

It seems that luafv or FileInfo drivers are using a lot of FMfn pool
on Vista (at first I thought it’s a memory leak in my driver, but I’ve
removed it - and still the same - high Alloc-Free of FMfn tag).
Is this a bug in the drivers, or do they actually make use of the
file name info allocations for a longer time?

–
Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
http://www.alfasp.com
File system audit, security and encryption kits.

2

> Is this a bug in the drivers

Is it growing during the work?

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

3

I’ve seen it as high as 4000 with <10 minutes of uptime, I didn’t go over that.

“Maxim S. Shatskih” wrote:

> Is this a bug in the drivers

Is it growing during the work?

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

–
Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
http://www.alfasp.com
File system audit, security and encryption kits.

4

BTW, a customer saw 34000 FMfn allocations with ~14000 open files.
On XP, the number of FMfn allocations rarely reaches 10 at a time.

“Maxim S. Shatskih” wrote:

> Is this a bug in the drivers

Is it growing during the work?

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

–
Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
http://www.alfasp.com
File system audit, security and encryption kits.

5

This is the filter manager structure that keeps track of cached names
for streams (when they are queried by a minifilter).

If you have a minifilter on the system, I would be suspicious that this
filter is leaking references to FLT_FILE_NAME_INFORMATION structures.

Minifilter verifier is your friend here and can help you detect the
offender.

Regards,
Sarosh.
File System Filter Lead
Microsoft Corp

This posting is provided “AS IS” with no warranties, and confers no Rights

Dejan Maksimovic wrote:

BTW, a customer saw 34000 FMfn allocations with ~14000 open files.
On XP, the number of FMfn allocations rarely reaches 10 at a time.

“Maxim S. Shatskih” wrote:

>> Is this a bug in the drivers
> Is it growing during the work?
>
> –
> Maxim S. Shatskih
> Windows DDK MVP
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

–
Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
http://www.alfasp.com
File system audit, security and encryption kits.

6

The FMfn use does not “overrise” (i.e. does not rise over :wink: the number of open files, but it IS high, without my
filter. The two Vista integrated filters (one of them at least) do not free the structures, but since it does not rise
over the number of open files, I presume the drivers actually use the structure…
Either that or FltMgr on Vista keeps cache references for a LONG time?

Sarosh Havewala wrote:

This is the filter manager structure that keeps track of cached names
for streams (when they are queried by a minifilter).

If you have a minifilter on the system, I would be suspicious that this
filter is leaking references to FLT_FILE_NAME_INFORMATION structures.

Minifilter verifier is your friend here and can help you detect the
offender.

Regards,
Sarosh.
File System Filter Lead
Microsoft Corp

This posting is provided “AS IS” with no warranties, and confers no Rights

Dejan Maksimovic wrote:
> BTW, a customer saw 34000 FMfn allocations with ~14000 open files.
> On XP, the number of FMfn allocations rarely reaches 10 at a time.
>
> “Maxim S. Shatskih” wrote:
>
>>> Is this a bug in the drivers
>> Is it growing during the work?
>>
>> –
>> Maxim S. Shatskih
>> Windows DDK MVP
>> xxxxx@storagecraft.com
>> http://www.storagecraft.com
>>
>> —
>> NTFSD is sponsored by OSR
>>
>> For our schedule of debugging and file system seminars
>> (including our new fs mini-filter seminar) visit:
>> http://www.osr.com/seminars
>>
>> To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
>
> –
> Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
> http://www.alfasp.com
> File system audit, security and encryption kits.
>
>
>

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

–
Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
http://www.alfasp.com
File system audit, security and encryption kits.