sc stop is hanging, Part Deaux

NTFSD
1

As I said in an earlier posting (the “sc stop is hanging” thread), when I do
“sc stop myFilter” it just hangs until I hit Ctrl-C. Then any sc command
hangs and rebooting windows hangs.

I have now eliminated the possibility of my leaving filter manager contexts
with unmatched references. I did this by keeping all my contexts on a list
and enumerating them at unload time and deleting each one. When my unload
finishes, there are no contexts left around at all that originated from my
driver.

Does anyone have any other idea of what could cause “sc stop” to hang? The
only thing I can think of doing is commenting out all code in my driver that
does anything, verify it unloads ok, and slowly un-commenting code until it
fails again. This will be a ton of work. Anyone have a better idea?

2

Mark:

Back to square one, eh? :frowning:

You’re running with verifier enabled, right? It can help find things that
might be related.

Do you use FltGetFileNameInformation() or variants thereof? They must be
matched with a FltReleaseFileNameInformation().

How about FltAcquireResourcexxx? Closed all files opened with
FltCreateFile()? Released FileObjects obtained by
ObReferenceObjectByHandle()? FltAllocatexxx()?

How about mutexes? Or spin locks? Or security descriptors? Or…

Without knowing everything you’re doing, it’s hard to offer much except
condolences.

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
Sent: Friday, March 25, 2005 8:14 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] sc stop is hanging, Part Deaux

As I said in an earlier posting (the “sc stop is hanging” thread), when I do

“sc stop myFilter” it just hangs until I hit Ctrl-C. Then any sc command
hangs and rebooting windows hangs.

I have now eliminated the possibility of my leaving filter manager contexts
with unmatched references. I did this by keeping all my contexts on a list
and enumerating them at unload time and deleting each one. When my unload
finishes, there are no contexts left around at all that originated from my
driver.

Does anyone have any other idea of what could cause “sc stop” to hang? The
only thing I can think of doing is commenting out all code in my driver that

does anything, verify it unloads ok, and slowly un-commenting code until it
fails again. This will be a ton of work. Anyone have a better idea?

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

A couple others:

You’re using RtlVolumeDeviceToDosName(), right? Are you calling
ObDereferenceObject() for the VDO you get?

Any FltEnumerateVolumes()? FltEnumerateInstances()?
PsReferenceImpersonationToken()? PsReferencePrimaryToken()?
SeLockSubjectContext()?

There’s really quite a few…

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ken Cross
Sent: Friday, March 25, 2005 10:10 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] sc stop is hanging, Part Deaux

Mark:

Back to square one, eh? :frowning:

You’re running with verifier enabled, right? It can help find things that
might be related.

Do you use FltGetFileNameInformation() or variants thereof? They must be
matched with a FltReleaseFileNameInformation().

How about FltAcquireResourcexxx? Closed all files opened with
FltCreateFile()? Released FileObjects obtained by
ObReferenceObjectByHandle()? FltAllocatexxx()?

How about mutexes? Or spin locks? Or security descriptors? Or…

Without knowing everything you’re doing, it’s hard to offer much except
condolences.

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
Sent: Friday, March 25, 2005 8:14 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] sc stop is hanging, Part Deaux

As I said in an earlier posting (the “sc stop is hanging” thread), when I do

“sc stop myFilter” it just hangs until I hit Ctrl-C. Then any sc command
hangs and rebooting windows hangs.

I have now eliminated the possibility of my leaving filter manager contexts
with unmatched references. I did this by keeping all my contexts on a list
and enumerating them at unload time and deleting each one. When my unload
finishes, there are no contexts left around at all that originated from my
driver.

Does anyone have any other idea of what could cause “sc stop” to hang? The
only thing I can think of doing is commenting out all code in my driver that

does anything, verify it unloads ok, and slowly un-commenting code until it
fails again. This will be a ton of work. Anyone have a better idea?

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

Prefast gave no error and when I enable the verifier nothing special seems
to happen. I’m not exactly sure what is supposed to happen with the
verifier.

“Ken Cross” wrote in message news:xxxxx@ntfsd…
> Mark:
>
> Back to square one, eh? :frowning:
>
> You’re running with verifier enabled, right? It can help find things that
> might be related.
>
> Do you use FltGetFileNameInformation() or variants thereof? They must be
> matched with a FltReleaseFileNameInformation().
>
> How about FltAcquireResourcexxx? Closed all files opened with
> FltCreateFile()? Released FileObjects obtained by
> ObReferenceObjectByHandle()? FltAllocatexxx()?
>
> How about mutexes? Or spin locks? Or security descriptors? Or…
>
> Without knowing everything you’re doing, it’s hard to offer much except
> condolences.
>
> Ken
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
> Sent: Friday, March 25, 2005 8:14 PM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] sc stop is hanging, Part Deaux
>
> As I said in an earlier posting (the “sc stop is hanging” thread), when I
> do
>
> “sc stop myFilter” it just hangs until I hit Ctrl-C. Then any sc command
> hangs and rebooting windows hangs.
>
> I have now eliminated the possibility of my leaving filter manager
> contexts
> with unmatched references. I did this by keeping all my contexts on a
> list
> and enumerating them at unload time and deleting each one. When my unload
> finishes, there are no contexts left around at all that originated from my
> driver.
>
> Does anyone have any other idea of what could cause “sc stop” to hang?
> The
> only thing I can think of doing is commenting out all code in my driver
> that
>
> does anything, verify it unloads ok, and slowly un-commenting code until
> it
> fails again. This will be a ton of work. Anyone have a better idea?
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@comcast.net
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>

5

Mark,

Your algorithm for deleting the contexts at unload time will NOT
eliminate the issue of your filter not unloading if you have a leaked
context reference. All delete does is detach it from its associated
system object but it will not be freed (and your filter can not unload)
until ALL references to it go away.

For longhorn we are going to fix the filter manager verifier support so
if verification is on it will detect linked contexts. This is an
important enough change that we will backport this feature to downlevel
OS’s.

In the meantime if you will run with a CHKD version of filter manager it
will report lost contexts on the debugger screen when your filter
unloads. What version of the OS are you doing this on?

Neal Christiansen
Microsoft File System Filter Group Lead
This posting is provided “AS IS” with no warranties, and confers no
Rights

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
Sent: Friday, March 25, 2005 5:14 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] sc stop is hanging, Part Deaux

As I said in an earlier posting (the “sc stop is hanging” thread), when
I do
“sc stop myFilter” it just hangs until I hit Ctrl-C. Then any sc
command
hangs and rebooting windows hangs.

I have now eliminated the possibility of my leaving filter manager
contexts
with unmatched references. I did this by keeping all my contexts on a
list
and enumerating them at unload time and deleting each one. When my
unload
finishes, there are no contexts left around at all that originated from
my
driver.

Does anyone have any other idea of what could cause “sc stop” to hang?
The
only thing I can think of doing is commenting out all code in my driver
that
does anything, verify it unloads ok, and slowly un-commenting code until
it
fails again. This will be a ton of work. Anyone have a better idea?

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

6

The blocking of unload will ONLY occur if you have called Flt APIs that
return an object of some kind and then don’t release the reference on
them. We can’t block unload if you call other API’s (because we don’t
know that you called them).

Neal Christiansen
Microsoft File System Filter Group Lead
This posting is provided “AS IS” with no warranties, and confers no
Rights

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ken Cross
Sent: Friday, March 25, 2005 7:47 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] sc stop is hanging, Part Deaux

A couple others:

You’re using RtlVolumeDeviceToDosName(), right? Are you calling
ObDereferenceObject() for the VDO you get?

Any FltEnumerateVolumes()? FltEnumerateInstances()?
PsReferenceImpersonationToken()? PsReferencePrimaryToken()?
SeLockSubjectContext()?

There’s really quite a few…

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ken Cross
Sent: Friday, March 25, 2005 10:10 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] sc stop is hanging, Part Deaux

Mark:

Back to square one, eh? :frowning:

You’re running with verifier enabled, right? It can help find things
that
might be related.

Do you use FltGetFileNameInformation() or variants thereof? They must
be
matched with a FltReleaseFileNameInformation().

How about FltAcquireResourcexxx? Closed all files opened with
FltCreateFile()? Released FileObjects obtained by
ObReferenceObjectByHandle()? FltAllocatexxx()?

How about mutexes? Or spin locks? Or security descriptors? Or…

Without knowing everything you’re doing, it’s hard to offer much except
condolences.

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
Sent: Friday, March 25, 2005 8:14 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] sc stop is hanging, Part Deaux

As I said in an earlier posting (the “sc stop is hanging” thread), when
I do

“sc stop myFilter” it just hangs until I hit Ctrl-C. Then any sc
command
hangs and rebooting windows hangs.

I have now eliminated the possibility of my leaving filter manager
contexts
with unmatched references. I did this by keeping all my contexts on a
list
and enumerating them at unload time and deleting each one. When my
unload
finishes, there are no contexts left around at all that originated from
my
driver.

Does anyone have any other idea of what could cause “sc stop” to hang?
The
only thing I can think of doing is commenting out all code in my driver
that

does anything, verify it unloads ok, and slowly un-commenting code until
it
fails again. This will be a ton of work. Anyone have a better idea?

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

7

Neal:

Really? That’s good to know, but seems a little dangerous since those
objects will stay locked forever, right?

OTOH, as you say, I don’t see how you could monitor every kernel call
made…

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Neal Christiansen
Sent: Sunday, March 27, 2005 12:35 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] sc stop is hanging, Part Deaux

The blocking of unload will ONLY occur if you have called Flt APIs that
return an object of some kind and then don’t release the reference on
them. We can’t block unload if you call other API’s (because we don’t
know that you called them).

Neal Christiansen
Microsoft File System Filter Group Lead
This posting is provided “AS IS” with no warranties, and confers no
Rights

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ken Cross
Sent: Friday, March 25, 2005 7:47 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] sc stop is hanging, Part Deaux

A couple others:

You’re using RtlVolumeDeviceToDosName(), right? Are you calling
ObDereferenceObject() for the VDO you get?

Any FltEnumerateVolumes()? FltEnumerateInstances()?
PsReferenceImpersonationToken()? PsReferencePrimaryToken()?
SeLockSubjectContext()?

There’s really quite a few…

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ken Cross
Sent: Friday, March 25, 2005 10:10 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] sc stop is hanging, Part Deaux

Mark:

Back to square one, eh? :frowning:

You’re running with verifier enabled, right? It can help find things
that
might be related.

Do you use FltGetFileNameInformation() or variants thereof? They must
be
matched with a FltReleaseFileNameInformation().

How about FltAcquireResourcexxx? Closed all files opened with
FltCreateFile()? Released FileObjects obtained by
ObReferenceObjectByHandle()? FltAllocatexxx()?

How about mutexes? Or spin locks? Or security descriptors? Or…

Without knowing everything you’re doing, it’s hard to offer much except
condolences.

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
Sent: Friday, March 25, 2005 8:14 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] sc stop is hanging, Part Deaux

As I said in an earlier posting (the “sc stop is hanging” thread), when
I do

“sc stop myFilter” it just hangs until I hit Ctrl-C. Then any sc
command
hangs and rebooting windows hangs.

I have now eliminated the possibility of my leaving filter manager
contexts
with unmatched references. I did this by keeping all my contexts on a
list
and enumerating them at unload time and deleting each one. When my
unload
finishes, there are no contexts left around at all that originated from
my
driver.

Does anyone have any other idea of what could cause “sc stop” to hang?
The
only thing I can think of doing is commenting out all code in my driver
that

does anything, verify it unloads ok, and slowly un-commenting code until
it
fails again. This will be a ton of work. Anyone have a better idea?

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com