ntfsd Hi
There is a deadlock i find in my filter, after i copy file which size is about 780 MB from d:\ to c:. during the copy, the explorer hanged.
I found explorer’s thread and a system thread tried to get each’s esource, so the deadlock accured.
In my IRP_MJ_WRITE dispatch routine, i made a irp package to query the file name.
My question is that why the threads wanna get share locks to complete the work? I don’t ask
them to hold such a lock!
Thank u in advance!!!
my dump file is below:
kd> !locks -v 817e1668
Resource @ 0x817e1668 Exclusively owned
Contention Count = 3
NumberOfSharedWaiters = 1
NumberOfExclusiveWaiters = 1
Threads: 815153a0-01<*>
THREAD 815153a0 Cid 340.204 Teb: 7ff96000 Win32Thread: e30ffba8 WAIT: (Executive) KernelMode Non-Alertable
81527488 Semaphore Limit 0x7fffffff
81515488 NotificationTimer
IRP List:
81485528: (0006,01fc) Flags: 00000830 Mdl: 00000000
Not impersonating
Owning Process 815c9020
Wait Start TickCount 66227
Context Switch Count 140971 LargeStack
UserTime 0:00:03.0855
KernelTime 0:00:40.0808
Start Address KERNEL32!BaseThreadStartThunk (0x77e6b700)
Win32 Start Address SHLWAPI!WrapperThreadProc (0x70c0b86c)
Stack Init bcf3c000 Current bcf3b410 Base bcf3c000 Limit bcf36000 Call 0
Priority 14 BasePriority 8 PriorityDecrement 6 DecrementCount 16
ChildEBP RetAddr Args to Child
bcf3b428 804facbd 00000000 81853740 815153a0 nt!KiSwapThread+0xc5
bcf3b450 804e48da 81527488 00000000 00000000 nt!KeWaitForSingleObject+0x1a1
bcf3b490 804e40a7 bcf3b578 bcf3b584 00000000 nt!ExpWaitForResource+0x1ac
bcf3b4a8 804e3ff5 81853760 00000001 bcf3b534 nt!ExpAcquireSharedStarveExclusive+0xad
bcf3b4b8 804dc78d 81853740 00000001 bcf3b5e0 nt!ExAcquireSharedStarveExclusive+0x41
bcf3b534 804e157c 816f4db8 bcf3b578 00001000 nt!CcPinFileData+0x313
bcf3b5a8 bfef7ab1 816f4db8 bcf3b5e0 00001000 nt!CcPinRead+0xda
bcf3b5d0 bfefda69 814be808 816f3208 00008000 Ntfs!NtfsPinStream+0x70
bcf3b5fc bfeff919 814be808 816f40f0 00040000 Ntfs!NtfsMapOrPinPageInBitmap+0xaa
bcf3b67c bfefee2b 814be808 816f40f0 00041b63 Ntfs!NtfsAllocateBitmapRun+0x64
bcf3b7ac bfefe608 814be808 816f40f0 e2d4ad78 Ntfs!NtfsAllocateClusters+0x918
bcf3b8d4 bfef49da 814be808 81556c28 e2d4ad78 Ntfs!NtfsAddAllocation+0x3c9
bcf3ba0c bfef4bc0 814be808 81556c28 81485528 Ntfs!NtfsSetEndOfFileInfo+0x621
bcf3baa4 bfef4b68 814be808 81485528 816f4020 Ntfs!NtfsCommonSetInformation+0x3d5
bcf3bb14 804ecc8b 816f4020 81485528 814856b0 Ntfs!NtfsFsdSetInformation+0xbf
bcf3bb28 bff75665 816f5740 81485528 81485694 nt!IopfCallDriver+0x35
bcf3bb4c bff7829b 816f5740 81485528 816f5740 Kfilter!KfPassThrough+0xf4
bcf3bb88 bff79530 816f5740 81485528 bcf3bd48 Kfilter!KfProtectSetInformation+0x96
bcf3bb98 804ecc8b 816f5740 81485528 814856d4 Kfilter!KfSetInformation+0x10
bcf3bbac ed818ab0 816f9800 81485528 00000000 nt!IopfCallDriver+0x35
bcf3bd48 80532f14 000003a0 0381edcc 0381ede0 CnsMinKP+0xab0
bcf3bd48 77f88bf7 000003a0 0381edcc 0381ede0 nt!KiSystemService+0xc4
0381ee44 00000000 00000000 00000000 00000000 ntdll!NtSetInformationFile+0xb
81857b20-01
THREAD 81857b20 Cid 8.14 Teb: 00000000 Win32Thread: 00000000 WAIT: (Executive) KernelMode Non-Alertable
81612328 Semaphore Limit 0x7fffffff
81857c08 NotificationTimer
Not impersonating
Owning Process 818589e0
Wait Start TickCount 66228
Context Switch Count 6028
UserTime 0:00:00.0000
KernelTime 0:00:00.0600
Start Address nt!ExpWorkerThread (0x804e63a6)
Stack Init ed830000 Current ed82f478 Base ed830000 Limit ed82d000 Call 0
Priority 14 BasePriority 13 PriorityDecrement 1 DecrementCount 16
ChildEBP RetAddr Args to Child
ed82f490 804facbd 00000000 817e1668 81857b20 nt!KiSwapThread+0xc5
ed82f4b8 804e48da 81612328 00000000 00000000 nt!KeWaitForSingleObject+0x1a1
ed82f4f8 804e3f6a c00000d8 816f54c8 ed82f618 nt!ExpWaitForResource+0x1ac
ed82f510 804e3eb5 817e1668 817e3201 ed82f5d0 nt!ExpAcquireResourceSharedLite+0xb0
ed82f520 bfedcb60 817e1668 817e3201 ed82f618 nt!ExAcquireResourceSharedLite+0x41
ed82f538 bff00f36 ed82f618 816f54c8 816f3208 Ntfs!NtfsAcquireSharedFcb+0x1f
ed82f5d0 bff01245 ed82f618 8141c848 816f4020 Ntfs!NtfsCommonQueryInformation+0x166
ed82f744 804ecc8b 816f4020 8141c848 8182ddc8 Ntfs!NtfsFsdQueryInformation+0xd7
ed82f758 bff76216 00000001 8141c9b4 00000000 nt!IopfCallDriver+0x35
ed82f78c bff75be3 00000005 816f4db8 816f4020 Kfilter!KfQuerySetInformation+0x18d
ed82f7cc bff79fc9 816f5740 816f4db8 817f4668 Kfilter!KfGetFileFullPathName+0x63
ed82fa24 bff79570 816f5740 81483de8 ed82faf8 Kfilter!KfIRPWriteEncrypt+0x124
ed82fa34 804ecc8b 816f5740 81483de8 81483f94 Kfilter!KfWrite+0x10
ed82fa48 ed818ab0 816f9800 81483de8 00000000 nt!IopfCallDriver+0x35
ed82faf8 8050b92e 816f4db8 ed82fb20 ed82fba8 CnsMinKP+0xab0
ed82fbc4 8050b43a e1437020 e143704c 00000019 nt!MiFlushSectionInternal+0x36a
ed82fc04 804de7df 817e5920 00000006 0000b000 nt!MmFlushSection+0x1a4
ed82fcd8 804de104 817ee354 00000000 00000001 nt!CcFlushCache+0x399
ed82fd0c 804e2608 81858128 80542cc0 81857b20 nt!CcWriteBehind+0xc0
ed82fd78 804e6454 81858128 00000000 00000000 nt!CcWorkerThread+0x12c
ed82fda8 80522b64 81858128 00000000 00000000 nt!ExpWorkerThread+0xae
ed82fddc 8053786a 804e63a6 00000000 00000000 nt!PspSystemThreadStartup+0x54
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
Threads Waiting On Exclusive Access:
8154d860
1 total locks, 1 locks currently held
kd> !locks
**** DUMP OF ALL RESOURCE OBJECTS ****
KD: Scanning for held locks…
Resource @ 0x817e3248 Shared 1 owning threads
Threads: 81857b20-01<*>
KD: Scanning for held locks.
Resource @ 0x817e1668 Exclusively owned
Contention Count = 3
NumberOfSharedWaiters = 1
NumberOfExclusiveWaiters = 1
Threads: 815153a0-01<*> 81857b20-01
Threads Waiting On Exclusive Access:
8154d860
KD: Scanning for held locks…
Resource @ 0x81853740 Exclusively owned
Contention Count = 1
NumberOfSharedWaiters = 1
Threads: 81857b20-01<*> 815153a0-01
???george
???xxxxx@hotmail.com
???2003-12-27