Unreferenced device object to be deleted is still in use

NTDEV
1

Hi All,

I am hitting the following assertion after disabing FC ports to my
external disks:

*** Assertion failed: Unreferenced device object to be deleted is
still in use((vpb->Flags & (VPB_MOUNTED | VPB_LOCKED)) == 0)
*** Source File: d:\srvrtm\base\ntos\io\iomgr\objsup.c, line 872

Break repeatedly, break Once, Ignore, terminate Process, or terminate
Thread (boipt)? b
b
Execute ‘.cxr F78E6A3C’ to dump context
Break instruction exception - code 80000003 (first chance)
nt!DbgBreakPoint:
811507a8 cc int 3
1: kd> kb
ChildEBP RetAddr Args to Child
f78e6a24 811529f6 846653c8 84a4d750 846653b0 nt!DbgBreakPoint
f78e6d0c 81308e28 81308d38 81308d10 00000368 nt!RtlAssert+0xba
f78e6d2c 813904cf 846653c8 00000000 846653b0 nt!IopDeleteDevice+0x76
f78e6d50 81146b12 846653c8 00000000 81146a70 nt!ObpRemoveObjectRoutine+0x263
f78e6d70 f739137d 86bc4b40 8126d85c f78e6dac nt!ObfDereferenceObject+0xa2
f78e6d80 81165bfa 84bccd68 00000000 86bc4b40 volsnap!VspCleanupFilterWorker+0x51
f78e6dac 813b5d7c 84bccd68 00000000 00000000 nt!ExpWorkerThread+0x12e
f78e6ddc 81174ed6 81165acc 00000001 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

1: kd> !devobj 846653c8
Device object (846653c8) is for:
\Driver\Ftdisk DriverObject 86b48938
Current Irp 00000000 RefCount 0 Type 00000007 Flags 00001050
Dacl e18acf84 DevExt 84665480 DevObjExt 84665650
ExtensionFlags (0x04000012) DOE_DELETE_PENDING, DOE_START_PENDING
Unknown flags 0x04000000
Device queue is not busy.
1: kd> !devstack 846653c8
!DevObj !DrvObj !DevExt ObjectName

846653c8 \Driver\Ftdisk 84665480

So it appears that an ftdisk DO is being that is being deleted while
still in use. I currently have an upperfilter to the disk class
driver installed. Is there a way to find out if my driver has
something to do with the above ASSERT? At the moment, I have already
recv’d REMOVE_DEVICE for all my DOs (above \device\disk) and they have
all been deleted. Can somebody help me with the relationship b/t the
two?

Thanks in advance,
Alex

2

Well, what you want to see is the VPB - but usually that is shown in the
device object display (you can use "!vpb

" or "dt
nt!_VPB " to display it).

But the VPB bits in question here are normally used by the file system;
not sure if ftdisk tries to use them when constructing a volume from the
underlying partition objects (having never looked). But I've looked at
the VPB of volumes numerous times.

If you use the .cxr command, you can probably find the VPB from one of
the registers as well, since it was just tested...

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Alex
Sent: Monday, August 15, 2005 1:50 PM
To: ntdev redirect
Subject: [ntdev] Unreferenced device object to be deleted is still in
use

Hi All,

I am hitting the following assertion after disabing FC ports to my
external disks:

***Assertion failed: Unreferenced device object to be deleted is
still in use((vpb->Flags & (VPB_MOUNTED | VPB_LOCKED)) == 0)
*** Source File: d:\srvrtm\base\ntos\io\iomgr\objsup.c, line 872

Break repeatedly, break Once, Ignore, terminate Process, or terminate
Thread (boipt)? b
b
Execute '.cxr F78E6A3C' to dump context
Break instruction exception - code 80000003 (first chance)
nt!DbgBreakPoint:
811507a8 cc int 3
1: kd> kb
ChildEBP RetAddr Args to Child
f78e6a24 811529f6 846653c8 84a4d750 846653b0 nt!DbgBreakPoint
f78e6d0c 81308e28 81308d38 81308d10 00000368 nt!RtlAssert+0xba
f78e6d2c 813904cf 846653c8 00000000 846653b0 nt!IopDeleteDevice+0x76
f78e6d50 81146b12 846653c8 00000000 81146a70
nt!ObpRemoveObjectRoutine+0x263
f78e6d70 f739137d 86bc4b40 8126d85c f78e6dac
nt!ObfDereferenceObject+0xa2
f78e6d80 81165bfa 84bccd68 00000000 86bc4b40
volsnap!VspCleanupFilterWorker+0x51
f78e6dac 813b5d7c 84bccd68 00000000 00000000 nt!ExpWorkerThread+0x12e
f78e6ddc 81174ed6 81165acc 00000001 00000000
nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

1: kd> !devobj 846653c8
Device object (846653c8) is for:
\Driver\Ftdisk DriverObject 86b48938
Current Irp 00000000 RefCount 0 Type 00000007 Flags 00001050
Dacl e18acf84 DevExt 84665480 DevObjExt 84665650
ExtensionFlags (0x04000012) DOE_DELETE_PENDING, DOE_START_PENDING
Unknown flags 0x04000000
Device queue is not busy.
1: kd> !devstack 846653c8
!DevObj !DrvObj !DevExt ObjectName
> 846653c8 \Driver\Ftdisk 84665480

So it appears that an ftdisk DO is being that is being deleted while
still in use. I currently have an upperfilter to the disk class
driver installed. Is there a way to find out if my driver has
something to do with the above ASSERT? At the moment, I have already
recv'd REMOVE_DEVICE for all my DOs (above \device\disk) and they have
all been deleted. Can somebody help me with the relationship b/t the
two?

Thanks in advance,
Alex

---
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument:
''
To unsubscribe send a blank email to xxxxx@lists.osr.com
3

Can you avoid deleting the disk device objects? The only safe way you can
do this is via PnP remove - i.e. IoInvalidateDeviceState.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Alex”
To: “Windows System Software Devs Interest List”
Sent: Monday, August 15, 2005 9:49 PM
Subject: [ntdev] Unreferenced device object to be deleted is still in use

Hi All,

I am hitting the following assertion after disabing FC ports to my
external disks:

Assertion failed: Unreferenced device object to be deleted is
still in use((vpb->Flags & (VPB_MOUNTED | VPB_LOCKED)) == 0)
 Source File: d:\srvrtm\base\ntos\io\iomgr\objsup.c, line 872

Break repeatedly, break Once, Ignore, terminate Process, or terminate
Thread (boipt)? b
b
Execute ‘.cxr F78E6A3C’ to dump context
Break instruction exception - code 80000003 (first chance)
nt!DbgBreakPoint:
811507a8 cc int 3
1: kd> kb
ChildEBP RetAddr Args to Child
f78e6a24 811529f6 846653c8 84a4d750 846653b0 nt!DbgBreakPoint
f78e6d0c 81308e28 81308d38 81308d10 00000368 nt!RtlAssert+0xba
f78e6d2c 813904cf 846653c8 00000000 846653b0 nt!IopDeleteDevice+0x76
f78e6d50 81146b12 846653c8 00000000 81146a70 nt!ObpRemoveObjectRoutine+0x263
f78e6d70 f739137d 86bc4b40 8126d85c f78e6dac nt!ObfDereferenceObject+0xa2
f78e6d80 81165bfa 84bccd68 00000000 86bc4b40
volsnap!VspCleanupFilterWorker+0x51
f78e6dac 813b5d7c 84bccd68 00000000 00000000 nt!ExpWorkerThread+0x12e
f78e6ddc 81174ed6 81165acc 00000001 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

1: kd> !devobj 846653c8
Device object (846653c8) is for:
\Driver\Ftdisk DriverObject 86b48938
Current Irp 00000000 RefCount 0 Type 00000007 Flags 00001050
Dacl e18acf84 DevExt 84665480 DevObjExt 84665650
ExtensionFlags (0x04000012) DOE_DELETE_PENDING, DOE_START_PENDING
Unknown flags 0x04000000
Device queue is not busy.
1: kd> !devstack 846653c8
!DevObj !DrvObj !DevExt ObjectName
> 846653c8 \Driver\Ftdisk 84665480

So it appears that an ftdisk DO is being that is being deleted while
still in use. I currently have an upperfilter to the disk class
driver installed. Is there a way to find out if my driver has
something to do with the above ASSERT? At the moment, I have already
recv’d REMOVE_DEVICE for all my DOs (above \device\disk) and they have
all been deleted. Can somebody help me with the relationship b/t the
two?

Thanks in advance,
Alex

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

Hi Maxim,

Thanks for your reply. However, I’m not sure I understand. I am
doing IoDetachDevice and IoDeleteDevice on my Device Object which is
an upper filter to the disk class driver during PnP REMOVE_DEVICE. I
am not explicitly deleting the disk Device Objects. Are you saying to
use IoInvalidateDeviceState instead in this situation? Maybe I’m
misunderstanding.

Regards,
Alex

On 8/15/05, Maxim S. Shatskih wrote:
> Can you avoid deleting the disk device objects? The only safe way you can
> do this is via PnP remove - i.e. IoInvalidateDeviceState.
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
> ----- Original Message -----
> From: “Alex”
> To: “Windows System Software Devs Interest List”
> Sent: Monday, August 15, 2005 9:49 PM
> Subject: [ntdev] Unreferenced device object to be deleted is still in use
>
>
> Hi All,
>
> I am hitting the following assertion after disabing FC ports to my
> external disks:
>
> Assertion failed: Unreferenced device object to be deleted is
> still in use((vpb->Flags & (VPB_MOUNTED | VPB_LOCKED)) == 0)
> Source File: d:\srvrtm\base\ntos\io\iomgr\objsup.c, line 872
>
> Break repeatedly, break Once, Ignore, terminate Process, or terminate
> Thread (boipt)? b
> b
> Execute ‘.cxr F78E6A3C’ to dump context
> Break instruction exception - code 80000003 (first chance)
> nt!DbgBreakPoint:
> 811507a8 cc int 3
> 1: kd> kb
> ChildEBP RetAddr Args to Child
> f78e6a24 811529f6 846653c8 84a4d750 846653b0 nt!DbgBreakPoint
> f78e6d0c 81308e28 81308d38 81308d10 00000368 nt!RtlAssert+0xba
> f78e6d2c 813904cf 846653c8 00000000 846653b0 nt!IopDeleteDevice+0x76
> f78e6d50 81146b12 846653c8 00000000 81146a70 nt!ObpRemoveObjectRoutine+0x263
> f78e6d70 f739137d 86bc4b40 8126d85c f78e6dac nt!ObfDereferenceObject+0xa2
> f78e6d80 81165bfa 84bccd68 00000000 86bc4b40
> volsnap!VspCleanupFilterWorker+0x51
> f78e6dac 813b5d7c 84bccd68 00000000 00000000 nt!ExpWorkerThread+0x12e
> f78e6ddc 81174ed6 81165acc 00000001 00000000 nt!PspSystemThreadStartup+0x2e
> 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
>
> 1: kd> !devobj 846653c8
> Device object (846653c8) is for:
> \Driver\Ftdisk DriverObject 86b48938
> Current Irp 00000000 RefCount 0 Type 00000007 Flags 00001050
> Dacl e18acf84 DevExt 84665480 DevObjExt 84665650
> ExtensionFlags (0x04000012) DOE_DELETE_PENDING, DOE_START_PENDING
> Unknown flags 0x04000000
> Device queue is not busy.
> 1: kd> !devstack 846653c8
> !DevObj !DrvObj !DevExt ObjectName
> > 846653c8 \Driver\Ftdisk 84665480
>
> So it appears that an ftdisk DO is being that is being deleted while
> still in use. I currently have an upperfilter to the disk class
> driver installed. Is there a way to find out if my driver has
> something to do with the above ASSERT? At the moment, I have already
> recv’d REMOVE_DEVICE for all my DOs (above \device\disk) and they have
> all been deleted. Can somebody help me with the relationship b/t the
> two?
>
> Thanks in advance,
> Alex
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
> —
> Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

5

Tony,

Thanks for your reply. I tried searching for the vpb, but could not
find it in the registers. I have reproduced this in two different
environments and the VPB seems to be null in both occasions. Is there
anything else I can do? Does it make sense to you that my disk class
filter can be causing this? I’m still not making the connection.

Regards,
Alex

On 8/15/05, Tony Mason wrote:
> Well, what you want to see is the VPB - but usually that is shown in the
> device object display (you can use “!vpb ” or “dt
> nt!_VPB ” to display it).
>
> But the VPB bits in question here are normally used by the file system;
> not sure if ftdisk tries to use them when constructing a volume from the
> underlying partition objects (having never looked). But I’ve looked at
> the VPB of volumes numerous times.
>
> If you use the .cxr command, you can probably find the VPB from one of
> the registers as well, since it was just tested…
>
> Regards,
>
> Tony
>
> Tony Mason
> Consulting Partner
> OSR Open Systems Resources, Inc.
> http://www.osr.com
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Alex
> Sent: Monday, August 15, 2005 1:50 PM
> To: ntdev redirect
> Subject: [ntdev] Unreferenced device object to be deleted is still in
> use
>
> Hi All,
>
> I am hitting the following assertion after disabing FC ports to my
> external disks:
>
> Assertion failed: Unreferenced device object to be deleted is
> still in use((vpb->Flags & (VPB_MOUNTED | VPB_LOCKED)) == 0)
> Source File: d:\srvrtm\base\ntos\io\iomgr\objsup.c, line 872
>
> Break repeatedly, break Once, Ignore, terminate Process, or terminate
> Thread (boipt)? b
> b
> Execute ‘.cxr F78E6A3C’ to dump context
> Break instruction exception - code 80000003 (first chance)
> nt!DbgBreakPoint:
> 811507a8 cc int 3
> 1: kd> kb
> ChildEBP RetAddr Args to Child
> f78e6a24 811529f6 846653c8 84a4d750 846653b0 nt!DbgBreakPoint
> f78e6d0c 81308e28 81308d38 81308d10 00000368 nt!RtlAssert+0xba
> f78e6d2c 813904cf 846653c8 00000000 846653b0 nt!IopDeleteDevice+0x76
> f78e6d50 81146b12 846653c8 00000000 81146a70
> nt!ObpRemoveObjectRoutine+0x263
> f78e6d70 f739137d 86bc4b40 8126d85c f78e6dac
> nt!ObfDereferenceObject+0xa2
> f78e6d80 81165bfa 84bccd68 00000000 86bc4b40
> volsnap!VspCleanupFilterWorker+0x51
> f78e6dac 813b5d7c 84bccd68 00000000 00000000 nt!ExpWorkerThread+0x12e
> f78e6ddc 81174ed6 81165acc 00000001 00000000
> nt!PspSystemThreadStartup+0x2e
> 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
>
> 1: kd> !devobj 846653c8
> Device object (846653c8) is for:
> \Driver\Ftdisk DriverObject 86b48938
> Current Irp 00000000 RefCount 0 Type 00000007 Flags 00001050
> Dacl e18acf84 DevExt 84665480 DevObjExt 84665650
> ExtensionFlags (0x04000012) DOE_DELETE_PENDING, DOE_START_PENDING
> Unknown flags 0x04000000
> Device queue is not busy.
> 1: kd> !devstack 846653c8
> !DevObj !DrvObj !DevExt ObjectName
> > 846653c8 \Driver\Ftdisk 84665480
>
> So it appears that an ftdisk DO is being that is being deleted while
> still in use. I currently have an upperfilter to the disk class
> driver installed. Is there a way to find out if my driver has
> something to do with the above ASSERT? At the moment, I have already
> recv’d REMOVE_DEVICE for all my DOs (above \device\disk) and they have
> all been deleted. Can somebody help me with the relationship b/t the
> two?
>
> Thanks in advance,
> Alex
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: unknown lmsubst tag argument:
> ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
> —
> Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>