Hi guys,
I have FS filter driver BSOD on Windows 10.
Few words about environment: all I know about the scenario and environment that leads to the crash is almost nothing. The customer gets BSOD on Windows 10x64 (don’t know about Win7). BSOD occurs randomly (as per the customer). Also, as I found from !analyze -v:
SYSTEM_MANUFACTURER: VMware, Inc.
VIRTUAL_MACHINE: VMware
SYSTEM_PRODUCT_NAME: VMware7,1
SYSTEM_VERSION: None
BIOS_VENDOR: VMware, Inc.
BIOS_VERSION: VMW71.00V.0.B64.1507021939
That makes me think, that OS is run on virtual machine.
I analyzed memory dump in WinDbg and looks like I found a place where driver is crashed.
Here is call stack:
nt!KiPageFault+0x221
MYDRV!IsShadow+0xcd
MYDRV!ControlMount+0x38
MYDRV!Control+0x77
nt!IopMountVolume+0x2e5
nt!IopCheckVpbMounted+0x10a
nt!IopParseDevice+0xbc7
nt!ObpLookupObjectName+0x8b2
nt!ObOpenObjectByNameEx+0x1dd
nt!IopCreateFile+0x3d9
nt!NtOpenFile+0x58
nt!KiSystemServiceCopyEnd+0x13
0x00007ffc`5e2f6734
What is happened in MYDRV!Control:
PIO_STACK_LOCATION irps = IoGetCurrentIrpStackLocation( Irp ); // Irp is IN parameter of the function
switch (irps->MinorFunction) {
case IRP_MN_MOUNT_VOLUME:
return ControlMount( DeviceObject, Irp );
So here we see, that ControlMount is called. Lets look inside:
PIO_STACK_LOCATION irps = IoGetCurrentIrpStackLocation( Irp );
PDEVICE_OBJECT storageStackDeviceObject;
BOOLEAN isShadowCopy;
storageStackDeviceObject = irps->Parameters.MountVolume.Vpb->RealDevice;
status = IsShadow( storageStackDeviceObject, &isShadowCopy);
He we call IsShadow and pass there storageStackDeviceObject. Inside of IsShadow after some code (that doesn’t change storageStackDeviceObject):
if (FILE_DEVICE_VIRTUAL_DISK != StorageStackDeviceObject->DeviceType)
And here is the place where crash is happened.
Looking what is inside of MountVolume.Vpd->RealDevice I see:
+0x000 MountVolume :
+0x000 Vpb : 0xffffa5895eb42a90 _VPB<br> +0x000 Type : 0n0<br> +0x002 Size : 0n0<br> +0x004 Flags : 0<br> +0x006 VolumeLabelLength : 0<br> +0x008 DeviceObject : (null) <br> +0x010 RealDevice : 0x0000000000008000 _DEVICE_OBJECT
+0x018 SerialNumber : 1
+0x01c ReferenceCount : 0xffffffff
+0x020 VolumeLabel : [32] “”
RealDevice has invalid address…moreover Vpb seems to be corrupted or invalid.
From what I found on MSDN (https://msdn.microsoft.com/en-us/library/windows/hardware/ff548670(v=vs.85).aspx):
IrpSp->Parameters.MountVolume.Vpb
Pointer to the volume parameter block (VPB) for the volume to be mounted. File systems that support removable media might substitute a previously used VPB for the one passed in this parameter. On such file systems, after the volume is mounted, this pointer can no longer be assumed to be valid. File system filter drivers that filter these file systems should use this parameter as follows: Before sending the IRP down to lower-level drivers, the filter should save the value of IrpSp->Parameters.MountVolume.Vpb->RealDevice. After the volume is successfully mounted, the filter can use this pointer to the storage device object to obtain the correct VPB pointer.
So my questions are:
1) Might it be the reason (as said in MSDN)? However, it seems to me that MYDRV doesn’t send this IRP to lower-lever driver before it handles the IRP.
2) If the reason is in that, why don’t we see the issue on Windows7 (I don’t sure if we really do not see it).
3) What other possible reasons of such behavior?
Thanks.