Minifilter instance setup callback is calling at DPC level?!

NTFSD
1

I have very strange, as for me, fail, for some reason instance setup callback i called at DPC level. As I know it should be always at passive level msdn: http://msdn.microsoft.com/en-us/library/windows/hardware/ff551096(v=vs.85).aspx.

Here the !analyze -v output:

AGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff7ffba9cab56, memory referenced.
Arg2: 0000000000000008, value 0 = read operation, 1 = write operation.
Arg3: fffff7ffba9cab56, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)

Debugging Details:

READ_ADDRESS: fffff7ffba9cab56

FAULTING_IP:
+af97a71fa108
fffff7ff`ba9cab56 ?? ???

MM_INTERNAL_CODE: 2

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

BUGCHECK_STR: AV

PROCESS_NAME: System

CURRENT_IRQL: 2

ANALYSIS_VERSION: 6.3.9600.17029 (debuggers(dbg).140219-1702) amd64fre

TRAP_FRAME: ffffd00023221230 – (.trap 0xffffd00023221230)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000016 rbx=0000000000000000 rcx=ffffd000232214d0
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff7ffba9cab56 rsp=ffffd000232213c8 rbp=ffffd00023221600
r8=0000000000000014 r9=000000000000000d r10=ffffcf8000ed6ca0
r11=ffffe00002f52fc8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
fffff7ff`ba9cab56 ?? ???
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff802399f27c6 to fffff8023996fc90

FAILED_INSTRUCTION_ADDRESS:
+af97a71fa108
fffff7ff`ba9cab56 ?? ???

STACK_TEXT:
ffffd0002321fe48 fffff802399f27c6 : fffff6fb7dbf0040 fffff6fb7dbedf80 0000000000000000 fffff802399f313a : nt!DbgBreakPointWithStatus
ffffd0002321fe50 fffff802399f2499 : fffff80200000004 fffff80239ae8180 000000000000000a 0000000000000002 : nt!KiBugCheckDebugBreak+0x12
ffffd0002321feb0 fffff802399691a4 : 0000070000000000 0000000000000000 ffffcf8000fe0000 fffff802398e5f1f : nt!KeBugCheck2+0xc6d
ffffd000232205c0 fffff80239974be9 : 000000000000000a fffff6fb7dffeea0 0000000000000002 0000000000000000 : nt!KeBugCheckEx+0x104
ffffd00023220600 fffff8023997343a : 0000000000000000 0000070000000000 0000000000000000 ffffd00023220740 : nt!KiBugCheckDispatch+0x69
ffffd00023220740 fffff802398cbae4 : 0000000000000060 0000000000000008 ffffd00023221230 0000000000000000 : nt!KiPageFault+0x23a
ffffd000232208d0 fffff802399f1d04 : 0000070000000000 ffffd00023220a00 fffff7ffba9cab56 0000007fffffffff : nt!MmIsSpecialPoolAddress+0x54
ffffd00023220900 fffff802399691a4 : 0000000000000000 fffff80239b0a180 00000000000c3500 fffff802399f4e60 : nt!KeBugCheck2+0x4d8
ffffd00023221010 fffff80239982615 : 0000000000000050 fffff7ffba9cab56 0000000000000008 ffffd00023221230 : nt!KeBugCheckEx+0x104
ffffd00023221050 fffff80239881ffd : 0000000000000008 ffffe00002f52880 ffffd00023221230 ffff3067967c4ed8 : nt! ?? ::FNODOBFM::string'+0x9085 ffffd000232210f0 fffff8023997332f : 0000000000000008 000000000000000d fffff80239b08300 ffffd00023221230 : nt!MmAccessFault+0x7ed ffffd00023221230 fffff7ffba9cab56 : fffff80002448712 ffffd0002321c000 fffff80239a432a8 ffffcf8000ed6cf8 : nt!KiPageFault+0x12f ffffd000232213c8 fffff80002448712 : ffffd0002321c000 fffff80239a432a8 ffffcf8000ed6cf8 fffff802398e5f1f : 0xfffff7ffba9cab56
ffffd000232213d0 fffff800009afa83 : ffffd000232214d0 fffff80000000001 ffffd00000000014 ffffd0000000000d : MyFilter!MyFilterInstanceSetup+0x22 [l:\gitrepos2\drivers - copy\MyFilter\MyFilter\MyFilter.c @ 262]
ffffd00023221450 fffff80000995a27 : 0000000000000001 ffffd00023221631 0000000000000000 ffffcf8000cd6cf0 : fltmgr!FltvInstanceSetup+0x4f
ffffd000232214b0 fffff80000997f4f : ffffcf8000cd6cf0 ffffcf80000d4800 ffffcf80000d4802 ffffd000232215e0 : fltmgr!FltpDoInstanceSetupNotification+0x87
ffffd00023221510 fffff80000996af5 : 0000000000000000 ffffd000232216d8 ffffd00000000001 0000000000000004 : fltmgr!FltpInitInstance+0x2db
ffffd000232215a0 fffff800009982e5 : 0000000000000000 ffffcf80000d4800 0000000000000050 fffff8000000001a : fltmgr!FltpCreateInstanceFromName+0x1ad
ffffd00023221680 fffff8000099b9f1 : ffffcf8000060948 ffffe00003957000 ffffcf8000ed6c02 ffffd00000000028 : fltmgr!FltpEnumerateRegistryInstances+0x145
ffffd00023221720 fffff8000099b90c : ffffcf8000060880 0000000000000000 ffffe00003957000 ffffffff80000e88 : fltmgr!FltpDoVolumeNotificationForNewFilter+0xb9
ffffd00023221780 fffff8000244c3d6 : ffffcf8000ed6ca0 ffffe000028cad00 ffffe00003957000 ffffe00003957000 : fltmgr!FltStartFiltering+0x2c
ffffd000232217b0 fffff80239c5901e : ffffe000028cad00 ffffe00003957000 ffffe00003957000 ffffffff000001c8 : MyFilter!DriverEntry+0x256 [l:\gitrepos2\drivers - copy\MyFilter\MyFilter\MyFilter.c @ 150]
ffffd00023221850 fffff80239cd6292 : 0000000000000000 0000000000000000 fffff80239abb1c0 ffffe00002f52880 : nt!IopLoadDriver+0x5e2
ffffd00023221b10 fffff802398553cd : fffff80200000000 ffffffff80000e88 fffff80239cd6244 fffff80239aef9a0 : nt!IopLoadUnloadDriver+0x4e
ffffd00023221b50 fffff80239900664 : 00001ffffdd58fd8 ffffe00002f52880 ffffe00002f52880 ffffe000000d8580 : nt!ExpWorkerThread+0x2b5
ffffd00023221c00 fffff8023996f6c6 : fffff80239b0a180 ffffe00002f52880 ffffe000001a9580 ffcb8b4801000003 : nt!PspSystemThreadStartup+0x58
ffffd00023221c60 0000000000000000 : ffffd00023222000 ffffd0002321c000 0000000000000000 0000000000000000 : nt!KiStartSystemThread+0x16

STACK_COMMAND: kb

FOLLOWUP_IP:
MyFilter!MyFilterInstanceSetup+22 [l:\gitrepos2\drivers - copy\MyFilter\MyFilter\MyFilter.c @ 262]
fffff800`02448712 1800 sbb byte ptr [rax],al

FAULTING_SOURCE_LINE: l:\gitrepos2\drivers - copy\MyFilter\MyFilter\MyFilter.c

FAULTING_SOURCE_FILE: l:\gitrepos2\drivers - copy\MyFilter\MyFilter\MyFilter.c

FAULTING_SOURCE_LINE_NUMBER: 262

FAULTING_SOURCE_CODE:
258:
259: –*/
260: {
261: PFLT_VOLUME SystemVolume;

262: const UNICODE_STRING SystemRoot = RTL_CONSTANT_STRING(L"\SystemRoot");
263: NTSTATUS status = STATUS_FLT_DO_NOT_ATTACH;
264: PDEVICE_OBJECT diskDeviceObject = NULL;
265: BOOLEAN IsWriteable = FALSE;
266:

SYMBOL_STACK_INDEX: d

SYMBOL_NAME: MyFilter!MyFilterInstanceSetup+22

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: MyFilter

IMAGE_NAME: MyFilter.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 546e0bcc

IMAGE_VERSION: 6.3.9600.17038

BUCKET_ID_FUNC_OFFSET: 22

FAILURE_BUCKET_ID: AV_VRF_BAD_IP_MyFilter!MyFilterInstanceSetup

BUCKET_ID: AV_VRF_BAD_IP_MyFilter!MyFilterInstanceSetup

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:av_vrf_bad_ip_MyFilter!MyFilterinstancesetup

FAILURE_ID_HASH: {c4458935-a4b4-30d4-095a-349491d5209e}

Followup: MachineOwner.

Can this be because driver verifier bug? I enabled it both for my minifilter and fltmgr.

2

Instance setup callback is always called at passive level. It looks like you
called/returned to invalid fffff7ff`ba9cab56 address. Can you please set
breakpoint to your “MyFilterInstanceSetup” function and debug it manually?
It also looks like MyFilterInstanceSetup+22 instruction is invalid (or it’s
incorrect address offset):

MyFilter!MyFilterInstanceSetup+22 [l:\gitrepos2\drivers -
copy\MyFilter\MyFilter\MyFilter.c @ 262]
fffff800`02448712 1800 sbb byte ptr [rax],al

3

That was only one time… so can’t debug manualy. ??? all work… strange

4

Single-time irreproducible bugs can be due to CPU fan issues, for instance :slight_smile:

<u_pashi> wrote in message news:xxxxx@ntfsd…
> That was only one time… so can’t debug manualy. ??? all work… strange
></u_pashi>

5

> Arg1: fffff7ffba9cab56, memory referenced.

Arg2: 0000000000000008, value 0 = read operation, 1 = write operation.

And 8 is execute I think?

Arg3: fffff7ffba9cab56, If non-zero, the instruction address which referenced the bad memory
address.

Same as Arg1. Execute.

Find the frame for KiPageFault below, set it as a current one using “.cxr”, and print it using “kb” and “r”.

–
Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com