Driver Problems? Questions? Issues?
Put OSR's experience to work for you! Contact us for assistance with:
  • Creating the right design for your requirements
  • Reviewing your existing driver code
  • Analyzing driver reliability/performance issues
  • Custom training mixed with consulting and focused directly on your specific areas of interest/concern.
Check us out. OSR, the Windows driver experts.

Monthly Seminars at OSR Headquarters

East Coast USA
Windows Internals and SW Drivers, Dulles (Sterling) VA, 9 April 2018

Writing WDF Drivers I: Core Concepts, Manchester, NH, 7 May 2018

Kernel Debugging & Crash Analysis for Windows, Manchester, NH, 21 May 2018


Go Back   OSR Online Lists > ntfsd
Welcome, Guest
You must login to post to this list
  Message 1 of 6  
27 Mar 18 17:13
Mauro Leggieri
xxxxxx@mauroleggieri.com
Join Date: 02 Jun 2016
Posts To This List: 37
Where did my IRP go?

Hi!!! Short story... trying to look for an IRP by following the steps listed here https://blogs.msdn.microsoft.com/ntdebugging/2011/11/23/where-did-my-disk-io-go/ without luck. The IRP is not in the outgoing packets and the original IRP is not completed. Long: My driver makes a call to FltCreateFileEx (targetting a VHD volume) and stops in the call to NtfsAcquireExclusiveFcb owned by another thread which called NtFlushBuffersFileEx which ends in a call to DiskFlushDispatch/ClassSendSrbSynchronous that could track until VHDMP.SYS ... don't know what this driver internally do/did to the request. (checked all threads involving storport/vhdmp/disk/classpnp) On the other hand I have several threads locked in NtfsCheckpointVolume and a worker thread that called NtfsCheckpointAllVolumes stopped in ClassShutdownFlush/DiskShutdownFlush. No locks being held except the one for Fcb access. Any hint on where I can continue my research will be appreciated. Kind regards, Mauro.
  Message 2 of 6  
27 Mar 18 21:57
Scott Noone
xxxxxx@osr.com
Join Date: 10 Jul 2002
Posts To This List: 982
List Moderator
Where did my IRP go?

Can you make the dump available? Not saying I can find it, but faster than trying to debug over HTTP. -scott OSR @OSRDrivers Next Seminar: Windows Internals and Software Driver Development 9-13 April 2018, Sterling, VA https://www.osr.com/seminars/software-drivers/
  Message 3 of 6  
28 Mar 18 12:04
Mauro Leggieri
xxxxxx@mauroleggieri.com
Join Date: 02 Jun 2016
Posts To This List: 37
Where did my IRP go?

Hi Scott, thank you for the offer. Because company rules, I can send you the link privately, might be thru OSR's Facebook account or linkedin. Kind regards, Mauro.
  Message 4 of 6  
28 Mar 18 13:01
Mauro Leggieri
xxxxxx@mauroleggieri.com
Join Date: 02 Jun 2016
Posts To This List: 37
Where did my IRP go?

(NOTE: We can make public information that might help other community users)
  Message 5 of 6  
11 Apr 18 20:51
Mauro Leggieri
xxxxxx@mauroleggieri.com
Join Date: 02 Jun 2016
Posts To This List: 37
Where did my IRP go?

I revive this thread because, with the great help of Scott Noone, we could find what was going on. The problem was a bug in my redirector driver. OneDrive's cloud minifilter, opens a stream on a folder, first opening the folder and using the handle as the OBJECT_ATTRIBUTES.RootDirectory when opens the stream. My driver was not handling this scenario properly and the wrong RelatedFileObject (the upper FO instead of the shadow one) was being sent to NTFS.SYS BUT, the interesting part Scott could notice, was the volume's VCB reference count dropping below zero and no bugcheck raising!! The only visible effect was the OS entering in some class of never-ending loop and preventing other threads to continue. So, don't assume a crash or deadlock will appear if your driver has a bug, other weird things can happen. Kind regards, Mauro.
  Message 6 of 6  
13 Apr 18 19:45
Scott Noone
xxxxxx@osr.com
Join Date: 10 Jul 2002
Posts To This List: 982
List Moderator
Where did my IRP go?

Glad to be of help! I have a work item to write up some of the stuff that we saw in order to help other folks track down these types of problems in the future. I will post this in the next week or two. However, in the end I just found a few things an Mauro did all the hard work to track down the issue (the man knows his way around the debugger :)). -scott OSR @OSRDrivers
Posting Rules  
You may not post new threads
You may not post replies
You may not post attachments
You must login to OSR Online AND be a member of the ntfsd list to be able to post.

All times are GMT -5. The time now is 08:31.


Copyright ©2015, OSR Open Systems Resources, Inc.
Based on vBulletin Copyright ©2000 - 2005, Jelsoft Enterprises Ltd.
Modified under license