how to detect oplocks

NTFSD
1

Hi,

I have a problem with a mini filter driver I am writing and I suspect that it is related to an oplock on a file, but I am not sure. The symptom is deadlock - in my post-op create callback I am trying to read the file but that read is waiting on some synchronization event. The read is done while holding my main resource for the stream context. While the read is blocked I get a pre-op cleanup request for the same file (\System Volume Information\tracking.log. The deadlock only happens with this file) and I try to acquire the stream context resource only to deadlock.

I am not sure what FltReadFile is waiting for. I thought that it might be breaking an oplock. The cleanup thread has a kernel APC queued to it and I thought that that may be an oplock break IRP completion APC. Maybe, the application is trying to close the handle to the file before acknowledging the oplock break which causes this deadlock?

Attempting to test this “theory” I looked at how to use the few oplock routines the filter manager exposes. How would you check if a file has an oplock on it? I came up with something that looks like this (assume that this is an IRP operation):

OLOCK oplock = NULL;
FltInitializeOplock(&oplock);

FltCheckOplockEx(&oplock, callbackData, OPLOCK_FLAG_OPLOCK_KEY_CHECK_ONLY, NULL, NULL, NULL);

if (FltCurrentOplock(&oplock)) {
print something;
do something;
}

FltUninitializeOplock(&oplock);

Should this work? I based this on the fastfat example for win 7 in which fastfat checks in similar fashing if a batch oplock exists on a file. FltCurrentOplock returns false for tracking.log. Any ideas what FltReadFile is blocked on?

Thanks,
G.

2

Hi.

Since you are in post create, why don’t you check if Data->IoStatus.Status
has value STATUS_OPLOCK_BREAK_IN_PROGRESS (which is a success code). In this
case you shouldn’t read the file.

http://www.osronline.com/article.cfm?article=17#Q33

wrote news:xxxxx@ntfsd…
> Hi,
>in my post-op create callback I am trying to read the file but that read is
>waiting on some synchronization event

3

Could you perhaps post a stack trace of the thread doing the read ?

The FltCheckOplockEx & friends apis are only meant to be used by filters
that wish to implement oplocks at their level. This is a wrapper over
FsRtlCheckOplockEx, which requires an IRP parameter, which means it would be
impossible to use in a minifilter. So that’s why it has a Flt equivalent.
However, it’s probably not useful for what you’re trying to do.

Also, there is a rule for minifilters about holding locks while issuing IO
to the file system (the rule is “DON’T” :)), and the reason for that rule is
what you’re experiencing right now. This has issues even when oplocks are
not involved (for example, what if you serialize access to the file at your
level and then the Read you’re issuing requires a coherency flush ?).

What does your filter do ? Why do you need a stream context lock ?

Thanks,
Alex.

4

Thanks Frank and Alex for your replies.

Checking the STATUS_OPLOCK_BREAK_IN_PROGRESS did the trick. The create post-op is indeed received while an oplock break is in progress and waiting to the oplock break notification without holding the lock solved the problem.

Thanks,
G.