Re: 请问张老师，minifilter内核锁死问题

Windows内核调试

请问张老师，minifilter内核锁死问题

dion.zhao 2013-03-25, 11:19 上午
张老师，您好！

最近在做一个minifiter,偶尔会发生死锁。主要功能是拦截阻塞文件的读请求，在用户态将要读取数据块下载完成后写回文件，之后恢复该读请求。

minifilter中会：

1、在pre-operation中判断是fastio直接返回FLT_PREOP_DISALLOW_FASTIO

2、拦截page read

下面是发生死锁的时候windbg的调试信息。

0: kd> !locks

**** DUMP OF ALL RESOURCE OBJECTS ****

KD: Scanning for held locks...........

Resource @ 0x85cca574 Shared 2 owning threads

Contention Count = 1

Threads: 84ec6a60-01<*> 86b1cc10-01<*>

KD: Scanning for held locks..............................................................................................................................................................................

Resource @ 0x84ec5e04 Shared 1 owning threads

Contention Count = 3

NumberOfSharedWaiters = 1

NumberOfExclusiveWaiters = 2

Threads: 84e47830-01<*> 84cd7a70-01

Threads Waiting On Exclusive Access:

86b1cc10 84ec6a60

0: kd> !thread 84e47830

THREAD 84e47830 Cid 0e08.0e0c Teb: 7ffdf000 Win32Thread: ffa01978 WAIT: (Executive) KernelMode Alertable

SuspendCount 2

FreezeCount 2

84ebd538 NotificationEvent

9a51b4a4 NotificationEvent

IRP List:

84dfe9e0: (0006,01d8) Flags: 00060403 Mdl: 85aa9de0

84f42e28: (0006,01d8) Flags: 00060900 Mdl: 00000000

Not impersonating

DeviceMap 95c16350

Owning Process 84ede128 Image: xxxxx.exe

Attached Process N/A Image: N/A

Wait Start TickCount 7948 Ticks: 64120 (0:00:16:40.278)

Context Switch Count 6596

UserTime 00:00:01.294

KernelTime 00:00:01.185

Win32 Start Address 0x00a334b0

Stack Init 9a51bfd0 Current 9a51b228 Base 9a51c000 Limit 9a519000 Call 0

Priority 14 BasePriority 8 UnusualBoost 4 ForegroundBoost 2 IoPriority 2 PagePriority 5

ChildEBP RetAddr Args to Child

9a51b240 82eb8ed5 84e47830 00000000 807c4120 nt!KiSwapContext+0x26 (FPO: [Uses EBP] [0,0,4])

9a51b278 82eb77d3 9a51b4a4 84e47830 84e4792c nt!KiSwapThread+0x266

9a51b2a0 82eb3aaf 84e47830 84e478f0 00000000 nt!KiCommitThreadWait+0x1df

9a51b418 8305f87c 00000002 9a51b4d4 00000001 nt!KeWaitForMultipleObjects+0x535

9a51b464 88993000 00000002 9a51b4d4 00000001 nt!FsRtlCancellableWaitForMultipleObjects+0x8c

9a51b524 966016c5 00000000 84ebd4bc 84d9cdb8 fltmgr!FltSendMessage+0x3e0 (FPO: [Non-Fpo])

WARNING: Stack unwind information not available. Following frames may be wrong.

9a51b830 8898daeb 84fe1a70 9a51b850 9a51b87c xxxxx+0x16c5

9a51b89c 889909f0 9a51b8f0 84dfe9e0 00000000 fltmgr!FltpPerformPreCallbacks+0x34d (FPO: [Non-Fpo])

9a51b8b4 88990f01 9a51b8f0 00000000 85cbb6d8 fltmgr!FltpPassThroughInternal+0x40 (FPO: [Non-Fpo])

9a51b8d8 889913ba 0351b800 85cbb6d8 85aa9de0 fltmgr!FltpPassThrough+0x203 (FPO: [Non-Fpo])

9a51b908 82e8679c 85cbb6d8 84dfe9e0 84dfe9e0 fltmgr!FltpDispatch+0xb4 (FPO: [Non-Fpo])

9a51b920 82ef1b60 85aa9de1 85aa9d68 84fc738a nt!IofCallDriver+0x63

9a51b93c 8305c4aa 84fc7388 84e47830 85aa9da0 nt!IoPageRead+0x1f5

9a51b970 8305da5e 84f13418 00000001 a0f7e000 nt!MiPfExecuteReadList+0x10c

9a51b99c 82f01ae7 0053e000 00000000 00002000 nt!MmPrefetchForCacheManager+0xa4

9a51b9dc 830a934a 84fdf908 00000001 9a51ba54 nt!CcFetchDataForRead+0x94

9a51ba1c 830aafb1 84fdf908 0053e386 00000000 nt!CcMapAndCopyFromCache+0x71

9a51ba58 88c44d13 84fdf908 9a51ba9c 00001000 nt!CcCopyRead+0x107

9a51ba84 88c425c4 84fa5af8 84fdf908 84f42e28 Ntfs!NtfsCachedRead+0x13e (FPO: [Non-Fpo])

9a51bb60 88c45c36 84fa5af8 84f42e28 12970164 Ntfs!NtfsCommonRead+0x11a1 (FPO: [Non-Fpo])

9a51bbd0 82e8679c 85cca020 84f42e28 84f42e28 Ntfs!NtfsFsdRead+0x279 (FPO: [Non-Fpo])

9a51bbe8 8899120c 85cbb6d8 84f42e28 00000000 nt!IofCallDriver+0x63

9a51bc0c 889913cb 9a51bc2c 85cbb6d8 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2aa (FPO: [Non-Fpo])

9a51bc44 82e8679c 85cbb6d8 84f42e28 84f42e28 fltmgr!FltpDispatch+0xc5 (FPO: [Non-Fpo])

9a51bc5c 830894ce 84f42e28 84f42fdc 84fdf908 nt!IofCallDriver+0x63

9a51bc7c 8309ae26 85cbb6d8 84fdf908 00000001 nt!IopSynchronousServiceTail+0x1f8

9a51bd08 82e8d78a 85cbb6d8 84f42e28 00000000 nt!NtReadFile+0x644

9a51bd08 77686194 85cbb6d8 84f42e28 00000000 nt!KiFastCallEntry+0x12a (FPO: [0,3] TrapFrame @ 9a51bd34)

0012e450 00000000 00000000 00000000 00000000 0x77686194

0: kd> !thread 84ec6a60

THREAD 84ec6a60 Cid 0a30.0ba8 Teb: 7ffd8000 Win32Thread: fe9fcae8 WAIT: (WrResource) KernelMode Non-Alertable

86debf60 SynchronizationEvent

IRP List:

84fd1740: (0006,01d8) Flags: 00060000 Mdl: 00000000

Not impersonating

DeviceMap 95c16350

Owning Process 84d7a5f0 Image: xxxxxx.exe

Attached Process N/A Image: N/A

Wait Start TickCount 71883 Ticks: 185 (0:00:00:02.886)

Context Switch Count 6445

UserTime 00:00:00.202

KernelTime 00:00:00.124

Win32 Start Address 0x6de19f90

Stack Init 9a4f7fd0 Current 9a4f7948 Base 9a4f8000 Limit 9a4f5000 Call 0

Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5

ChildEBP RetAddr Args to Child

9a4f7960 82eb8ed5 84ec6a60 00000000 82f74d20 nt!KiSwapContext+0x26 (FPO: [Uses EBP] [0,0,4])

9a4f7998 82eb77d3 84ec6b20 84ec6a60 86debf60 nt!KiSwapThread+0x266

9a4f79c0 82eb168f 84ec6a60 84ec6b20 000000cc nt!KiCommitThreadWait+0x1df

9a4f7a3c 82ee94f5 86debf60 0000001b 00000000 nt!KeWaitForSingleObject+0x393

9a4f7a94 82eb4a6e 86debf60 9e522890 84fa58a8 nt!ExpWaitForResource+0x16f

9a4f7ae0 88c3e997 84ec5e04 00000001 9a4f7b34 nt!ExAcquireResourceExclusiveLite+0x1cf

9a4f7af0 88cadb45 84fa58a8 9e522890 00000001 Ntfs!NtfsAcquirePagingResourceExclusive+0x2c (FPO: [Non-Fpo])

9a4f7b34 88cad115 84fa58a8 9e522890 1289c110 Ntfs!NtfsPerformOptimisticFlush+0x2a (FPO: [Non-Fpo])

9a4f7ba4 88cad83a 84fa58a8 84fd1740 1289c6b8 Ntfs!NtfsCommonFlushBuffers+0x244 (FPO: [Non-Fpo])

9a4f7c0c 82e8679c 85cca020 84fd1740 84fd1740 Ntfs!NtfsFsdFlushBuffers+0xf7 (FPO: [Non-Fpo])

9a4f7c24 8899120c 85cbb6d8 84fd1740 00000000 nt!IofCallDriver+0x63

9a4f7c48 889913cb 9a4f7c68 85cbb6d8 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2aa (FPO: [Non-Fpo])

9a4f7c80 82e8679c 85cbb6d8 84fd1740 84fd1740 fltmgr!FltpDispatch+0xc5 (FPO: [Non-Fpo])

9a4f7c98 830894ce 84fd1740 84ec5f80 00000000 nt!IofCallDriver+0x63

9a4f7cb8 8306a282 85cbb6d8 84ec5f80 00000000 nt!IopSynchronousServiceTail+0x1f8

9a4f7d24 82e8d78a 00000000 041defc8 041defd0 nt!NtFlushBuffersFile+0x1d7

9a4f7d24 77686194 00000000 041defc8 041defd0 nt!KiFastCallEntry+0x12a (FPO: [0,3] TrapFrame @ 9a4f7d34)

WARNING: Frame IP not in any known module. Following frames may be wrong.

041defd0 00000000 00000000 00000000 00000000 0x77686194

0: kd> !irp 84dfe9e0

Irp is active with 10 stacks 10 is current (= 0x84dfeb94)

Mdl=85aa9de0: No System Buffer: Thread 84e47830: Irp stack trace.

cmd flg cl Device File Completion-Context

[ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000

[ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000

[ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000

[ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000

[ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000

[ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000

[ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000

[ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000

[ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000

>[ 3, 0] 0 1 85cbb6d8 84fc7388 00000000-00000000 pending

\FileSystem\FltMgr

Args: 00002000 00000000 0053e000 00000000

0: kd> !irp 84f42e28

Irp is active with 10 stacks 9 is current (= 0x84f42fb8)

No Mdl: No System Buffer: Thread 84e47830: Irp stack trace.

cmd flg cl Device File Completion-Context

[ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000

[ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000

[ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000

[ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000

[ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000

[ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000

[ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000

[ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000

>[ 3, 0] 0 e0 85cca020 84fdf908 88990aae-84fc7008 Success Error Cancel

\FileSystem\Ntfs fltmgr!FltpPassThroughCompletion

Args: 00001000 00000000 0053e386 00000000

[ 3, 0] 0 1 85cbb6d8 84fdf908 00000000-00000000 pending

\FileSystem\FltMgr

Args: 00001000 00000000 0053e386 00000000

目前的疑惑有

1、为什么蓝色代码部分没有进入我的minifilter，而是往下走到page io才进入minifilter，是fastio的原因吗

2、如果是fastio的原因，那我理解的在pre-operation中返回FLT_PREOP_DISALLOW_FASTIO是让irp重发重新进入我的minifilter，这个理解是错误的吗。

3、死锁的原因是因为read irp进入cc后加锁，写回的irp也要加锁同样的resource导致的吗

Re: 请问张老师，minifilter内核锁死问题

格蠹老雷 2013-04-05, 16:05 下午

1，也可能是调用你的filter，filter返回后，继续向下传

2，没有错

3，没有错，84ec6a60要获取Paging resource，但已经被线程84e47830获取了。后者在用FltSendMessage与用户态通信，但用户态的线程可能就是触发了文件访问而被阻塞住的84ec6a60或者86b1cc10...