is this a bug in netio.sys in windows 10 build 14942?---update:wdk sample "inspect" ran into the same issue RRS feed

  • General discussion

  • recently we received a feedback that WINDOWS 10 cant login after installing our product which using some wfp tech..(symth:the loginui never show the login user name and password window)

    after doing some research.there is a lpc handler thread blocked in svchost ,its stack shows below:

    Call Stack : 13 frames
    ## Stack-Pointer    Return-Address   Call-Site      
    00 ffff8f80a8d272f0 fffff8001662cde2 nt!KiSwapContext+76
    01 ffff8f80a8d27430 fffff8001662c72b nt!KiSwapThread+512
    02 ffff8f80a8d274e0 fffff8001662c058 nt!KiCommitThreadWait+3cb
    03 ffff8f80a8d27570 fffff8055b46856a nt!KeWaitForSingleObject+378
    04 ffff8f80a8d27620 fffff8055b44cfc3 NETIO!KfdNotifyRscIncompatCalloutAdd+a2
    05 ffff8f80a8d27680 fffff8055b42752c NETIO!FeNotifyFilter+26753 (perf)
    06 ffff8f80a8d276d0 fffff8055ba07a29 NETIO!IoctlKfdBatchUpdate+14c
    07 ffff8f80a8d277c0 fffff80016a1828f tcpip!KfdDispatchDevCtl+e9
    08 ffff8f80a8d27820 fffff80016a17b54 nt!IopSynchronousServiceTail+16f (perf)
    09 ffff8f80a8d278e0 fffff80016a17376 nt!IopXxxControlFile+7d4
    0a ffff8f80a8d27a20 fffff80016778093 nt!NtDeviceIoControlFile+56
    0b ffff8f80a8d27a90 00007ffeac1e6494 nt!KiSystemServiceCopyEnd+13

    it's waiting a event from netio!global which is initialized not-signaled.

    when KfdNotifyRscIncompatCalloutAdd is called ,it will wait for this event.(from i know calling KfdNotifyRscIncompatCalloutDel will do the same thing),and thenn clear event.

    everything looks fine.but at the first time this event is waited ,who is going to make this event signaled? i notice there is a function nameKfdRscDisableStatusIndicate will set this event.

    let's get back our problem. since the stack shows we are blocked by this event,so it seems there is a bug when KfdNotifyRscIncompatCalloutAdd was called but KfdRscDisableStatusIndicate this function never gets a chance.

    ps:we can't re-pro this problem.after some investigation, it shows KeWaitForSingleObject or KfdRscDisableStatusIndicate never get called in KfdNotifyRscIncompatCalloutAdd

    looking forward response...


    ===============update 10.17

    we found that the system will hang event install the inspect from wdk sample by cmd "sc create xxx; sc start xxx"

    Saturday, October 15, 2016 3:03 AM

All replies