Corinna Vinschen <corinna-cygwin <at> cygwin.com> writes:
> > Basically, the NtOpenFile took over execution (I'm guessing that it
triggered a
> > fault handler, which interfered with single stepping?). My next attempt:
>
> Hmm.
>
> STATUS_ACCESS_DENIED. But why?
>
>
> Not exactly. If I had MVFS here, I'd try various changes to the
> arguments to NtOpenFile which make sort of sense.
>
> For instance, maybe it chokes on the sharing flags. I'd try with
> FILE_SHARE_VALID_FLAGS instead of just FILE_SHARE_DELETE.
>
> Btw., it's very helpful to observe what happens exactly using
> sysinternal's procmon.
What would you like to see? Here's a few procman entries captured immediately
before the breakpoint, and then for the failing NtOpenFile [*]:
7:39:53.9261746 AM rm.exe 5912 QueryAttributeInformationVolume
M:\u_fabt_eblake\FABT_Development\FABT_MPG_Process_BSP_SPCI\foo SUCCESS
FileSystemAttributes: Case Preserved, Case Sensitive,
MaximumComponentNameLength: 255, FileSystemName: MVFS
7:39:53.9262013 AM rm.exe 5912 QueryAllInformationFile
G:\views\fabt_eblake.vws\.s\00049\800039b14a4a8b07foo BUFFER OVERFLOW
CreationTime: 7/15/2009 3:42:16 PM, LastAccessTime: 7/15/2009 3:42:16
PM, LastWriteTime: 7/15/2009 3:42:16 PM, ChangeTime: 7/15/2009 3:42:16 PM,
FileAttributes: RA, AllocationSize: 0, EndOfFile: 0, NumberOfLinks: 1,
DeletePending: False, Directory: False, IndexNumber: 0x47283402d42464, EaSize:
0, Access: None, Position: 0, Mode: , AlignmentRequirement: Byte
7:39:53.9275562 AM rm.exe 5912 QueryAllInformationFile
G:\views\fabt_eblake.vws\.s\00049\800039b14a4a8b07foo BUFFER OVERFLOW
CreationTime: 7/15/2009 3:42:16 PM, LastAccessTime: 7/15/2009 3:42:16
PM, LastWriteTime: 7/15/2009 3:42:16 PM, ChangeTime: 7/15/2009 3:42:16 PM,
FileAttributes: RA, AllocationSize: 0, EndOfFile: 0, NumberOfLinks: 1,
DeletePending: False, Directory: False, IndexNumber: 0x47283402d42464, EaSize:
0, Access: None, Position: 0, Mode: , AlignmentRequirement: Byte
7:39:53.9292306 AM rm.exe 5912 QueryObjectIdInformationVolume
M:\u_fabt_eblake\FABT_Development\FABT_MPG_Process_BSP_SPCI\foo INVALID
PARAMETER
7:39:53.9292609 AM rm.exe 5912 QueryAllInformationFile
G:\views\fabt_eblake.vws\.s\00049\800039b14a4a8b07foo BUFFER OVERFLOW
CreationTime: 7/15/2009 3:42:16 PM, LastAccessTime: 7/15/2009 3:42:16
PM, LastWriteTime: 7/15/2009 3:42:16 PM, ChangeTime: 7/15/2009 3:42:16 PM,
FileAttributes: RA, AllocationSize: 0, EndOfFile: 0, NumberOfLinks: 1,
DeletePending: False, Directory: False, IndexNumber: 0x47283402d42464, EaSize:
0, Access: None, Position: 0, Mode: , AlignmentRequirement: Byte
7:39:53.9305921 AM rm.exe 5912 QueryAllInformationFile
G:\views\fabt_eblake.vws\.s\00049\800039b14a4a8b07foo BUFFER OVERFLOW
CreationTime: 7/15/2009 3:42:16 PM, LastAccessTime: 7/15/2009 3:42:16
PM, LastWriteTime: 7/15/2009 3:42:16 PM, ChangeTime: 7/15/2009 3:42:16 PM,
FileAttributes: RA, AllocationSize: 0, EndOfFile: 0, NumberOfLinks: 1,
DeletePending: False, Directory: False, IndexNumber: 0x47283402d42464, EaSize:
0, Access: None, Position: 0, Mode: , AlignmentRequirement: Byte
7:39:53.9321605 AM rm.exe 5912 CloseFile
M:\u_fabt_eblake\FABT_Development\FABT_MPG_Process_BSP_SPCI\foo SUCCESS
7:39:53.9321728 AM rm.exe 5912 CloseFile
G:\views\fabt_eblake.vws\.s\00049\800039b14a4a8b07foo SUCCESS
7:39:53.9322032 AM rm.exe 5912 QueryAllInformationFile
G:\views\fabt_eblake.vws\.s\00049\800039b14a4a8b07foo BUFFER OVERFLOW
CreationTime: 7/15/2009 3:42:16 PM, LastAccessTime: 7/15/2009 3:42:16
PM, LastWriteTime: 7/15/2009 3:42:16 PM, ChangeTime: 7/15/2009 3:42:16 PM,
FileAttributes: RA, AllocationSize: 0, EndOfFile: 0, NumberOfLinks: 1,
DeletePending: False, Directory: False, IndexNumber: 0x47283402d42464, EaSize:
0, Access: None, Position: 0, Mode: , AlignmentRequirement: Byte
7:40:37.3023584 AM rm.exe 5912 CreateFile
M:\u_fabt_eblake\FABT_Development\FABT_MPG_Process_BSP_SPCI\foo ACCESS
DENIED Desired Access: Generic Write, Delete, Disposition: Open, Options: Open
For Backup, Attributes: n/a, ShareMode: Delete, AllocationSize: n/a
7:40:37.3030100 AM rm.exe 5912 RegCloseKey <INVALID NAME> INVALID
HANDLE
7:40:37.3031448 AM rm.exe 5912 Thread Exit SUCCESS Thread
ID: 276, User Time: 0.0000000, Kernel Time: 0.0000000
MVFS appears to be more of a forwarding file system - requests into MVFS (m:\,
in my case) are interpreted by the driver and redirected to the backing store
file system of the view directory. In my case, foo is unversioned, so it is
backed by my separate view directory (g:\views\fabt_eblake.vws).
$ df -T /cygdrive/[gm]
Filesystem Type 1K-blocks Used Available Use% Mounted on
G: smbfs 20480 20480 0 100% /cygdrive/g
M: unknown 1024000 512000 512000 50% /cygdrive/m
At any rate, it looks like all access to g:\ are due to the MVFS file system
driver, and I'm hoping that the BUFFER OVERFLOW on QueryAllInformationFile is a
benign effect within that driver (it certainly does not appear to be due to
cygwin1.dll).
Next, I'll have to play with your advice to play with the various ShareMode
flags.
[*] This was my first time using procmon - cool tool!
--
Eric Blake
--
Problem reports: http://cygwin.com/problems.html
FAQ: http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
