正在读取延迟工作项中处于预清理阶段的文件

Question

我正在编写一个Windows Minifilter驱动程序，该驱动程序需要读取IRP_MJ_CLEANUP上的整个文件（仅限大小达到特定阈值的文件）。由于FltRadFile可能不会从preop回调中调用，我将作业排入工作队列，并在那里执行。当我完成读取文件时，我调用FltCompletePendedPreOperation并调用post-cleanup回调，该回调还将post操作作为延迟工作处理。以下是我的代码片段：

static NTSTATUS HandlePreCleanup(_In_ PFLT_CALLBACK_DATA Data,
                                 _Out_ PVOID *Context)
{
    NTSTATUS Status = STATUS_SUCCESS;
    PFLT_INSTANCE Instance;
    PFILE_OBJECT FileObject;
    PVOID Buffer = NULL;
    LARGE_INTEGER FileOffset;
    FileObject = Data->Iopb->TargetFileObject;
    Instance = Data->Iopb->TargetInstance;   
    Buffer = ExAllocatePoolWithTag(PagedPool,
                                   (ULONG) FILE_CHUNK_SIZE,
                                   PPFILTER_FILE_POOLTAG);
    if (Buffer == NULL) {
        PPERROR("Failed allocating file chunkn");
        Status = STATUS_MEMORY_NOT_ALLOCATED;
        goto out;
    }
    FileOffset.QuadPart = 0;
    for (;;) {
        ULONG BytesRead;
        Status = FltReadFile(
            Instance, FileObject, &FileOffset,
            (ULONG) FILE_CHUNK_SIZE, Buffer,
            FLTFL_IO_OPERATION_DO_NOT_UPDATE_BYTE_OFFSET,
            &BytesRead, NULL, NULL
        );
        if (!NT_SUCCESS(Status)) {
            if (Status == STATUS_END_OF_FILE) {
                Status = STATUS_SUCCESS;
                break;
            }
            PPERROR("Failed reading from file %wZ: error %dn",
                    &FileObject->FileName, Status);
            goto out;
        }
        FileOffset.QuadPart += BytesRead;
    }
out:
    if (Buffer != NULL) {
        ExFreePoolWithTag(Buffer, PPFILTER_FILE_POOLTAG);
    }
    return Status;
}
static VOID DeferredPreCallback(_In_ PFLT_DEFERRED_IO_WORKITEM WorkItem,
                                _In_ PFLT_CALLBACK_DATA Data,
                                _In_opt_ PVOID Context)
{
    NTSTATUS Status = STATUS_SUCCESS;
    PVOID PostContext = NULL;
    UNREFERENCED_PARAMETER(Context);
    switch (Data->Iopb->MajorFunction) {
    case IRP_MJ_CLEANUP:
        Status = HandlePreCleanup(Data, &PostContext);
        break;
    default:
        NT_ASSERTMSG("Unexpected deferred pre callback operation",
                     FALSE);
        break;
    }
    FltCompletePendedPreOperation(Data,
                                  FLT_PREOP_SUCCESS_WITH_CALLBACK,
                                  PostContext);
    FltFreeDeferredIoWorkItem(WorkItem);
}

static NTSTATUS QueueWork(_Inout_ PFLT_CALLBACK_DATA Data,
                          _In_ PFLT_DEFERRED_IO_WORKITEM_ROUTINE WorkRoutine,
                          _In_ PVOID Context)
{
    NTSTATUS Status = STATUS_SUCCESS;
    PFLT_DEFERRED_IO_WORKITEM WorkItem = NULL;
    WorkItem = FltAllocateDeferredIoWorkItem();
    if (WorkItem == NULL) {
        Status = STATUS_MEMORY_NOT_ALLOCATED;
        PPERROR("Failed allocating work itemn");
        goto failed;
    }
    Status = FltQueueDeferredIoWorkItem(WorkItem, Data, WorkRoutine,
                                        CriticalWorkQueue, Context);
    if (!NT_SUCCESS(Status)) {
        PPERROR("Failed queuing work item to queue: error %dn",
                Status);
        goto failed;
    }
    return STATUS_SUCCESS;
failed:
    if (WorkItem != NULL) {
        FltFreeDeferredIoWorkItem(WorkItem);
    }
    return Status;
}
static FLT_PREOP_CALLBACK_STATUS DeferPreCallback(
    _Inout_ PFLT_CALLBACK_DATA Data,
    _In_ PCFLT_RELATED_OBJECTS FltObjects,
    _Out_ PVOID *CompletionContext
)
{
    NTSTATUS Status = STATUS_SUCCESS;
    UNREFERENCED_PARAMETER(FltObjects);
    UNREFERENCED_PARAMETER(CompletionContext);
    Status = QueueWork(Data, DeferredPreCallback, NULL);
    if (!NT_SUCCESS(Status)) {
        return FLT_PREOP_SUCCESS_NO_CALLBACK;
    }
    return FLT_PREOP_PENDING;
}
CONST FLT_OPERATION_REGISTRATION OperationRegistrations[] = {
    {
        IRP_MJ_CLEANUP,
        0,
        DeferPreCallback,
        DeferPostCallback,
        NULL
    },
    { IRP_MJ_OPERATION_END },
};

这在一段时间内被证明是有效的，但过了一段时间，系统似乎挂起了（死锁？）。问题似乎出在对FltRadFile的调用上，因为删除此调用时不会发生挂起。关于为什么会发生这种情况，或者如何进一步调试，有什么想法吗？

Answer 1

很明显，问题是FltRadFile的FileOffset与卷扇区大小不一致。如果FileObject是为非缓存IO创建的，这显然是一个问题（请参阅中的备注部分https://msdn.microsoft.com/en-us/library/windows/hardware/ff544286（v=vs.85）.aspx）。由于我无法控制所讨论的FileObject是如何创建的，可能有些情况下它确实是为非缓存IO创建的。为了解决此问题，我在for（；）循环的末尾添加了以下检查：

if (BytesRead < FILE_CHUNK_SIZE) {
        break;
}

如果FILE_CHUNK_SIZE是卷扇区大小的倍数，则此操作应该有效。