Crash in Dokan2.dll in DispatchDirectoryInformation

[uhonermann]

Hello,

we see intermittent crashes of our user mode implementation at a customer.
Since we cannot reproduce this on demand, it's about impossible to test it with mirror or memfs.

But we' ve some dumps, and they all look the same:

 	ntdll.dll!RtlEnterCriticalSection�()	Unknown
>	dokan2.dll!DispatchDirectoryInformation(_DOKAN_IO_EVENT * IoEvent=0x0000020464c6f9a0) Line 656	C
 	dokan2.dll!DispatchEvent(_DOKAN_IO_EVENT * ioEvent=0x0000020464c6f9a0) Line 315	C
 	dokan2.dll!DispatchDedicatedIoCallback(_TP_CALLBACK_INSTANCE * Instance=0x000000492c2ffd78, void * Parameter=0x0000020464c6f9a0, _TP_WORK * Work=0x0000020464c76d20) Line 605	C
 	ntdll.dll!TppWorkpExecuteCallback()	Unknown
 	ntdll.dll!TppWorkerThread()	Unknown
 	kernel32.dll!BaseThreadInitThunk�()	Unknown
 	ntdll.dll!RtlUserThreadStart�()	Unknown

Within DispatchDirectoryInformation we see the crash at:

EnterCriticalSection(&IoEvent->DokanOpenInfo->CriticalSection);

which makes sense, because IoEvent->DokanOpenInfo is NULL.

Interesting fact: at the start of the Function there's a DbgPrint that deals with this:

   DbgPrint(
      "###FindFiles file handle = 0x%p, eventID = %04d, event Info = 0x%p\n",
      IoEvent->DokanOpenInfo,
      **IoEvent->DokanOpenInfo != NULL ? IoEvent->DokanOpenInfo->EventId : -1**,
      IoEvent);

Besides the question, how that pointer can be NULL, shouldn't this be checked before the EnterCriticalSection ?

Regards,
Uwe

[Liryna]

Hi Uwe,
Indeed a handle is not always expected during listing but the migration from v1 to v2 with the memory pool missed broke the logic
This patch should be enough 952087b to fix it. If you have the chance to confirm it, please let me know!

[uhonermann]

Hi Liryna,

I'll build a patch for the customer and ask him to install it on some machines.
If there's no crash anymore during the next weeks, I'll come back to you.

Thanks,
Uwe

[Liryna]

Any update on this @uhonermann ?

[uhonermann]

Not yet, I'll ask them.

[uhonermann]

Okay, the customer has used the patch for a week now, and they didn't have any crashes since.

So it looks like it's working correctly.