Close is being called before QueryDirectory ends

[tomas.d...@gmail.com]

Hi,

First of all; many thanks for providing such an excellent tool.

I want to check with you:

1) if a "Close" call from WinFsp can get called before QueryDirectory ends?

2) these hex number that WinFsp prints out, (see below) are these from the 2nd parameter address pointer of the readdirectory function?

spfs[TID=3228]: FFFFC50CFB14EC60: >>QueryDirectory 0000000000000000:00000186333ABED0, Address=0000018628820000, Length=65520, Pattern=NULL, Marker=NULL

NTSTATUS spfs_readdirectory(FSP_FILE_SYSTEM *FileSystem,
        PVOID FileContext, PWSTR Pattern, PWSTR Marker,
        PVOID Buffer, ULONG BufferLength, PULONG PBytesTransferred)
{

I have attached "aaa" which contains some strange where Close looks being calls before QueryDirectory  ends. Below here is a summary.

Do you have any idea why this happens?

spfs[TID=3228]: FFFFC50CFB14EC60: >>QueryDirectory 0000000000000000:00000186333ABED0, Address=0000018628820000, Length=65520, Pattern=NULL, Marker=NULL
2025-11-16.13:38:26 SP99999D c:\users\daleto\desktop\spictera\win-spfs\spfs_readdirectory.c:36:spfs_readdirectory(\:1):ENTRY
spfs[TID=3228]: FFFFC50CFB14EC60: <<QueryDirectory IoStatus=0[33034]
spfs[TID=3228]: FFFFC50CFB146820: >>QueryDirectory 0000000000000000:000001863AAF4ED0, Address=0000018628830000, Length=65520, Pattern=NULL, Marker="svc.exe"
2025-11-16.13:38:26 SP99999D c:\users\daleto\desktop\spictera\win-spfs\spfs_readdirectory.c:36:spfs_readdirectory(\:2):ENTRY
spfs[TID=3228]: FFFFC50CFB146820: <<QueryDirectory IoStatus=0[0]
spfs[TID=39fc]: FFFFC50CFB147230: >>Close 0000000000000000:000001863AAF4ED0
spfs[TID=3228]: FFFFC50CFB145CA0: >>Close 0000000000000000:00000186333ABED0

[Bill Zissimopoulos]

When an application opens a file for the first time in a WinFsp file system, WinFsp creates two internal data structures:

• A "FileNode" data structure that contains important information for managing the open file. There is a single such data structure per opened file, regardless of how many times the file is opened.
• A "FileDesc" data structure that contains information related to the particular HANDLE that will be returned to user mode.

If the application opens the same file for a second (or more) times, only a new FileDesc data structure will be created and the original FileNode will be reused.

User mode file systems need to track files on their own and WinFsp allows you to attach some "user context" to the FileNode or FileDesc. The user mode file system uses "UserContext" to attach information to FileNodes and "UserContext2" to attach information to FileDescs.

With this in mind, let's look into your questions:

if a "Close" call from WinFsp can get called before QueryDirectory ends?

This is not possible when we are talking about the same FileDesc (which you may see in your file system as the UserContext2 value). A Close will always be the last operation for a particular UserContext2 (unless of course the UserContext2 value is reused by the file system, e.g. because malloc returns memory that was just freed).

However it is possible when we are talking about the same FileNode (which you may see in your file system as the UserContext value). A directory may be open multiple times and may receive a Close on one FileDesc and a QueryDirectory afterwards on a different FileDesc. However if you are only tracking FileNodes (via UserContext) it will appear as if a Close came before a QueryDirectory (because the UserContext value for both will be the same).

these hex number that WinFsp prints out, (see below) are these from the 2nd parameter address pointer of the readdirectory function?

When the log looks like 000...0:XXX...X it likely means that you are using the UmFileContextIsUserContext2 flag (directly or indirectly via FUSE) to track files using UserContext2. The XXX...X hexadecimal part is the value that your user mode returned as UserContext2 from Create/Open. In this case the FileContext parameter will indeed be the same value as the UserContext2 value.

I have attached "aaa" which contains some strange where Close looks being calls before QueryDirectory  ends.

In the log you posted there are only two QueryDirectory calls and their associated UserContext2 values show that they happen before the corresponding Close calls (as they should be).

Bill

--
You received this message because you are subscribed to the Google Groups "WinFsp" group.
To unsubscribe from this group and stop receiving emails from it, send an email to winfsp+un...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/winfsp/cfb03e07-5a52-4c27-9aef-5453a5175ce2n%40googlegroups.com.

[Tomas Dalebjörk]

Thanks Bill 

Thats explains.

Is there a way to "print" this hexadecimal numbers that you print in WinFsp to actually know which of the WinFsp calls which user programs, as they might be executed in parallell making it hard to link...

Thanks