IRP_MN_MOUNT_VOLUME and ObQueryNameString

 From:http://www.osronline.com/showThread.cfm?link=25276

 

<span style="font-size:18px;">This is a common problem for filter drivers trying to query the name of a file object.IIRC, when you call ObQueryNameString for a file object, it calls the query name method on the file object type.  That method is implemented by the function IopQueryName which in turn calls IopQueryXxxInformation.  If the file was opened for non-overlapped IO, the default for WIN32, IopQueryXxxInformation tries to synchronize the name query--IRP_MJ_QUERY_INFORMATION--with other operations on the file object, such as the IRP_MJ_CLEANUP you are filtering.  This synchronization is done by treating the KEVENT Lock field of the file object like a mutex.  Because ZwClose already locked the file object prior to your filter receiving the IRP_MJ_CLEANUP, and a KEVENT has no concept of recursive acquisition, you are experiencing a deadlock in IopQueryXxxInformation when it tries to lock the file object.I suggest you build the IRP_MJ_QUERY_INFORMATION with a FileInformationClass of FileNameInformation, and send it yourself.  This will bypass acquiring the file object's lock, and the FSD will do the necessary synchronization using its FCB resources.</span>