NTOSKRNL bugcheck when clicking on "My Computer C disk icon"

[Gge]

With svn 14668 , Ros bugchecks when I click on the "my computer " icon 
and o then on the "C" disk drive icon as per debug messages below.
This is a regression and it is always reproductible .
I cannot say exactly when it has been broken.
Any idea ?

-----------------------------
PM_OPEN_WINDOW: path=C:\
KeBugCheckWithTf at ke/catch.c:237
A problem has been detected and ReactOS has been shut down to prevent 
damage to your computer.

The problem seems to be caused by the following file: ntoskrnl.exe

KMODE_EXCEPTION_NOT_HANDLED

Technical information:

*** STOP: 0x0000001E (0xc0000005,0x8004773e,0x00000000,0x00000006)

***    ntoskrnl.exe - Address 0x8004773e base at 0x80000000, DateStamp 0x0

Page Fault Exception: 14(0)
Processor: 0 CS:EIP 8:8004773e <ntoskrnl.exe:4773e (io/mdl.c:130 
(IoFreeMdl))>
cr2 6 cr3 d896000 Proc: 80d46990 Pid: f0 <explorer> Thrd: 80d50a68 Tid: f4
DS 10 ES 10 FS 30 GS 23
EAX: 00000000   EBX: 8004635f   ECX: 00000003
EDX: 00000002   EBP: a1f76a88   ESI: 007ecdd8   ESP: a1f769d8
EDI: a1f76d74   EFLAGS: 00010282 kESP a1f769d8 kernel stack base a1f74000
Frames:
<ntoskrnl.exe:3c7d0 (io/cleanup.c:112 (IoReadWriteCompletion))>
<ntoskrnl.exe:3c8e0 (io/cleanup.c:211 (IoSecondStageCompletion))>
<ntoskrnl.exe:4694d (io/irp.c:498 (IofCompleteRequest))>
<vfatfs.sys:c65c (rw.c:775 (VfatRead))>
<vfatfs.sys:dcc9 (misc.c:110 (VfatDispatchRequest))>
<vfatfs.sys:de94 (misc.c:168 (VfatBuildRequest))>
<ntoskrnl.exe:4627d (io/irp.c:211 (IofCallDriver))>
<ntoskrnl.exe:46293 (io/irp.c:226 (IoCallDriver))>
<ntoskrnl.exe:4e6b0 (io/rw.c:154 (NtReadFile))>
<ntoskrnl.exe:38f2 (C:\DOCUME~1\home\LOCALS~1\Temp/ccucbaaa.s:178 
(KiSystemService))>
<kernel32.dll:278f6 (file/rw.c:154 (ReadFile))>

Reaards
Gerard

[Hartmut Birr]

Gge wrote:
> With svn 14668 , Ros bugchecks when I click on the "my computer " icon
> and o then on the "C" disk drive icon as per debug messages below.
> This is a regression and it is always reproductible .
> I cannot say exactly when it has been broken.
> Any idea ?

It may be a result of my changes in 14418. The mdl is only allocated if
the read/write length is greater 0. Can you add my patch and try it again?

- Hartmut

Index: drivers/fs/vfat/rw.c
===================================================================
--- drivers/fs/vfat/rw.c	(revision 14480)
+++ drivers/fs/vfat/rw.c	(working copy)
@@ -617,6 +617,7 @@
    }
    if (Length == 0)
    {
+      DPRINT1("Length is 0\n");
       IrpContext->Irp->IoStatus.Information = 0;
       Status = STATUS_SUCCESS;
       goto ByeBye;
Index: ntoskrnl/io/cleanup.c
===================================================================
--- ntoskrnl/io/cleanup.c	(revision 14480)
+++ ntoskrnl/io/cleanup.c	(working copy)
@@ -1,4 +1,4 @@
-/* $Id:$
+/* $Id$
  * 
  * COPYRIGHT:       See COPYING in the top level directory
  * PROJECT:         ReactOS kernel
@@ -109,7 +109,10 @@

if (DeviceObject->Flags & DO_DIRECT_IO)
    {
-      IoFreeMdl(Irp->MdlAddress);
+      if (Irp->MdlAddress)
+      {
+         IoFreeMdl(Irp->MdlAddress);
+      }
    }
 }

[Gge]

Hartmut Birr wrote:
> Gge wrote:
> > With svn 14668 , Ros bugchecks when I click on the "my computer " icon
> > and o then on the "C" disk drive icon as per debug messages below.
> > This is a regression and it is always reproductible .
> > I cannot say exactly when it has been broken.
> > Any idea ?
>
> It may be a result of my changes in 14418. The mdl is only allocated if
> the read/write length is greater 0. Can you add my patch and try it again?
> Hartmut
> Index: drivers/fs/vfat/rw.c
>
> --- drivers/fs/vfat/rw.c	(revision 14480)
> +++ drivers/fs/vfat/rw.c	(working copy)
> @@ -617,6 +617,7 @@
>     }
>     if (Length == 0)
>     {
>  DPRINT1("Length is 0\n");
>  IrpContext->Irp->IoStatus.Information = 0;
>  Status = STATUS_SUCCESS;
>  goto ByeBye;
> Index: ntoskrnl/io/cleanup.c
>
> --- ntoskrnl/io/cleanup.c	(revision 14480)
> +++ ntoskrnl/io/cleanup.c	(working copy)
> @@ -1,4 +1,4 @@
> -/* $Id:$
> +/* $Id$
> COPYRIGHT:       See COPYING in the top level directory
> PROJECT:         ReactOS kernel
>
> @@ -109,7 +109,10 @@
> if (DeviceObject->Flags & DO_DIRECT_IO)
> {
>  IoFreeMdl(Irp->MdlAddress);
>  if (Irp->MdlAddress)
>  {
>     IoFreeMdl(Irp->MdlAddress);
>  }
> }
>
> }

Thanks Harmut,

I have tested successfully your path with an additional fix from Royce3 
below.

These fixes can be committed
Regards
Gerard

--------------   Royce3 patch   -------------------------------

/*
  * @implemented
  */
VOID STDCALL
IoFreeMdl(PMDL Mdl)
{
    /*
     * This unmaps partial mdl's from kernel space but also asserts that
non-partial
     * mdl's isn't still mapped into kernel space.
     */

ASSERT(Mdl);
    ASSERT_IRQL(DISPATCH_LEVEL);

MmPrepareMdlForReuse(Mdl);

ExFreePool(Mdl);
}