DokanEventRelease re-entrancy race: double ExDeleteLookasideListEx / freed VCB access causes BSOD (0xA / 0x50) #1335

Activity

1. strvert commented on Jul 22, 2026

   

   strvert

   on Jul 22, 2026

   Author

   More actions

   Reproduced with Driver Verifier (verifier /standard /driver dokan2.sys, reboot). The repro mounts mirror.exe, then fires 16 concurrent DokanRemoveMountPoint calls at the same mount point, in a loop. Crash within ~100 iterations.

   Crash 1 — the lookaside double-delete, same offset as the production 0xA dumps (dokan2+0x13cbc = DokanEventRelease+0x198):

   0xC4 (DRIVER_VERIFIER_DETECTED_VIOLATION), Arg1 = 0xCB (deleting uninitialized lookaside list)
   dokan2!DokanEventRelease+0x198 [notification.c @ 380]
   dokan2!DokanGlobalEventRelease+0x3d5 [notification.c @ 454]
   dokan2!DokanGlobalUserFsRequest+0x130 [fscontrol.c @ 430]
   PROCESS_NAME: repro_unmount_race.exe
   FAILURE_BUCKET_ID: 0xc4_cb_dokan2!DokanEventRelease
   

   Crash 2 — second concurrent release reading DCB fields torn down by the first:

   0xC4, Arg1 = 0xE0 (kernel API called with user-mode address)
   dokan2!DokanStopCheckThread+0x19f [timeout.c @ 325]
   dokan2!DokanEventRelease+0x15d [notification.c @ 368]
   dokan2!DokanGlobalEventRelease+0x3d5 [notification.c @ 454]
   PROCESS_NAME: powershell.exe
   FAILURE_BUCKET_ID: 0xc4_e0_dokan2!DokanStopCheckThread
   

   Repro source (build: cl /O2 repro_unmount_race.c, run with dokan2.dll on PATH):

   Details

   // repro_unmount_race.c
   //
   // Repro for dokany issue #1335: DokanEventRelease re-entrancy race.
   //
   // Each iteration:
   //   1. starts mirror.exe to mount a volume at <mnt>
   //   2. fires <threads> concurrent DokanRemoveMountPoint(<mnt>) calls
   //   3. waits for mirror to exit, cleans up, repeats
   //
   // Concurrent unmount requests for the same VCB can both pass the
   // non-atomic re-entry guard in DokanEventRelease and execute the whole
   // teardown twice. With Driver Verifier enabled for dokan2.sys this
   // bugchecks within minutes (observed: 0xC4_e0 in DokanStopCheckThread
   // called from DokanEventRelease; the same race produces 0xA at the
   // ExDeleteLookasideListEx site and 0x50 on a freed VCB without
   // verifier).
   //
   // Build (VS prompt):  cl /O2 /W3 /I<dokany>\dokan repro_unmount_race.c /link <path>\dokan2.lib
   // Run:                repro_unmount_race.exe C:\dokan\mirror.exe C:\src C:\mnt\repro 100 16
   // Args:               <mirror.exe path> <source dir> <mount dir prefix> [iterations] [threads]
   
   #include <windows.h>
   
   #include <stdio.h>
   
   typedef BOOL(WINAPI *DokanRemoveMountPointFn)(LPCWSTR);
   
   static volatile LONG g_ok;
   static HANDLE g_goEvent;
   static DokanRemoveMountPointFn g_RemoveMountPoint;
   static WCHAR g_mnt[MAX_PATH];
   
   static DWORD WINAPI UnmountThread(LPVOID unused) {
     (void)unused;
     WaitForSingleObject(g_goEvent, INFINITE);
     if (g_RemoveMountPoint(g_mnt)) {
       InterlockedIncrement(&g_ok);
     }
     return 0;
   }
   
   static BOOL WaitForFile(LPCWSTR path, DWORD timeoutMs) {
     DWORD waited = 0;
     while (waited < timeoutMs) {
       if (GetFileAttributesW(path) != INVALID_FILE_ATTRIBUTES) {
         return TRUE;
       }
       Sleep(50);
       waited += 50;
     }
     return FALSE;
   }
   
   int wmain(int argc, wchar_t *argv[]) {
     if (argc < 4) {
       fwprintf(stderr,
                L"usage: %s <mirror.exe> <srcdir> <mnt-prefix> [iterations] "
                L"[threads]\n",
                argv[0]);
       return 2;
     }
     const wchar_t *mirror = argv[1];
     const wchar_t *srcdir = argv[2];
     const wchar_t *prefix = argv[3];
     int iterations = argc > 4 ? _wtoi(argv[4]) : 100;
     int threads = argc > 5 ? _wtoi(argv[5]) : 16;
     if (threads < 1 || threads > 64) {
       fwprintf(stderr, L"threads must be 1..64\n");
       return 2;
     }
   
     // Resolve DokanRemoveMountPoint from dokan2.dll (must be on PATH).
     HMODULE dokan = LoadLibraryW(L"dokan2.dll");
     if (!dokan) {
       fwprintf(stderr, L"dokan2.dll not found (add its dir to PATH): %lu\n",
                GetLastError());
       return 1;
     }
     g_RemoveMountPoint =
         (DokanRemoveMountPointFn)GetProcAddress(dokan, "DokanRemoveMountPoint");
     if (!g_RemoveMountPoint) {
       fwprintf(stderr, L"DokanRemoveMountPoint not exported: %lu\n",
                GetLastError());
       return 1;
     }
   
     g_goEvent = CreateEventW(NULL, TRUE, FALSE, NULL);
     if (!g_goEvent) {
       return 1;
     }
   
     HANDLE threadHandles[64];
     WCHAR cmdline[MAX_PATH * 3];
     WCHAR probe[MAX_PATH + 32];
   
     wprintf(L"repro start: iterations=%d threads=%d\n", iterations, threads);
   
     for (int i = 1; i <= iterations; i++) {
       _snwprintf(g_mnt, MAX_PATH, L"%s%d", prefix, i);
       g_mnt[MAX_PATH - 1] = L'\0';
       CreateDirectoryW(g_mnt, NULL);
   
       // Start mirror.exe to mount the volume.
       _snwprintf(cmdline, MAX_PATH * 3, L"\"%s\" /r \"%s\" /l \"%s\" /i 30000",
                  mirror, srcdir, g_mnt);
       cmdline[MAX_PATH * 3 - 1] = L'\0';
       STARTUPINFOW si = {sizeof(si)};
       PROCESS_INFORMATION pi = {0};
       if (!CreateProcessW(NULL, cmdline, NULL, NULL, FALSE,
                           CREATE_NO_WINDOW, NULL, NULL, &si, &pi)) {
         fwprintf(stderr, L"iter %d: CreateProcess failed %lu\n", i,
                  GetLastError());
         return 1;
       }
   
       // Wait until the volume answers, then fire the storm.
       _snwprintf(probe, MAX_PATH + 32, L"%s\\*", g_mnt);
       probe[MAX_PATH + 31] = L'\0';
       WaitForFile(probe, 5000);
       Sleep(300);
   
       g_ok = 0;
       ResetEvent(g_goEvent);
       for (int t = 0; t < threads; t++) {
         threadHandles[t] =
             CreateThread(NULL, 0, UnmountThread, NULL, 0, NULL);
         if (!threadHandles[t]) {
           fwprintf(stderr, L"iter %d: CreateThread %d failed %lu\n", i, t,
                    GetLastError());
           TerminateProcess(pi.hProcess, 1);
           return 1;
         }
       }
       SetEvent(g_goEvent);
       WaitForMultipleObjects(threads, threadHandles, TRUE, 30000);
       for (int t = 0; t < threads; t++) {
         CloseHandle(threadHandles[t]);
       }
   
       wprintf(L"iter %d: ok=%ld\n", i, g_ok);
       FlushFileBuffers(GetStdHandle(STD_OUTPUT_HANDLE));
   
       // A successful unmount makes mirror exit; kill it if it lingers.
       if (WaitForSingleObject(pi.hProcess, 3000) == WAIT_TIMEOUT) {
         TerminateProcess(pi.hProcess, 1);
       }
       CloseHandle(pi.hProcess);
       CloseHandle(pi.hThread);
       RemoveDirectoryW(g_mnt);
     }
   
     wprintf(L"repro done: all %d iterations completed (no crash)\n", iterations);
     FreeLibrary(dokan);
     return 0;
   }