ZwCreateFile invoked with UNC path

[robert-j]

Environment

• Windows version: Windows 10 Version 20H2 (Build 19042.804)
• Processor architecture: x64 and x64
• Dokany version: 1.4.1
• Library type (Dokany/FUSE): Dokany

Check List

• ☑ I checked my issue doesn't exist yet
• ☑ My issue is valid with mirror default sample and not specific to my user-mode driver implementation
• ☑ I can always reproduce the issue with the provided description below.
• ☑ I have updated Dokany to the latest version and have reboot my computer after.
• ☐ I tested one of the last snapshot from appveyor CI

Description

The ZwCreateFile callback is sometimes invoked with a UNC path.

The following steps are required to reproduce the issue:

1. Start memfs with memfs.exe /l M: /n /u \unc\test /d

2. create the file M:\test.txt

3. select it in Explorer and open its context menu

4. wait for the provider to eventually time out (this is another issue ;))

5. look at the debug logs:

    ###Create 0089
    [2021-02-19 15:10:09.745] [info] CreateFile: \unc\test\test.txt with node: false
    [2021-02-19 15:10:09.745] [info] CreateFile: \unc\test\test.txt is a File
    [2021-02-19 15:10:09.746] [info] CreateFile: \unc\test\test.txt OPEN_EXISTING
    CreateFile status = c0000034
    ###Create 0090
    [2021-02-19 15:10:09.752] [info] CreateFile: \test.txt with node: true
    [2021-02-19 15:10:09.752] [info] CreateFile: \test.txt is a File
    [2021-02-19 15:10:09.752] [info] CreateFile: \test.txt OPEN_EXISTING
    CreateFile status = 0
    

Remarks

The issue occurs only if Dokan's network provider is installed.

I stand corrected. It occurs even w/out the network provider. See the comments below.

[Liryna]

Thanks for the report.

Do you a way to reproduce the issue ? I mean I never saw this behavior 🥺 Does it comes from a specific process?

[robert-j]

I first thought it's Explorer, but it can be reproduced as simple as this from inside a PowerShell console:

dir \\unc\test\test.txt

At least on my machine.

I also had a look at Dokan's NP logs with DgbView. Nothing interesting:

[10412] NpGetConnection M:, 40
[10412] NpGetConnection M:, 260
[10412] NpGetConnection M:, 260

This happened at the same timestamps as ZwCreateFile was invoked on the UNC.

[robert-j]

I've fired up a Windows 7 x86 virtual machine (updated with the latest Microsoft updates available):

Same behavior.

[robert-j]

I don't know if this is "by design" or if it's related to the issue, but no kind of UNC access is working for me:

type \\unc\test\test.txt

returns a "path not found" error. The request is coming as ZwCreateFile("\unc\test\test.txt", ...) to memfs (or to my own FS driver for that matter).

Maybe is this the real issue.

Another observation:

When I disable the network provider, type \\unc\test\test.txt leads to the same callback as above:

ZwCreateFile("\unc\test\test.txt", ...) 

[Liryna]

@robert-j It is definitely an issue but I cannot say if it comes from the network provider or the kernel unfortunately. It needs some debugging that I cannot allocate right now.

[robert-j]

Can you reproduce the issue?

[Liryna]

@robert-j sorry for the delay, I can reproduce the issue easily with your steps. Yes the mirror gets the path with unc.

Using procmon, can see that there is a first request for the unc path with the text file which result in a repasse status and a second createfile with the same path but starting with a single backslash instead of a double.
Kernel debug is needed here to see what is happening

[Liryna]

Quickly looked at the issue. The driver logs is not showing the reparse call. We only get the \unc\test\test.txt. The issue seems to not be kernel (probably a network provider issue).

[dokan1][0][DokanDispatchRequest][FFFFAA864D4E4420][VCB][IRP_MJ_CREATE][]: Begin ProcessId=9096
[dokan1][0][DokanDispatchCreate][FFFFAA864D4E4420]: FileObject=FFFFAA864DE630D0 RelatedFileObject=0000000000000000 FileName="\unc\test\test.txt" Flags=0 DesiredAccess=80 Options=1200000 FileAttributes=0 ShareAccess=7
[dokan1][0][DokanGetFCB][FFFFAA864D4E4420]: Has entry FCB=FFFFAA864BEDBC80 FileName="\__drive_fs_keepalive" FileCount: 1
[dokan1][0][DokanGetFCB][FFFFAA864D4E4420]: Has entry FCB=FFFFAA864D4E62D0 FileName="\" FileCount: 4
[dokan1][0][DokanGetFCB][FFFFAA864D4E4420]: No matching FCB found.
[dokan1][0][DokanDispatchCreate][FFFFAA864D4E4420]: Use FCB=FFFFAA8646FF1AA0
[dokan1][0][DokanAllocateCCB][FFFFAA864D4E4420]: Allocated CCB
[dokan1][0][DokanRegisterPendingIrp][FFFFAA864D4E4420]: Register the IRP pending
[dokan1][0][DokanRegisterPendingIrp][FFFFAA864D4E4420]: Pending Registration: STATUS_PENDING
[dokan1][0][DokanDispatchRequest][FFFFAA864D4E4420]: End - Irp is marked pending
[dokan1][0][DokanDispatchRequest][FFFFAA8646FED8B0][VCB][IRP_MJ_FILE_SYSTEM_CONTROL][IRP_MN_USER_FS_REQUEST]: Begin ProcessId=8576
[dokan1][0][DokanUserFsRequest][FFFFAA8646FED8B0][FSCTL_EVENT_INFO]: FileObject=FFFFAA864E89A300
[dokan1][0][DokanDispatchCompletion][FFFFAA864D4E4420][VCB][IRP_MJ_CREATE][]: Begin ProcessId=9096
[dokan1][0][DokanCompleteCreate][FFFFAA864D4E4420]: FileObject=FFFFAA864DE630D0 CreateInformation=FILE_DOES_NOT_EXIST
[dokan1][0][DokanFreeCCB][FFFFAA864D4E4420]: Free CCB=FFFFAA864C4A6580
[dokan1][0][DokanDeleteFcb]: Free FCB:FFFFAA8646FF1AA0
[dokan1][0][DokanDispatchCompletion][FFFFAA864D4E4420]: End - STATUS_OBJECT_NAME_NOT_FOUND Information=5
[dokan1][0][DokanDispatchRequest][FFFFAA8646FED8B0]: End - STATUS_SUCCESS Information=0
[dokan1][0][DokanDispatchRequest][FFFFAA8647B25660][VCB][IRP_MJ_CLEANUP][]: Begin ProcessId=8576
[dokan1][0][DokanDispatchCleanup][FFFFAA8647B25660]: FileObject=FFFFAA864E89A300
[dokan1][0][DokanCheckCCB][FFFFAA8647B25660]: Ccb is NULL
[dokan1][0][DokanDispatchRequest][FFFFAA8647B25660]: End - STATUS_SUCCESS Information=0
[dokan1][0][DokanDispatchRequest][FFFFAA8647B25660][VCB][IRP_MJ_CLOSE][]: Begin ProcessId=8576
[dokan1][0][DokanDispatchClose][FFFFAA8647B25660]: FileObject=FFFFAA864E89A300
[dokan1][0][DokanDispatchRequest][FFFFAA8647B25660]: End - STATUS_SUCCESS Information=0
[dokan1][0][DokanDispatchRequest][FFFFAA8647B25660][VCB][IRP_MJ_CREATE][]: Begin ProcessId=8576
[dokan1][0][DokanDispatchCreate][FFFFAA8647B25660]: FileObject=FFFFAA864DE50CA0 RelatedFileObject=0000000000000000 FileName="(null)" Flags=0 DesiredAccess=100080 Options=1000060 FileAttributes=0 ShareAccess=3
[dokan1][0][DokanDispatchCreate][FFFFAA8647B25660]: Request for FS device
[dokan1][0][DokanDispatchRequest][FFFFAA8647B25660]: End - STATUS_SUCCESS Information=1
[dokan1][0][DokanDispatchRequest][FFFFAA8647B25660][VCB][IRP_MJ_FILE_SYSTEM_CONTROL][IRP_MN_USER_FS_REQUEST]: Begin ProcessId=8576
[dokan1][0][DokanUserFsRequest][FFFFAA8647B25660][FSCTL_EVENT_WAIT]: FileObject=FFFFAA864DE50CA0
[dokan1][0][DokanDispatchRequest][FFFFAA8647B25660]: End - Irp is marked pending

[Liryna]

Note: The mirror sample actually remove the UNC from the requested path if present so I imagine some believed it was expected somehow.
Unclear if it is a bug or should we filter it in the library