DokanEventRelease re-entrancy race: double ExDeleteLookasideListEx / freed VCB access causes BSOD (0xA / 0x50)

[strvert]

Check List

• I checked my issue doesn't exist yet (searched for lookaside / ExDeleteLookasideListEx / DokanEventRelease / AV_dokan2; no matching report)
• My issue is valid with mirror default sample and not specific to my user-mode driver implementation (the race is in the driver's unmount path; it can be triggered from any FS implementation, including mirror, by concurrent unmount requests)
• I can always reproduce the issue with the provided description below (timing-dependent race — reproduction is probabilistic; Driver Verifier increases the chance)
• I have updated Dokany to the latest version and have reboot my computer after (2.3.1.1000 is the latest release)
• I tested one of the last snapshot from appveyor CI (not run; the faulty code is unchanged on master — see below)

Describe the bug

DokanEventRelease (sys/notification.c) has a non-atomic re-entry guard, leaving a race window between passing the guard and setting the unmount flags. If two threads enter concurrently for the same VCB, this leads to either a double ExDeleteLookasideListEx on the same list (0xA IRQL_NOT_LESS_OR_EQUAL), or a store into a VCB already freed by the thread that got ahead (0x50 PAGE_FAULT_IN_NONPAGED_AREA).

Observed under a workload where a user-mode FS process repeatedly mounts/unmounts (up to 8 concurrent mounts, 60 s request timeout): multiple BSODs, three times 0xA at dokan2+0x13cbc and once 0x50 at dokan2+0x144da, all in the same process on the same code path. Present in both v2.3.1.1000 and master (as of 2026-07-22).

To Reproduce

1. Mount a volume (mirror is fine) with a short request timeout.
2. Issue DokanRemoveMountPoint concurrently from two threads against the same mount point — or race one DokanRemoveMountPoint against the timeout-triggered unmount (timeout.c DokanUnmount).
3. Repeat in a loop. Enabling Driver Verifier (special pool, force IRQL checking) on dokan2.sys makes the race easier to catch.

Expected behavior

Concurrent unmount/release requests for the same VCB are serialized: one performs the teardown, the others return cleanly. No BSOD.

Logs

BSOD minidump analysis. The 0xA dumps are identical (FAILURE_BUCKET_ID: AV_dokan2!unknown_function):

nt!KeBugCheckEx
nt!KiBugCheckDispatch
nt!KiPageFault
nt!ExpRemoveGeneralLookaside+0x21
nt!ExDeleteLookasideListEx+0x28
dokan2+0x13cbc

Symbol resolution with dokan2.pdb (private PDB) from the release asset dokan.zip — the installed dokan2.sys is SHA256-identical to x64/Release/Driver/dokan2.sys:

• dokan2+0x13cbc = dokan2!DokanEventRelease+0x198 (notification.c:380) — return address right after the ExDeleteLookasideListEx(&vcb->FCBAvlNodeLookasideList) call at line 378
• dokan2+0x144da = dokan2!DokanStopFcbGarbageCollectorThread+0x36 (notification.c:309) — the Vcb->FcbGarbageCollectorThread = NULL; store, i.e. the 0x50 is a write to an already-freed VCB

DokanStopFcbGarbageCollectorThread is called from DokanEventRelease (line 374), so both crashes are inside the unmount path. Minidumps can be provided if needed.

Environment:

• Windows version: Windows 11 Pro build 26200
• Processor architecture: x64
• Dokany version: 2.3.1.1000 (dokan2.sys built 2025-09-28)
• Library type (Dokany/FUSE): Dokany

Additional context

Root cause in v2.3.1.1000's DokanEventRelease (sys/notification.c):

1. The re-entry guards (line 336 IsDeletePending, line 341 IsUnmountPendingVcb) are plain flag reads with no locking; check and set are not atomic.
2. The flags are only set at lines 358–359 (SetLongFlag: VCB_DISMOUNT_PENDING / DCB_DELETE_PENDING), after DokanDeleteMountPoint (line 355, which involves mount manager I/O). Two threads entering at about the same time both pass the guard and execute the whole teardown twice.
3. FCBAvlNodeLookasideListInit is never cleared after ExDeleteLookasideListEx (lines 377–379; same at 385–387 on master), so nothing prevents re-entering the deleted list.

The 0xA is two threads running ExDeleteLookasideListEx on the same list concurrently — ExpRemoveGeneralLookaside then walks a corrupted list (ExDeleteLookasideListEx does not tolerate concurrent calls on the same list). The 0x50 is the trailing thread executing the line-309 store after the leading thread had already freed the VCB.

Entry points that can race for the same VCB:

• DokanRemoveMountPoint → SendGlobalReleaseIRP → FSCTL_EVENT_RELEASE → DokanGlobalEventRelease (fscontrol.c:430). Every call reaches the driver; no idempotency on the user-mode side.
• Volume FSCTL (fscontrol.c:575)
• Timeout watcher thread → DokanUnmount (timeout.c:32). The driver unmounts on its own when the request timeout fires.
• MountManager link deletion (device.c:469/480)
• EventStart failure (event.c:1162)

For example, while a DokanRemoveMountPoint unmount is inside DokanDeleteMountPoint, the timeout thread (or a second DokanRemoveMountPoint) can pass the guard.

Suggested fix:

1. Make the re-entry guard an interlocked test-and-set, and set the flags at the top of the function (before IoAcquireRemoveLock)
2. Set FCBAvlNodeLookasideListInit = FALSE before ExDeleteLookasideListEx
3. Make teardown steps such as DokanStopFcbGarbageCollectorThread idempotent and order them against VCB freeing

[strvert]

Reproduced with Driver Verifier (verifier /standard /driver dokan2.sys, reboot). The repro mounts mirror.exe, then fires 16 concurrent DokanRemoveMountPoint calls at the same mount point, in a loop. Crash within ~100 iterations.

Crash 1 — the lookaside double-delete, same offset as the production 0xA dumps (dokan2+0x13cbc = DokanEventRelease+0x198):

0xC4 (DRIVER_VERIFIER_DETECTED_VIOLATION), Arg1 = 0xCB (deleting uninitialized lookaside list)
dokan2!DokanEventRelease+0x198 [notification.c @ 380]
dokan2!DokanGlobalEventRelease+0x3d5 [notification.c @ 454]
dokan2!DokanGlobalUserFsRequest+0x130 [fscontrol.c @ 430]
PROCESS_NAME: repro_unmount_race.exe
FAILURE_BUCKET_ID: 0xc4_cb_dokan2!DokanEventRelease

Crash 2 — second concurrent release reading DCB fields torn down by the first:

0xC4, Arg1 = 0xE0 (kernel API called with user-mode address)
dokan2!DokanStopCheckThread+0x19f [timeout.c @ 325]
dokan2!DokanEventRelease+0x15d [notification.c @ 368]
dokan2!DokanGlobalEventRelease+0x3d5 [notification.c @ 454]
PROCESS_NAME: powershell.exe
FAILURE_BUCKET_ID: 0xc4_e0_dokan2!DokanStopCheckThread

Repro source (build: cl /O2 repro_unmount_race.c, run with dokan2.dll on PATH):

Details

// repro_unmount_race.c
//
// Repro for dokany issue #1335: DokanEventRelease re-entrancy race.
//
// Each iteration:
//   1. starts mirror.exe to mount a volume at <mnt>
//   2. fires <threads> concurrent DokanRemoveMountPoint(<mnt>) calls
//   3. waits for mirror to exit, cleans up, repeats
//
// Concurrent unmount requests for the same VCB can both pass the
// non-atomic re-entry guard in DokanEventRelease and execute the whole
// teardown twice. With Driver Verifier enabled for dokan2.sys this
// bugchecks within minutes (observed: 0xC4_e0 in DokanStopCheckThread
// called from DokanEventRelease; the same race produces 0xA at the
// ExDeleteLookasideListEx site and 0x50 on a freed VCB without
// verifier).
//
// Build (VS prompt):  cl /O2 /W3 /I<dokany>\dokan repro_unmount_race.c /link <path>\dokan2.lib
// Run:                repro_unmount_race.exe C:\dokan\mirror.exe C:\src C:\mnt\repro 100 16
// Args:               <mirror.exe path> <source dir> <mount dir prefix> [iterations] [threads]

#include <windows.h>

#include <stdio.h>

typedef BOOL(WINAPI *DokanRemoveMountPointFn)(LPCWSTR);

static volatile LONG g_ok;
static HANDLE g_goEvent;
static DokanRemoveMountPointFn g_RemoveMountPoint;
static WCHAR g_mnt[MAX_PATH];

static DWORD WINAPI UnmountThread(LPVOID unused) {
  (void)unused;
  WaitForSingleObject(g_goEvent, INFINITE);
  if (g_RemoveMountPoint(g_mnt)) {
    InterlockedIncrement(&g_ok);
  }
  return 0;
}

static BOOL WaitForFile(LPCWSTR path, DWORD timeoutMs) {
  DWORD waited = 0;
  while (waited < timeoutMs) {
    if (GetFileAttributesW(path) != INVALID_FILE_ATTRIBUTES) {
      return TRUE;
    }
    Sleep(50);
    waited += 50;
  }
  return FALSE;
}

int wmain(int argc, wchar_t *argv[]) {
  if (argc < 4) {
    fwprintf(stderr,
             L"usage: %s <mirror.exe> <srcdir> <mnt-prefix> [iterations] "
             L"[threads]\n",
             argv[0]);
    return 2;
  }
  const wchar_t *mirror = argv[1];
  const wchar_t *srcdir = argv[2];
  const wchar_t *prefix = argv[3];
  int iterations = argc > 4 ? _wtoi(argv[4]) : 100;
  int threads = argc > 5 ? _wtoi(argv[5]) : 16;
  if (threads < 1 || threads > 64) {
    fwprintf(stderr, L"threads must be 1..64\n");
    return 2;
  }

  // Resolve DokanRemoveMountPoint from dokan2.dll (must be on PATH).
  HMODULE dokan = LoadLibraryW(L"dokan2.dll");
  if (!dokan) {
    fwprintf(stderr, L"dokan2.dll not found (add its dir to PATH): %lu\n",
             GetLastError());
    return 1;
  }
  g_RemoveMountPoint =
      (DokanRemoveMountPointFn)GetProcAddress(dokan, "DokanRemoveMountPoint");
  if (!g_RemoveMountPoint) {
    fwprintf(stderr, L"DokanRemoveMountPoint not exported: %lu\n",
             GetLastError());
    return 1;
  }

  g_goEvent = CreateEventW(NULL, TRUE, FALSE, NULL);
  if (!g_goEvent) {
    return 1;
  }

  HANDLE threadHandles[64];
  WCHAR cmdline[MAX_PATH * 3];
  WCHAR probe[MAX_PATH + 32];

  wprintf(L"repro start: iterations=%d threads=%d\n", iterations, threads);

  for (int i = 1; i <= iterations; i++) {
    _snwprintf(g_mnt, MAX_PATH, L"%s%d", prefix, i);
    g_mnt[MAX_PATH - 1] = L'\0';
    CreateDirectoryW(g_mnt, NULL);

    // Start mirror.exe to mount the volume.
    _snwprintf(cmdline, MAX_PATH * 3, L"\"%s\" /r \"%s\" /l \"%s\" /i 30000",
               mirror, srcdir, g_mnt);
    cmdline[MAX_PATH * 3 - 1] = L'\0';
    STARTUPINFOW si = {sizeof(si)};
    PROCESS_INFORMATION pi = {0};
    if (!CreateProcessW(NULL, cmdline, NULL, NULL, FALSE,
                        CREATE_NO_WINDOW, NULL, NULL, &si, &pi)) {
      fwprintf(stderr, L"iter %d: CreateProcess failed %lu\n", i,
               GetLastError());
      return 1;
    }

    // Wait until the volume answers, then fire the storm.
    _snwprintf(probe, MAX_PATH + 32, L"%s\\*", g_mnt);
    probe[MAX_PATH + 31] = L'\0';
    WaitForFile(probe, 5000);
    Sleep(300);

    g_ok = 0;
    ResetEvent(g_goEvent);
    for (int t = 0; t < threads; t++) {
      threadHandles[t] =
          CreateThread(NULL, 0, UnmountThread, NULL, 0, NULL);
      if (!threadHandles[t]) {
        fwprintf(stderr, L"iter %d: CreateThread %d failed %lu\n", i, t,
                 GetLastError());
        TerminateProcess(pi.hProcess, 1);
        return 1;
      }
    }
    SetEvent(g_goEvent);
    WaitForMultipleObjects(threads, threadHandles, TRUE, 30000);
    for (int t = 0; t < threads; t++) {
      CloseHandle(threadHandles[t]);
    }

    wprintf(L"iter %d: ok=%ld\n", i, g_ok);
    FlushFileBuffers(GetStdHandle(STD_OUTPUT_HANDLE));

    // A successful unmount makes mirror exit; kill it if it lingers.
    if (WaitForSingleObject(pi.hProcess, 3000) == WAIT_TIMEOUT) {
      TerminateProcess(pi.hProcess, 1);
    }
    CloseHandle(pi.hProcess);
    CloseHandle(pi.hThread);
    RemoveDirectoryW(g_mnt);
  }

  wprintf(L"repro done: all %d iterations completed (no crash)\n", iterations);
  FreeLibrary(dokan);
  return 0;
}