I am working on minifilter driver, my driver scans files at IRP_MJ_CLEANUP and it blocks IRP_MJ_CLEANUP until scan is not completed.
To scan file, FltCreateSectionForDataScan is being used to open memory mapped section in driver and userland app can open memory mapping using MapViewOfFile, and scan the file content.
Things work fine on local NTFS system.
But problem is with share folder, driver can open section handle using FltCreateSectionForDataScan and userland app can read file content using MapViewOfFile for remote files.
BUT 'sometimes' complete data is not saved at remote machine.
Suppose, I create a file using notepad or any app on share folder, this share folder has all access rights, type few lines and close the app, app tries to save the data at remote location before closing the file.
FltGetFileSize method returns correct file size but my memory mapped file does not show complete contents and complete contents are not saved into remote file. I open file again some part of file is not saved earlier therefore complete file content is not shown in editor.
I do not understand where to start looking the issue, is this issue related with oplock?
Please suggest me, what should I go forward?