Multiple stream contexts for the same stream

NTFSD
1

Assume in post-create I attach a stream context (SC1) to a file (F) and take out an extra reference on SC1 for my code for later processing and let the create complete. Now assume all system references to F are released (i.e. all handles are closed and no more file objects exist). Then F is opened again. In my post-create I create SC2 and call FltSetStreamContext() with the FLT_SET_CONTEXT_KEEP_IF_EXISTS flag. Will I receive a STATUS_FLT_CONTEXT_ALREADY_DEFINED (and SC1 as ‘OldContext’) at this point or is it possible that the system will accept SC2, return STATUS_SUCCESS and return NULL in ‘OldContext’? I think I observed the latter. Just wanted to make sure my code isn’t flawed and this is indeed expected/possible.

Thanks,
Michael

2

Your code is not flawed, that latter behavior is correct.

Your Flt reference just keeps the Flt state around, the underlying FSD has deleted the stream control block and it?s associated contexts. If you wanted the underlying stream control block (and thus contexts) to stay valid you would need to also reference a File Object.

-scott
OSR
@OSRDrivers

3

Thank you Scott. It’s good to know I haven’t gone completely insane, yet…