In NT Insider article "Tracking State and Context - Reference Counting for File System Filter Drivers" there is sentence "For each IRP_MJ_CLOSE the filter driver decrements the reference count on the per-file context structure if the FO_STREAM_FILE bit is not set for the file object and if CcGetFileObjectFromSectionPtrs does not return this file object."
I don't understand why we should call CcGetFileObjectFromSectionPtrs.
If this file is being closed then it can't be used for caching. Not anymore. So if we got irp_mj_close we already know that this file is not used for caching.
If the file still being used for caching then we won't get irp_mj_close.
It looks like you're new here. If you want to get involved, click one of these buttons!
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!||Kernel Debugging||30 Mar 2020||OSR Seminar Space|
|Developing Minifilters||20 Apr 2020||LIVE ONLINE|
|Writing WDF Drivers||11 May 2020||LIVE ONLINE|
|Internals & Software Drivers||28 Sept 2020||Dulles, VA|