Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.More Info on Driver Writing and Debugging
The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
The best time to release FCB of file object created by IoCreateStreamFileObject
Hi dear all,
If I understand it correctly , the best time (maybe only?) to release FCB of an ordinary file object is in response to IRP_MJ_CLOSE. But for file object created from IoCreateStreamFileObject by FSD , the receiver of IRP_MJ_CLOSE is not FSD. So what's the best time to release FCB in this case ?
I have the following use case
in response to IRP_MN_MOUNT_VOLUME 1. Fo=IoCreateStreamFileObject 2. allocate and fill FsContext / SectionObjectPointer etc. 3. CcInitializeCacheMap 4. use cache 5. CcUninitializeCacheMap 6. ObDereferenceObject(Fo) 7. release FsContext / SectionObjectPointer allocated in step 2
In this scenario I am experiencing system crash. Because at step 7 there still exists active reference to Fo which is held by Cc. Cc will use FsContext later but it has been released.
Howdy, Stranger!
| Upcoming OSR Seminars | ||
|---|---|---|
| OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead! | ||
| Kernel Debugging | 16-20 October 2023 | Live, Online |
| Developing Minifilters | 13-17 November 2023 | Live, Online |
| Internals & Software Drivers | 4-8 Dec 2023 | Live, Online |
| Writing WDF Drivers | 10-14 July 2023 | Live, Online |
Comments
When you're done with the stream file object you call ObDereferenceObject and this will send you an IRP_MJ_CLOSE. See how FAT deals with the VirtualVolumeFile:
https://github.com/microsoft/Windows-driver-samples/blob/main/filesys/fastfat/strucsup.c#L447
NB: You can build the source yourself and replace the version of FAT on your target system. Then you can set breakpoints and step the code. I personally find this more helpful than just trying to read source.
-scott
OSR