I have a minifilter and also subscibed to process Create/Destroy callback (PsSetCreateProcessNotifyRoutineEx). I use the same double linked list in minifilter routines and callbacks in PsSetCreateProcessNotifyRoutineEx. Do I need to made synchronization to this list access? Can system use different threads to call my callback in driver or maybe call minifilter in a few threads?
Yes, you need synchronization. Your minifilter callbacks are called in the context of whatever thread is performing the filesystem operation.
-scott
OSR
@OSRDrivers