I am using FltCreateSectionForDataScan to read file. Now I want to implement SectionNotificationCallback to hold off conflicting io until I am done with the section.
In my worker thread when I finished with the section:
1) close section(ZwClose + ObDereferenceObject)
2) set notification event(located in section context) indicating that I am done with the section
3) call FltCloseSectionForDataScan + FltReleaseContext
If my SectionNotificationCallback gets called I wait for notification event(in section context) and return from SectionNotificationCallback. It is safe to do so if section context additionally referenced before SectionNotificationCallback. If no additional reference taken before SectionNotificationCallback I can wait on invalid memory (section context destroyed already).
Is my solution ok or I can’t assume additional reference in SectionNotificationCallback ?
It looks like you're new here. If you want to get involved, click one of these buttons!
|Upcoming OSR Seminars||Kernel Debugging||30 Mar 2020||OSR Seminar Space|
|Writing WDF Drivers||13 April 2020||OSR Seminar Space & ONLINE|
|Developing Minifilters||20 Apr 2020||OSR Seminar Space & ONLINE|
|Internals & Software Drivers||TBD||Dulles, VA|