Hello!
I am using FltCreateSectionForDataScan to read file. Now I want to implement SectionNotificationCallback to hold off conflicting io until I am done with the section.
In my worker thread when I finished with the section:
- close section(ZwClose + ObDereferenceObject)
- set notification event(located in section context) indicating that I am done with the section
- call FltCloseSectionForDataScan + FltReleaseContext
If my SectionNotificationCallback gets called I wait for notification event(in section context) and return from SectionNotificationCallback. It is safe to do so if section context additionally referenced before SectionNotificationCallback. If no additional reference taken before SectionNotificationCallback I can wait on invalid memory (section context destroyed already).
Is my solution ok or I can’t assume additional reference in SectionNotificationCallback ?