Hello,
I’m porting a legacy filter driver that does File Encryption to minifilter.
Lately I started using Driver Verifier (the old legacy driver failed passing it). I went solving various problems thanks to it.
But I’m stuck on this one, I’ve disabled all my FLT_OPERATION_REGISTRATION Callbacks so now I’m not filtering any I/Os and while I shutdown the computer this message appears :
FILTER VERIFIER WARNING: A filter has set a completion context for a callback data which will be
lost. Probable cause of this is that no post-operation callback was requested
or routine was registered for this operation or the request was being pended
or completed. (Filter = FFFFC902E4C59010 (driver_name_here), Cbd = FFFFC902E8705998)
Break, ignore, zap or remove ?
In windbg I can print the FLT_CALLBACK_DATA structure and the FLT_IO_PARAMETER_BLOCK and the IO_STATUS_BLOCK :
kd> dt !_flt_callback_data FFFFC902E8705998
FLTMGR!_FLT_CALLBACK_DATA
+0x000 Flags : 2
+0x008 Thread : 0xffffc902`e7f40040 _KTHREAD
+0x010 Iopb : 0xffffc902`e87059f0 _FLT_IO_PARAMETER_BLOCK
+0x018 IoStatus : _IO_STATUS_BLOCK
+0x028 TagData : (null)
+0x030 QueueLinks : _LIST_ENTRY [ 0x00000000`00000000 - 0x00000000`00000000 ]
+0x040 QueueContext : [2] (null)
+0x030 FilterContext : [4] (null)
+0x050 RequestorMode : 0 ''
kd> dx -id 0,0,ffffc902e2aaf080 -r1 ((FLTMGR!_FLT_IO_PARAMETER_BLOCK *)0xffffc902e87059f0)
((FLTMGR!_FLT_IO_PARAMETER_BLOCK *)0xffffc902e87059f0) : 0xffffc902e87059f0 [Type: _FLT_IO_PARAMETER_BLOCK *]
[+0x000] IrpFlags : 0x0 [Type: unsigned long]
[+0x004] MajorFunction : 0x10 [Type: unsigned char]
[+0x005] MinorFunction : 0x0 [Type: unsigned char]
[+0x006] OperationFlags : 0x0 [Type: unsigned char]
[+0x007] Reserved : 0x0 [Type: unsigned char]
[+0x008] TargetFileObject : 0x0 [Type: _FILE_OBJECT *]
[+0x010] TargetInstance : 0xffffc902e69c1010 [Type: _FLT_INSTANCE *]
[+0x018] Parameters [Type: _FLT_PARAMETERS]
kd> dx -id 0,0,ffffc902e2aaf080 -r1 (*((FLTMGR!_IO_STATUS_BLOCK *)0xffffc902e87059b0))
(*((FLTMGR!_IO_STATUS_BLOCK *)0xffffc902e87059b0)) [Type: _IO_STATUS_BLOCK]
[+0x000] Status : -1 [Type: long]
[+0x000] Pointer : 0xffffffff [Type: void *]
[+0x008] Information : 0x0 [Type: unsigned __int64]
But they are quite empty…
And since I’m not filtering any I/Os where can I be using a FLT_CALLBACK_DATA ?
Without Driver Verifier it goes to shutdown normally (no BSOD or freezes).
If anybody has ever encountered this message … any help appreciated !
(I also registered some callback in pDriverObject->MajorFunction to communicate with the driver, but I don’t think it can come from this).
Thank you.