About Reference count article in NT Insider...

NTFSD
1

About Reference count in NT Insider…
According to description in Reference Counting article in NT Insider,I
have below question:
When does IRP_MJ_CREATE increase the reference count?In it’s Completion
Routing?
We know,an IRP_MJ_CLOSE will lead to an IRP_MJ_CLOSE(not the same
fileobject)recursively,then
the IRP_MJ_CLOSE will occur before the completion of the IRP_MJ_CREATE.
The reference count will decrease at first,it perhaps will drop to zero.
At this Scenario,Can I sure the (DataSection!=NULL&&ImageSection!=NULL)?
If the DataSection==NULL&&ImageSection==NULL,oh,Last Close.I delete the
context of per-file,Wrong!
anyone can explain it?maybe at this scenario,I can sure the two section
will not be NULL?
thanks you.

2

sorry,just mistake .it’s :
We know,an IRP_MJ_CREATE will lead to an IRP_MJ_CLOSE(not the same
fileobject)recursively,then
sorry.

We know,an IRP_MJ_CLOSE will lead to an IRP_MJ_CLOSE(not the same
fileobject)recursively,then