Attaching to FS CDOs in Volume Filter

NTFSD
1

Folks,

I thought it will be suitable to ask it on NTFS as problem is related to
attaching to FS CDOs.

I have a volume filter which registers for a FS notification and attaches to
FS CDOs using *IoAttachDeviceToDeviceStackSafe* (I am interested in
IRP_MN_MOUNT_VOLUME and hence doing all this) and storing the returned *
AttachedToDeviceObject* in my device extension of Filter device for CDO.

In handler of IRP_MN_MOUNT_VOLUME I am doing my own initialization stuff and
then passing down the IRP by calling IoCallDriver.
It causes the bug check and I see the bug check code - 0x35 which is
NO_MORE_IRP_STACK_LOCATIONS.

Analyzing further I learnt following:–

  1. When I am calling *IoAttachDeviceToDeviceStackSafe, *I was
    receiving *AttachedToDeviceObject
    *as pointer to NTFS CDO. Also *AttachedDevice *field of my Filter device
    object
    was NULL after calling *IoAttachDeviceToDeviceStackSafe.
    *2) When I receive IRP_MN_MOUNT_VOLUME, I saw that *AttachedDevice* field
    was set to a device object and after performing !devobj on that object I
    came to know that it was of Filter Manager.*

*I am suspecting the above analysis for the cause of my crash.*

Now my question:–

*Am I doing some thing in correctly in attaching to the file system CDOs.
Why I am seeing the Filter Manager as the AttachedDevice in my filter device
object at IRP_MN_MOUNT_VOLUME and not at the point when I am attaching to
File System CDO?*

*Any suggestions on how should I go about it.*

*Regards
Deepak*
*