Blue screen in IRP_MJ_CLOSE/IRP_MJ_WRITE

NTFSD
1

Hi,
I’m working in this minifilter driver that needs to call FltSetInformationFile() in IRP_MJ_WRITE or IRP_MJ_CLOSE. Before I call FltSetInformationFile(), I check that I’m in PASSIVE_LEVEL using KeGetCurrentIrql(). But I’m getting a blue screen and the mini dump tells me the problem is in NtfsSetBasicInfo.
So Why I can not call FltSetInformationFile() when my IRQL is PASSIVE_LEVEL?

Thanks for your help
Payman

2

IRP_MJ_CLOSE is beyond IRP_MJ_CLEANUP. You can not call
FltSetInformationFile() at that moment.

wrote news:xxxxx@ntfsd…
> Hi,
> I’m working in this minifilter driver that needs to call
> FltSetInformationFile() in IRP_MJ_WRITE or IRP_MJ_CLOSE. Before I call
> FltSetInformationFile(), I check that I’m in PASSIVE_LEVEL using
> KeGetCurrentIrql(). But I’m getting a blue screen and the mini dump tells
> me the problem is in NtfsSetBasicInfo.
> So Why I can not call FltSetInformationFile() when my IRQL is
> PASSIVE_LEVEL?
>
> Thanks for your help
> Payman
>
>

3

Thanks Frank,
What about IRP_MJ_WRITE? Why would I get the blue screen even if my IRQL is PASSIVE_LEVEL?

Payman

4

Update the !analyze output.

Sisimon

On 9/18/07, xxxxx@hotmail.com wrote:
>
> Thanks Frank,
> What about IRP_MJ_WRITE? Why would I get the blue screen even if my IRQL
> is PASSIVE_LEVEL?
>
> Payman
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

–
GCS d+ s: a- c++++ U> B+ L++>$ w++++$ W++(+++) PGP+N+ t PS+PE++ tv+(++) b+++
G+++ e++>(++++) h-- r
Don’t know this? See http://www.geekcode.com/geek.html