CreateFile in PostCleanup


I observed strange problem with my MF driver. In PostCleanup callback I open file, which PostCleanup callback was called for. So I open the file for read attributes, do some query and close the file. In PM log I see this sequence of IRPs:

  1. IRP_MJ_CREATE of user mode process (created new temporary file)
  2. IRP_MJ_CLEANUP of user mode process
  3. IRP_MJ_CREATE of my driver
  4. IRP_MJ_QUERY_INFORMATION of my driver
  5. IRP_MJ_CLEANUP of my driver
  6. IRP_MJ_CLOSE of my driver
  7. IRP_MJ_CLOSE of user mode process
  8. IRP_MJ_CREATE of user mode process
  9. IRP_MJ_QUERY_INFORMATION of user mode process (temporary attribute not present anymore)

Now if user mode process creates temporary file (step 1), then closes it (step 2) and in step 8) if it opens it again and does query (step 9), it gets no TEMPORARY attribute. This problem happens only on FAT filesystem, not on NTFS. I found out that if my driver do not perform step 4), it has no impact. Only if I do not open the file at all (without steps 3) - 6) ), user mode process gets TEMPORARY attribute in step 9. In step 4) I see temporary attribute. It disappears in step 7). Steps 3) and 8) are done with same parameters for CreateFile. So it looks like for FAT I must not open file between IRP_MJ_CLEANUP and IRP_MJ_CLOSE (in PostCleanup).

Any idea what I am doing wrongly?

I’ve never looked at the temporary attribute and its handling in FAT. However, you’re in luck - you have source code to FAT, so you should be able to rebuild it, install it, and walk through it to figure out why you are observing this behavior.