IoGetDeviceObjectPointer and ZwClose

NTDEV
1

Hi there

  1. a ZwClose(file handle) also dereferences the FileObject the handle
    points to OR an explicit ObDereference (FileObject) has to be called as
    well ?
  2. When IoGetDeviceObjectPointer() is called to get a DeviceObject of a
    named device (Tcp in my case) . A FileObject is also returned .
    Do I have to pass the FileObject to the underlying device with any
    subsequent Irp , until the the DeviceObject is no more in use (ZwClose
    called).

Zvi Dubitzky
Storage Systems Technology Email: dubi@il.ibm.com
IBM Haifa Research Laboratory Phone: +972-4-8296182
Haifa, 31905, ISRAEL

2

  1. you must call ZwClose(file handle) if you called ZwCreate/OpenFile. If you called ObReferenceObjectByHandle to get the PFILE_OBJECT, you must dereference that as well.

  2. the answer to this depends on the device you are sending I/O to. The simple answer is yes, you should do it. The complicated answer is that some stacks use the PFILE_OBJECT (like TCP) and some don’t (like serial), so it depends. It never hurts to send the PFILE_OBJECT in all I/O.

d

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Zvi Dubitzky
Sent: Wednesday, September 08, 2004 3:41 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] IoGetDeviceObjectPointer and ZwClose

Hi there

  1. a ZwClose(file handle) ?also dereferences the FileObject ?the handle ?points to OR ?an explicit ?ObDereference (FileObject) has to be called ?as well ?
  2. When ?IoGetDeviceObjectPointer() is called to get ?a DeviceObject of ?a named device (Tcp in my case) ?. ?A FileObject ?is also returned .
    ? ? Do I have to ?pass the ?FileObject ?to the underlying device with any subsequent Irp , until the ?the DeviceObject ?is no ?more in use (ZwClose called).

Zvi Dubitzky ? ? ? ? ? ? ? ? ? ? ? ? ? ?
Storage Systems Technology ? ? ? Email: dubi@il.ibm.com
IBM Haifa Research Laboratory ? ?Phone: +972-4-8296182
Haifa, 31905, ISRAEL

— Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256 You are currently subscribed to ntdev as: xxxxx@windows.microsoft.com To unsubscribe send a blank email to xxxxx@lists.osr.com

3

ZwClose destroys the handle, if you have the file object obtained by ObReferenceObjectByHandle before this - it will live (though with major limitations - only paging IO allowed).

“FileObject is also returned” for
a) filling your IRP stack locations with it
b) dereferencing it to “close” the driver logically.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: Zvi Dubitzky
To: Windows System Software Devs Interest List
Sent: Wednesday, September 08, 2004 2:41 PM
Subject: [ntdev] IoGetDeviceObjectPointer and ZwClose

Hi there

  1. a ZwClose(file handle) also dereferences the FileObject the handle points to OR an explicit ObDereference (FileObject) has to be called as well ?
  2. When IoGetDeviceObjectPointer() is called to get a DeviceObject of a named device (Tcp in my case) . A FileObject is also returned .
    Do I have to pass the FileObject to the underlying device with any subsequent Irp , until the the DeviceObject is no more in use (ZwClose called).

Zvi Dubitzky
Storage Systems Technology Email: dubi@il.ibm.com
IBM Haifa Research Laboratory Phone: +972-4-8296182
Haifa, 31905, ISRAEL

— Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256 You are currently subscribed to ntdev as: xxxxx@storagecraft.com To unsubscribe send a blank email to xxxxx@lists.osr.com

4
  1. a ZwClose(file handle) also dereferences the FileObject the handle
    points to OR an explicit ObDereference (FileObject) has to be called as
    well ?
  2. When IoGetDeviceObjectPointer() is called to get a DeviceObject of a
    named device (Tcp in my case) a FileObject is also returned .
    Do I have to pass the FileObject to the underlying device with any
    subsequent Irp , until the the DeviceObject is no more in use (ZwClose
    called).
5

>1. a ZwClose(file handle) also dereferences the FileObject the handle
points to OR an

explicit ObDereference (FileObject) has to be called as well ?

Yes, but other references can still exist after ZwClose, and must be removed by
ObDereferenceObject.

  1. When IoGetDeviceObjectPointer() is called to get a DeviceObject of a
    named device (Tcp
    in my case) a FileObject is also returned .

BTW - IoGetDeviceObjectPointer is:
ZwCreateFile
ObReferenceObjectByHandle
ZwClose
IoGetRelatedDeviceObject

Do I have to pass the FileObject to the underlying device with any
subsequent Irp

Yes, it is better to do so, though some drivers neglect this info.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com