IRP_MJ_CLEANUP and FileObject->FsContext is NULL??

NTFSD
1

Gentlefolk,

I’ve seen a surprising situation arise where my filter driver has an
IRP_MJ_CLEANUP in dispatch, and currentIrpStack->FileObject->FsContext is
NULL. So far, I’ve only seen it once, and for sure I didnt know how to
handle it then, or what it meant. I was wondering, if anyone could
enlighten me as to why/how this arises in the system, and what it means. I
am pretty sure that I am the only filter driver in the stack. Your
thoughts are once again deeply appreciated.

Kind regards
Lyndon

2

Raw FS?

“Lyndon J. Clarke” wrote:

Gentlefolk,

I’ve seen a surprising situation arise where my filter driver has an
IRP_MJ_CLEANUP in dispatch, and currentIrpStack->FileObject->FsContext is
NULL. So far, I’ve only seen it once, and for sure I didnt know how to
handle it then, or what it meant. I was wondering, if anyone could
enlighten me as to why/how this arises in the system, and what it means. I
am pretty sure that I am the only filter driver in the stack. Your
thoughts are once again deeply appreciated.

Kind regards
Lyndon

You are currently subscribed to ntfsd as: xxxxx@alfasp.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

–
Kind regards, Dejan M. MVP for DDK
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32 developers.

Alfa File Monitor - File monitoring library for Win32 developers.

3

Sorry I should have said it is definitely ntfs below me.

4

IoCreateStreamFileObject that is used by file systems generates such IRPs.

Alexei.

“Lyndon J. Clarke” wrote in message
news:xxxxx@ntfsd…
>
> Gentlefolk,
>
> I’ve seen a surprising situation arise where my filter driver has an
> IRP_MJ_CLEANUP in dispatch, and currentIrpStack->FileObject->FsContext is
> NULL. So far, I’ve only seen it once, and for sure I didnt know how to
> handle it then, or what it meant. I was wondering, if anyone could
> enlighten me as to why/how this arises in the system, and what it means. I
> am pretty sure that I am the only filter driver in the stack. Your
> thoughts are once again deeply appreciated.
>
> Kind regards
> Lyndon
>
>

5

Thanks Alexei. Do you know why is generates such an IRP? How can I do the
context tracking when I dont have the FsContext? Any ideas?