irp_mj_cleanup called immediately after irp_mj_create

NTDEV
1

Hi,
Can you please help me.

Here’s my problem
From my driver code, I tried to get the device object of another driver and am trying to call an ioctl.

From my driver when I call the
IoGetDeviceObject
for the target device, in the target driver I get an IRP_MJ_CREATE call and then immediately and IRP_MJ_CLEANUP call.

My driver code
IoGetDeviceObject()
IoCallDriver(MY_IOCTL)
obDereferenceObject()

The IRP sequence i receive in the target driver
IRP_MJ_CREATE
IRP_MJ_CLEANUP
IRP_MJ_DEVICECONTROL
IRP_MJ_CLOSE

The target driver was also written by us, but works correctly when called from the user mode.

Warm Regards
Jeseem
mailto:xxxxx@hotmail.com

You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

2

>for the target device, in the target driver I get an IRP_MJ_CREATE call and

then immediately and IRP_MJ_CLEANUP call.
My driver code
IoGetDeviceObject()
IoCallDriver(MY_IOCTL)
obDereferenceObject()
The IRP sequence i receive in the target driver
IRP_MJ_CREATE
IRP_MJ_CLEANUP
IRP_MJ_DEVICECONTROL
IRP_MJ_CLOSE

This is by design.
All is working OK. IoGetDeviceObjectPointer is a sequence of
ZwCreateFile/ObReferenceObjectByHandle/ZwClose.
ZwClose causes CLEANUP to be sent.
Your driver must be written to support read/write/IOCTL after CLEANUP.

Max

You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

3

Hi Max,

All is working OK. IoGetDeviceObjectPointer is a sequence of
ZwCreateFile/ObReferenceObjectByHandle/ZwClose.
ZwClose causes CLEANUP to be sent.
Your driver must be written to support read/write/IOCTL after CLEANUP.

Shouldn’t IRP_MJ_CLOSE be called immediately after cleanup?
I thought that cleanup is called only when closing the last instance of open
file object.

Presently what I am getting is
IRP_MJ_CLEANUP is called
My custom IOCTLs are called,
then only IRP_MJ_CLOSE is called.

Please clarify

Thanks and warm regards
Jeseem
mailto:xxxxx@hotmail.com

To: “NT Developers Interest List”
>Subject: [ntdev] Re: irp_mj_cleanup called immediately after irp_mj_create

> >for the target device, in the target driver I get an IRP_MJ_CREATE call
>and
> >then immediately and IRP_MJ_CLEANUP call.
> >My driver code
> >IoGetDeviceObject()
> >IoCallDriver(MY_IOCTL)
> >obDereferenceObject()
> >The IRP sequence i receive in the target driver
> >IRP_MJ_CREATE
> >IRP_MJ_CLEANUP
> >IRP_MJ_DEVICECONTROL
> >IRP_MJ_CLOSE
>
>This is by design.
>All is working OK. IoGetDeviceObjectPointer is a sequence of
>ZwCreateFile/ObReferenceObjectByHandle/ZwClose.
>ZwClose causes CLEANUP to be sent.
>Your driver must be written to support read/write/IOCTL after CLEANUP.
>
> Max
>

_________________________________________________________________________
Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.

—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

4

> Shouldn’t IRP_MJ_CLOSE be called immediately after cleanup?

I thought that cleanup is called only when closing the last instance of
open
file object.

No, CLEANUP is called when the last handle is closed.
In case of IoGetDeviceObjectPointer, the lower driver will receive CREATE
and the CLEANUP immediately.
CLOSE will be sent only when you will dereference the file object which is a
result of IoGetDeviceObjectPointer.

Max

You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com