Under what circumstances I can get IRP_MJ_CLOSE before IRP_MJ_CLEANUP?
-htfv
For stream file objects which where created with
IoCreateStreamFileObjectLite(). Technically, you dont get the CLOSE
before the cleanup. You never get any CLEANUP, nor CREATE. The first
operation observed can be any valid paging IO.
Dan
----- Original Message -----
From: “Alexey Logachyov”
To: “File Systems Developers”
Sent: Tuesday, September 17, 2002 11:36 AM
Subject: [ntfsd] IRP_MJ_CLEANUP/IRP_MJ_CLOSE
> Under what circumstances I can get IRP_MJ_CLOSE before IRP_MJ_CLEANUP?
>
> -htfv
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
> To unsubscribe send a blank email to %%email.unsub%%
>
I did not mean stream file objects but usual ones. I believe in FileMon I
saw occasions when IRP_MJ_CLOSE was sent before IRP_MJ_CLEANUP. Is that some
kind of race conditions in FileMon? Or it is quite possible.
-htfv
----- Original Message -----
From: “Dan Partelly”
To: “File Systems Developers”
Sent: Tuesday, September 17, 2002 12:44 PM
Subject: [ntfsd] Re: IRP_MJ_CLEANUP/IRP_MJ_CLOSE
> For stream file objects which where created with
> IoCreateStreamFileObjectLite(). Technically, you dont get the CLOSE
> before the cleanup. You never get any CLEANUP, nor CREATE. The first
> operation observed can be any valid paging IO.
>
> Dan
>
> ----- Original Message -----
> From: “Alexey Logachyov”
> To: “File Systems Developers”
> Sent: Tuesday, September 17, 2002 11:36 AM
> Subject: [ntfsd] IRP_MJ_CLEANUP/IRP_MJ_CLOSE
>
>
> > Under what circumstances I can get IRP_MJ_CLOSE before IRP_MJ_CLEANUP?
> >
> > -htfv
> >
> >
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
> > To unsubscribe send a blank email to %%email.unsub%%
> >
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to %%email.unsub%%
>
It’s certainly not a race condition. It’s probably an IRP_MJ_CLOSE for a
stream file object.
Since FileMon does not check FsContext it does not know whether something is
a stream file object or not - and since it doesn’t check the FO_STREAM_FILE
flag.
No FO will receive an IRP_MJ_CLOSE before the IRP_MJ_CLEANUP - HOWEVER, the
same file name CAN, since the same file can be opened multiple times, and also
it can be accessed with stream file objects by the Cc.
This is so common on NTFS, that you are bound to see it for virtually any
file I/O.
Alexey Logachyov wrote:
I did not mean stream file objects but usual ones. I believe in FileMon I saw
occasions when IRP_MJ_CLOSE was sent before IRP_MJ_CLEANUP. Is that some kind
of race conditions in FileMon? Or it is quite possible.
–
Kind regards, Dejan M. www.alfasp.com
E-mail: xxxxx@alfasp.com ICQ#: 56570367
Alfa File Monitor - File monitoring library for Win32 developers.
Alfa File Protector - File protection and hiding library for Win32 developers.
>> I did not mean stream file objects but usual ones.
One must make a distiniction between the “on disk file stream” and stream
file objects. conceptually they are different animals.
A very “normal” file can be accessed through a stream file object, and on
NTFS , caching is implemented through stream file objects.
“Alexey Logachyov” wrote in message news:xxxxx@ntfsd…
>
> I did not mean stream file objects but usual ones. I believe in FileMon I
> saw occasions when IRP_MJ_CLOSE was sent before IRP_MJ_CLEANUP. Is that
some
> kind of race conditions in FileMon? Or it is quite possible.
>
> -htfv
>
> ----- Original Message -----
> From: “Dan Partelly”
> To: “File Systems Developers”
> Sent: Tuesday, September 17, 2002 12:44 PM
> Subject: [ntfsd] Re: IRP_MJ_CLEANUP/IRP_MJ_CLOSE
>
>
> > For stream file objects which where created with
> > IoCreateStreamFileObjectLite(). Technically, you dont get the CLOSE
> > before the cleanup. You never get any CLEANUP, nor CREATE. The first
> > operation observed can be any valid paging IO.
> >
> > Dan
> >
> > ----- Original Message -----
> > From: “Alexey Logachyov”
> > To: “File Systems Developers”
> > Sent: Tuesday, September 17, 2002 11:36 AM
> > Subject: [ntfsd] IRP_MJ_CLEANUP/IRP_MJ_CLOSE
> >
> >
> > > Under what circumstances I can get IRP_MJ_CLOSE before IRP_MJ_CLEANUP?
> > >
> > > -htfv
> > >
> > >
> > >
> > >
> > > —
> > > You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
> > > To unsubscribe send a blank email to %%email.unsub%%
> > >
> >
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> > To unsubscribe send a blank email to %%email.unsub%%
> >
>
>
>
>
>