IRP_MJ_CLOSE is not sent !!!

NTFSD
1

I develop a minifilter driver that watch/block access to a context-specific file.
But I have a trouble for IRP_MJ_CLEANUP, IRP_MJ_CLOSE. In WDK document it is written as follows.
IRP_MJ_CLEANUP irq is sent when file handle reference count reached to zero, IRP_MJ_CLOSE irq is sent when file object reference count reached to zero.
I noted that both IRP_MJ_CLEANUP and IRP_MJ_CLOSE irq is sent with equal FCB(File Control Block) and File Object Pointer(PFILE_OBJECT) value.

But I found that IRP_MJ_CLEANUP is sent, but IRP_MJ_CLOSE is not sent in Windows Vista.
Why? Any special reason ?

2

Are you sure you waited long enough? IRP_MJ_CLOSE may not be sent
immediately after IRP_MJ_CLEANUP.

Tony
OSR

3

Thanks for your reply. You say that IRP_MJ_CLOSE with equal PFO is sent after IRP_MJ_CLEANUP eventually. I’ll check now.
I have another question. WDK Document says as follows.
“Thus a filter driver should expect to receive IRP_MJ_CLEANUP and IRP_MJ_CLOSE requests for previously unseen file objects.”

Is IRP_MJ_CLEANUP and IRP_MJ_CLOSE request surely sent for a file object pointer arrived in IRP_MJ_READ/WRITE request ?

4

A IRP_MP_CLEANUP will be sent for any file for which a IRP_MJ_CREATE has
been issued. Since some of those can be done before your driver loads, you
may not see any other requests until the cleanup. If the file was memory
mapped you might see the same file referenced by multiple file objects.
Have you read the FAQ at least three times? How about the only book on file
systems?

wrote in message news:xxxxx@ntfsd…
> Thanks for your reply. You say that IRP_MJ_CLOSE with equal PFO is sent
> after IRP_MJ_CLEANUP eventually. I’ll check now.
> I have another question. WDK Document says as follows.
> “Thus a filter driver should expect to receive IRP_MJ_CLEANUP and
> IRP_MJ_CLOSE requests for previously unseen file objects.”
>
> Is IRP_MJ_CLEANUP and IRP_MJ_CLOSE request surely sent for a file object
> pointer arrived in IRP_MJ_READ/WRITE request ?
>