Yet once hi all !
Sorry for the first question - it was answered by me.
I’m stupid truthly !
But that’s not all - i’ve yet once question.
In the article “Tracking State and Context - Reference Counting for
File System Filter Drivers” (The NT Insider, Vol 9, Issue 2, Mar-Apr
2002 | Published: 15-Apr-02| Modified: 06-May-03) was mentioned
some conditions, when the ReferenceCount for the tracked file context
structures must be decremented. Own from that conditions is:
“For each IRP_MJ_CLOSE the filter driver decrements the reference count
on the per-file context structure if the FO_STREAM_FILE bit is not set
for the file object and if CcGetFileObjectFromSectionPtrs does not return
this file object”
Question: If CcGetFileObjectFromSectionPtrs returns same FileObject
(for which IRP_MJ_CLOSE arrives) and SectionObjectPointers-
DataSectionObject(ImageSectionObject) is not null - what does it mean,
and when that case can occuring ?
With regards
Oleshii
Halloween Trivia: Everyone knows that cats are associated with witches but what has this got to do with the Plague of 14th century Europe?
postmaster.co.uk
http://www.postmaster.co.uk/cgi-bin/meme/quiz.pl?id=113
We tried to discuss this topic in the “Legacy tracking query” message(
number is 66186 ) , see some posts below.
“oleshii wood” wrote in message
news:xxxxx@ntfsd…
> Yet once hi all !
> Sorry for the first question - it was answered by me.
> I’m stupid truthly !
> But that’s not all - i’ve yet once question.
> In the article “Tracking State and Context - Reference Counting for
> File System Filter Drivers” (The NT Insider, Vol 9, Issue 2, Mar-Apr
> 2002 | Published: 15-Apr-02| Modified: 06-May-03) was mentioned
> some conditions, when the ReferenceCount for the tracked file context
> structures must be decremented. Own from that conditions is:
> “For each IRP_MJ_CLOSE the filter driver decrements the reference count
> on the per-file context structure if the FO_STREAM_FILE bit is not set
> for the file object and if CcGetFileObjectFromSectionPtrs does not return
> this file object”
> Question: If CcGetFileObjectFromSectionPtrs returns same FileObject
> (for which IRP_MJ_CLOSE arrives) and SectionObjectPointers-
>>DataSectionObject(ImageSectionObject) is not null - what does it mean,
> and when that case can occuring ?
> With regards
> Oleshii
>
>
> _______________________________________________________________
> Halloween Trivia: Everyone knows that cats are associated with witches but
> what has this got to do with the Plague of 14th century Europe?
>
> postmaster.co.uk
> http://www.postmaster.co.uk/cgi-bin/meme/quiz.pl?id=113
>
>
> "For each IRP_MJ_CLOSE the filter driver decrements the reference count
on the per-file context structure if the FO_STREAM_FILE bit is not set
for the file object
Correct. This is because such file objects never see MJ_CREATE.
and if CcGetFileObjectFromSectionPtrs does not return
this file object"
Correct. This is because some file object can be used by Cc/Mm in
MmCreateSection to be used in control area creation, and thus for paging IO. If
this is exactly that file object - then Cc/Mm hold a reference on it.
Control area (MmCa tag allocation) is the one which holds the reference. In
turn, it is referenced by a) each user app’s file mapping VAD b) shared cache
map. The lifetime of the shared cache map itself is determining by some garbage
collection existing inside Cc, the stale (not used by anybody,
CcUninitializeCacheMap already called) cache map can live for a long time.
Then suddenly Cc can decide to destroy it, which dereferences MmCa ->
deferences a file object -> possibly destroys a file object -> MJ_CLOSE to it
arrives -> FSD dereferences the FCB -> FSD possibly destroys the FCB.
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com