lost context in mini filter

NTFSD
1

Hi,
I am noticing that a file stream handle context gets lost/removed if another FileObject is opened and then closed on the same file that my FileObject with the lost context was opened on.

One possible problem is that I’m calling FltSupportsStreamHandleContexts and if it returns false then I just allocate the PFSRTL_ADVANCED_FCB_HEADER and set the pointer to that in the FileObject->FSContext variable. Then FltSupportsStreamHandleContexts succceeds and I allocate and set the context. This is on Windows XP Pro. That FSContext value is there for a while and Get… returns the context but then once the second FileObject is opened and then closed (which also allocates and sets its own context) then my original FSContext value disappears (changes to NULL).

Is the problem that both FileObjects share the same FCB?

2

Which filesystem is this ? The filesystem should set the
FileObject->FsContext, filters shouldn’t need to mess with that unless they
own the file object. By setting the FileObject->FsContext in your filter you
are effectively removing the filesystem’s context from the FILE_OBJECT and
the file system is well within its rights to bugcheck (I’m surprised you
don’t see that).

Thanks,
Alex.

3

Yep that’s what I thought. I did not actually write this code and it looked a little suspicious setting FSContext. We do not own the FileObject. It is passing through. The thing is, if in handling the create IRP that FltSupportsStreamHandleContexts method returns false then does that mean there is nothing one can do to use contexts on that FileObject? Just implement a hash? This is SQLServr.exe opening a .mdf data file for a database. Windows XP SP 3. Class Activity Monitor. Load order group FSFilter ACtivity Monitor, mini filter if any of that matters.

4

Which filesystem is this ? Support for stream contexts is a function of the
underlying file system.

You cannot use contexts in preCreate (since the file isn’t opened yet and
there is no way to know which stream it will actually open). The way
minifilters normally do this is to allocate and initialize the context in
preCreate, pass it to the postCreate callback via the Context parameter and
then in postCreate, if the create was successful, attach the context.

Thanks,
Alex.