I have a driver that allocates a log buffer in the pre operation callback and deallocate it during the post operation callback.
It sems that some pre operation callback do not match the post operation callback; this is causing my driver to leak buffers allocated during the pre callback operation.
I checked my code and I do return FLT_PREOP_SUCCESS_WITH_CALLBACK in the pre operation callback, so I don’t think this is an issue with my driver.
I trace the missing post operation callback to a call: major=IRP_MJ_FILE_SYSTEM_CONTROL, FSCTL_OPLOCK_BREAK_ACKNOWLEDGE, it seems that I get the pre operation callback but not the post operation callback. I am for now filtering the OPLOCK calls in the pre operation callback but I would like to know if this is a known issue or something I am doing wrong.
It’s not that you’re missing it, just that some operations can pend for a long/non-deterministic amount of time.