Multiple OPLOCK related questions

NTFSD
1

Hello All,

I would appreciate if someone could answer these questions related to oplocks:

  1. We have a filter which checks the contents of a file before
    allowing the IRP_MJ_CREATE to succeed. Now if we get a IRP_MJ_CREATE
    from Srv which has the FILE_COMPLETE_IF_OPLOCK field set, we cannot
    open the file and then read its contents in Create before deciding to
    deny or allow the file. In this case if we return
    STATUS_SHARING_VIOLATION from our filter, how will Srv behave?

  2. Assuming we don’t do option 1, I understand that we will have to
    let this create proceed and then at some point when we see a Success
    response to FSCTL_OPLOCK_BREAK_NOTIFY, we can open this file. However,
    by then it is too late to deny the original Create. How do people use
    this option in a filter driver which needs to deny creation/opening
    based on some policies?

  3. Modification to option 1: If we still go ahead and open the file in
    our create dispatch and only return STATUS_SHARING_VIOLATION when the
    create returns STATUS_OPLOCK_BREAK_IN_PROGRESS? In this case can we
    close the handle just create? MSDN (google “msdn IRP_MJ_CREATE”) seems
    to suggest that even a IRP_MJ_CLEANUP can cause a deadlock in case the
    flag FILE_COMPLETE_IF_OPLOCKED is set. Does it mean cleanup on the
    original fileobject or any fileobject of that stream?

I also want to understand the reason for the deadlock. So far I
understand that whenever Srv, initiates a IRP_MJ_CREATE with
FILE_COMPLETE_IF_OPLOCKED set, FSD (in our case NTFS) will immediately
complete the IRP with STATUS_OPLOCK_BREAK_IN_PROGRESS. In addition, it
will also queue an APC on this thread to initiate the oplock break.
However, if this thread enters a critical region before the APC gets
chance to execute, the oplock will not be broken. Also if we make a
call to the filesystem in such a state (i.e. without waiting for the
oplock to be broken), the filesystem would have disabled APC’s and
would also be waiting for the oplock break to complete and hence
deadlock. Is this understanding correct?

Thanks for any help.
Faras