No IRP_MJ_CLOSE after transaction commit or rollback

NTFSD
1

Has anyone ever seen this scenario before?

CreateTransaction
CreateFileTransacted
WriteFile
CommitTransaction

CloseHandle

Then no IRP_MJ_CLOSE is seen or even a context tear-down callback. A read/write breakpoint on the FO’s handle and pointer counts involved in the write reveals that the file object just disappears. There is never a break when the handle or pointer count reaches zero. The files involved in the above transaction is created on disk. This is on Server 2008.

The same thing happens with a rollback.

My minifilter is enlisting in transactions.

No problem in this case:

CreateTransaction
CreateFileTransacted
WriteFile
CloseHandle
CommitTransaction

Am I missing something here?

Any comments would be appreciated.

2

> Then no IRP_MJ_CLOSE is seen or even a context tear-down callback.

CloseHandle can be delayed a lot since Cc and Mm can hold the references to the FO, and they can last for a very long time till Cc’s scavenger will destroy the unused cache map (they live for a very long time).

So, this is OK. Try to trigger the volume remount - this should fire all MJ_CLOSE paths.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com