Re: MjCreate() and healthy way to abort it after it has b een processed.

IoCancelFileOpen is unsafe under any circumstances (the FAQ item should
be changed) - there’s a front page article about this
now. The alternative is to have your filter open its own reference to
the file (either a handle with the Zw* APIs through shadow DO’s or a
file object created with IoCreateStreamFileObject* sent down on the
original IRP_MJ_CREATE IRP), post-process, then close the reference and
send down the original IRP with the original file object.

Primoz Beltram wrote:

“Q6 What’s the right way to cancel a CREATE request in my filter driver?” on FAQs.
WBR Primoz

-----Original Message-----
From: lallous []
Sent: Monday, November 10, 2003 2:59 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] MjCreate() and healthy way to abort it after it has been


In the FS filter driver and on IrpMjCreate() I pass down then do post
processing. In case I want to close the file after the post processing what
is the healthy way to do that?

Do I allocate a new IRP and set a IRP_MJ_CLOSE then IoCallDriver() then
return status=STATUS_ACCESS_DENIED in the IrpMjCreate() dispatch routine?


You are currently subscribed to ntfsd as: To
unsubscribe send a blank email to

Nick Ryan (MVP for DDK)