RE: problems with late/pending processing of IRP_MN_QUERY_DIRECTORY

You are certainly not getting the directory IRP at IRQL 2 - you must be
raising the IRQL yourself!
Can you post all the code of the dispatch routine?

Nir Livni wrote:

I am not setting any completion in my filter driver.
When I get the IRP, I mark it as pending, and sending it to a UserMode
process to handle.
When I get the response from the UserMode - I complete the IRP.

Before I pend the IRP - I try to ProbeAndLock, and then I see I’m actually
running in KIRQL=2 which is DISPATCH.

Actually, I pend all the IRP’s I get and send them to the UserMode process.

But I could not yet understand why I get the IRP when KIRQL=2.


Kind regards, Dejan M. www.alfasp.com
E-mail: xxxxx@alfasp.com ICQ#: 56570367
Alfa File Monitor - File monitoring library for Win32 developers.
Alfa File Protector - File protection and hiding library for Win32 developers.

Yep, such things CAN happen:-) Use ERESOURCE objects unless you need your
data synchronized in the completion routines.
They provides single writer multiple reader acquisition, which is very
important and useful for FSFs.

Nir Livni wrote:

Well!
You certainly focused me on what could be the problem.
I found an AcquireSpinLock just before the QueryDir handling…


Kind regards, Dejan M. www.alfasp.com
E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32 developers.
Alfa File Monitor - File monitoring library for Win32 developers.