RE: why filespy detach after my filesystem filter - DeviceObject detach ?

I don’t want this to happen, as you can see I call the IoDeleteDevice()
not because the fsd IoDeleteDevice  get called , it means when ever I
delete  all the filters above me  get called and delete .
Is there any way like from my detech/delete routine to make a bound
between the deviceObcect below me(devobj->DevExt->filesystem/NextDevice)
and the one that is above me(devobj->AttachedDevice).( known that after
I’ll call IoDeleteDevice()those above me will also get called ).
forgive me if that’s doesn’t  sounds reasonable .
 

Tony Mason wrote:

When you call IoDeleteDevice, the I/O Manager notices that filespy is
attached to your device object and calls its fast I/O detach device entry
point.

This is exactly the same reason your detach device entry point is called
(when the FSD on which you are filtering deletes its own device object.)

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: Danny [mailto:xxxxx@neptune.co.il]
Sent: Wednesday, August 22, 2001 6:02 PM
To: File Systems Developers
Subject: [ntfsd] why filespy detach after my filesystem filter DeviceObject
detach ?

Hi  All,
 Could any one tell me why this is happening to me:
every time I ask filespy to filter the same partition which I am also
Attached to ,when I eventually detach/delete from it the
FilespyFastIoDetachDevice get Invoked by the system (see the call stack
and code below).
Thanks,
Daniel.

my dynamic unhook:

        MyDeviceExtension = MyDeviceObjectsL[Drive]->DeviceExtension;
        IoDetachDevice(My DeviceExtension->FileSystem );
        IoDeleteDevice( MyDeviceObjectsL[Drive] );
       MyDeviceObjectsL[Drive] = NULL;
    }
    return TRUE;
 

fileSpy code:

SpyFastIoDetachDevice(  IN PDEVICE_OBJECT SourceDevice,    IN
PDEVICE_OBJECT TargetDevice)
{
    PRECORD_LIST      recordList;
    BOOLEAN           shouldLog;
    PDEVICE_EXTENSION devext;

    PAGED_CODE();
 

  devext = SourceDevice->DeviceExtension;
    ASSERT(devext->Type == FILESPY_DEVICE_TYPE);

    ExAcquireFastMutex( &gSpyDeviceExtensionListLock );
    RemoveEntryList(&devext->NextDevice);       // remove from LOG list
    ExReleaseFastMutex( &gSpyDeviceExtensionListLock );
    …
    // Detach from the file system’s volume device object.

    IoDetachDevice( TargetDevice );
    IoDeleteDevice( SourceDevice );

}
call stack:
FramePtr  RetAddr   Param1   Param2   Param3   Function Name
f3206d2c  80114558  809a1e60 808f5260 808f5260
FILESPY!SpyFastIoDetachDevice (EBP)   [filespy.c @ 2080]
f3206d78  80111ee8  808f5260 00000000 f3f23650 NT!KeDetachProcess+0xa6
(FPO: [ebp f3206db0] [0,1,4])
f3206d8c  f3f21706  808f5260 808f5318 808f5260
NT!IoSetThreadHardErrorMode+0x1a (FPO: [1,0,1])
f3206db8  f3f225c9  00000000 80ad0cf0 f3f23650
MYFILTER!MyDetachDevice+0x80 (EBP)   [clearmp.c @  772]
f3206e0c  8016f29e  80a50aa8 00000001 00000000
MYFILTER!MyFfilterFastIoDeviceControl+0x138 (EBP) [clearmp.c @ 1385]
f3206ea0  80169a30  00000158 00000000 00000000
NT!IopCreateMadeupNode+0x1f0 (EBP)
f3206ed4  8013dde4  00000158 00000000 00000000
NT!BuildQueryDirectoryIrp+0x440 (EBP)
f3206f04  00000000  00000000 00000000 00000000
NT!V86CriticalInstruction+0x307 (No FPO)
 
 


You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: xxxxx@neptune.co.il
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com