Hi,
In my filter driver I filter files in some directory to supply their data from a remote server. For each IRP_MJ_CREATE (that is not marked with SL_OPEN_TARGET_DIRECTORY) for any files/directories under the filtered directory I created my own file object descriptor (for relative IRP_MJ_CREATE), which is my structure corresponding to the PFILE_OBJECT and a virtual file object, which is my structure corresponding to the FCB of the PFILE_OBJECT. On IRP_MJ_CLOSE I look for my own file object descriptor, remove it from my file object descriptor table, checks to see if it is the last IRP_MJ_CLOSE for this file and if so remove the FCB of the FILE_OBJECT from my FCB table (basically the same scheme described in one of the NT Insider articles).
I have a problem with rename (IRP_MJ_SET_INFORMATION/FileRenameInformation) on XP. For the files that were renamed by the application I get some leftovers in my file descriptor table and in my FCB table. I added some printouts to follow my entire file object descriptors creation and destruction and I see that at one point, before the actual IRP_MJ_SET_INFORMATION for the file, I receive an IRP_MJ_CREATE with some PFILE_OBJECT for which I create my file object descriptor but for which I don’t see any IRP_MJ_CLOSE. At the end of the rename operation using WinDbg, I looked at the address of the PFILE_OBJECT that I received during that IRP_MJ_CREATE and I could see that it isn’t valid FILE_OBJECT, but I didn’t receive any IRP_MJ_CLOSE with that PFILE_OBJECT.
The same code works fine on 2K and NT. Can anybody give me some hints of what I should be looking for in my code? As mentioned above, my reference count scheme is similar to the one described in one of the NT Insider articles and maybe there are some “special measurements” one should take in this scheme for rename operations? If you want to see some code snippets just write to me and I’ll send it to you.
Thanks for your help,
Gilad Ben-Zeev