return STATUS_PENDING in IRP_MJ_CLOSE dispatch routine

NTFSD
1

Returning STATUS_PENDING in IRP_MJ_CLOSE is illegal?

If I return STATUS_PENDING in the routine, what does I/O manager do?

2

> Returning STATUS_PENDING in IRP_MJ_CLOSE is illegal?

If I return STATUS_PENDING in the routine, what does I/O manager do?

In theory you can pend any operation, but it is likely that filters (or even
OS components) will make assumptions that things will always be synchronous
(you know the of code “if (NT_SUCCESS(IoCallDriver)) {”) and so oddness may
prevail.

What are you observing?

3

I am quit sure that IO manager will wait synchronously for completion, so thread will be blocked anyway in kernel mode. Also realize that status of IRP_MJ_CLOSE and (even) IRP_MJ_CLEANUP is not propagated into user mode Native or Win32 API (e.g NtClose(), CloseHandle() )

Bronislav Gabrhelik

4

>anyway in kernel mode. Also realize that status of IRP_MJ_CLOSE and (even) IRP_MJ_CLEANUP

I think they are not allowed to fail at all.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

5

I don’t think that anyone actually looks. The only status that the I/O
manager looks for with these IRPs is pending (and the I/O manager does wait
if pending is returned).

-scott

–
Scott Noone
Consulting Associate
OSR Open Systems Resources, Inc.
http://www.osronline.com

“Maxim S. Shatskih” wrote in message news:xxxxx@ntfsd…

anyway in kernel mode. Also realize that status of IRP_MJ_CLOSE and (even)
IRP_MJ_CLEANUP

I think they are not allowed to fail at all.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com