Stream handle context post close

NTFSD
1

Hey, I’m doing the following

  1. Post Create - allocate and set stream handle context
  2. Post Close - get , if successful release twice

The issue is the get fails and the minifilter hangs since reference from allocate was not released

It fails with status not supported , I’ve read the docs and apparently ntfs and fat do not support contexts for paging I/O in pre create and post close

Is there a way I can check if the operation if a paging I/o operation in my post create? My Thought is not allocating the context in such case , so refcount is 0 even if get fails in post close which is fine

Is FlagOn(Data->Iopb->IrpFlags,IRP_PAGING_IO) sufficient ?

Edit : not supported at all in post close ():

2

I must admit that I wouldn’t do anything like that post close. I’d grab the context in pre and pass it across to the post call if I needed it, then release in the post call?

When you say paging io do you mean paging file? (A paging create makes no sense) if so then FsRtlIsPagingFile is your friend,

1 Like
3

Passing it from pre to post close indeed makes more sense , thanks