tracking file state

NTFSD
1

Hi, I know that I already asked how to track file state, I’ve read the
article on OSR, but still I can’t understand how to use stream file
object, currently to track the file I’m saving the FILE_OBJECT pointer
in a structure, when the file is opened for the first time, I add its
pointer to a linked list and I increment its reference count (in
IRP_MJ_CREATE), and I decrement the reference count in IRP_MJ_CLEANUP.
Then if I get an IRP_MJ_CREATE with the same file object, I just
increment its reference count, this works fine, but sometimes (well,
almost everytime on local path, never on network path), I get two
IRP_MJ_WRITE, when I should get only one, I think this is related to the
fact that I can get two distinct file object for a single file, but I
don’t know how to solve this, stream file object may help?

Thanks.

Lorenzo

2

Couple of things. Its IRP_MJ_CLOSE which flags the end of the life of the
FILE_OBJECT as I understand. Also, for stream file objects a la
IoCreateStreamFileObjectLite anyway, you do not see IRP_MJ_CREATE. I
refernce count on the FCB - FileObject->FsContext - as suggested in the
osr article.

3

are you sure you are getting a second IRP_MJ_CREATE for a file object
already in your list? if that is so, it means somewhere your tracking is not
done correctly. there should only be at most one IRP_MJ_CREATE for a file
object.

Ampsi

----- Original Message -----
From: “Lorenzo”
Newsgroups: ntfsd
To: “Windows File Systems Devs Interest List”
Sent: Friday, December 10, 2004 16:20
Subject: [ntfsd] tracking file state

Hi, I know that I already asked how to track file state, I’ve read the
article on OSR, but still I can’t understand how to use stream file
object, currently to track the file I’m saving the FILE_OBJECT pointer
in a structure, when the file is opened for the first time, I add its
pointer to a linked list and I increment its reference count (in
IRP_MJ_CREATE), and I decrement the reference count in IRP_MJ_CLEANUP.
Then if I get an IRP_MJ_CREATE with the same file object, I just
increment its reference count, this works fine, but sometimes (well,
almost everytime on local path, never on network path), I get two
IRP_MJ_WRITE, when I should get only one, I think this is related to the
fact that I can get two distinct file object for a single file, but I
don’t know how to solve this, stream file object may help?

Thanks.

Lorenzo

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@hotmail.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

> are you sure you are getting a second IRP_MJ_CREATE for a file object

already in your list? if that is so, it means somewhere your tracking is not
done correctly. there should only be at most one IRP_MJ_CREATE for a file
object.

Of course, if you had IRP_MJ_CLOSE for that FILE_OBJECT, then memory at
the same address can soon after that be used to store a FILE_OBJECT and
can appear in another IRP_MJ_CREATE.

5

The first IRP_MJ_WRITE IRP may be cached write request from user-mode
application, while the second one may be paging write from VMM.

-htfv

“Lorenzo” wrote in message news:xxxxx@ntfsd…
>
> Hi, I know that I already asked how to track file state, I’ve read the
> article on OSR, but still I can’t understand how to use stream file
> object, currently to track the file I’m saving the FILE_OBJECT pointer
> in a structure, when the file is opened for the first time, I add its
> pointer to a linked list and I increment its reference count (in
> IRP_MJ_CREATE), and I decrement the reference count in IRP_MJ_CLEANUP.
> Then if I get an IRP_MJ_CREATE with the same file object, I just
> increment its reference count, this works fine, but sometimes (well,
> almost everytime on local path, never on network path), I get two
> IRP_MJ_WRITE, when I should get only one, I think this is related to the
> fact that I can get two distinct file object for a single file, but I
> don’t know how to solve this, stream file object may help?
>
> Thanks.
>
> Lorenzo
>
>
>