Tracking - question

NTFSD
1

http://www.osr.com/ntinsider/2002/tracking/tracking.htm

[A] “For each IRP_MJ_CLOSE the filter driver decrements the reference count
on the per-file context structure if the FO_STREAM_FILE bit is not set for
the file object.”

[B] The document previously noted that if my driver encountered an I/O with
stream file object that is is not in list thus I add reference to FsContext.

Now how will the reference decrement if [A] disallow reference decrementing
for case [B] ?

Regards,
Elias

2

The files with the FO_STREAM_FILE will not AddRef your your FsContext.
You will have a sublist of FILE_OBJECTs, and add this FILE_OBJECT to the
list.

“… a reference count (for file objects seen via the IRP_MJ_CREATE
mechanism) and an explicit list … of stream file objects seen by the
filter. On each I/O operation, the filter examines the FO_STREAM_FILE
Flag. If this bit is set, the filter verifies that the file object is
in its list ? if not, it allocates the necessary storage for its
tracking information and ***inserts it into its list***”

“Then, when it observes an IRP_MJ_CLOSE operation, it will **either**
decrement the reference count ***or remove it from the list***”

IRP_MJ_CREATE

  • RefCount++

IRP_MJ_CLOSE

  • FILE_OBJECT in list?
    o Yes: Remove from list
    o No: decrement the reference count
  • FILE_OBJECT list empty and RefCount == 0?
    o Yes: Delete the file (FsContext) reference

IRP_MJ_* (I/O)

  • Flag FO_STREAM_FILE?
    o Yes: FsContext in the list?
    ? Yes: FILE_OBJECT in the FsContext sublist?
    ? No: Insert FILE_OBJECT in the sublist

I ask the more experienced folks to say if my interpretation is correct
:-).

Strauss

lallous wrote:

http://www.osr.com/ntinsider/2002/tracking/tracking.htm

[A] “For each IRP_MJ_CLOSE the filter driver decrements the reference count
on the per-file context structure if the FO_STREAM_FILE bit is not set for
the file object.”

[B] The document previously noted that if my driver encountered an I/O with
stream file object that is is not in list thus I add reference to FsContext.

Now how will the reference decrement if [A] disallow reference decrementing
for case [B] ?

Regards,
Elias

Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@scua.com.br
To unsubscribe send a blank email to xxxxx@lists.osr.com