Vista's FltMgr deletes the device with IRPs on it


I have found a strange issue, which is possibly the FltMgr’s issue.

I have a legacy FS filter driver, FltMgr below it and then the FSD.

The volume is on the USB drive. The issue occurs after surprise removal
of this drive.

The issue is - my filter counts and keeps track of the IRPs sent down. It
creates some state for each IRP sent down to the target device object, and then
destroys this state in the completion routine.

The issue is that when my filter’s FastIoDetachDevice is called, this IRP
state shows that there are 5 IRPs inside the stack below.

FastIoDetachDevice is called by FltMgr’s IoDeleteDevice on its FiDO. The
FSD’s DO is gone at this moment, it does not exist, nothing is attached at this
moment below FltMgr’s FiDo. The FltMgr’s FiDo itself is in the

The disk volume stack is also destroyed at this moment.

So, FltMgr seems to call IoDeleteDevice on its FiDO - thus triggering a
call to FastIoDetachDevice in the legacy filter above FltMgr - when there are
some IRPs sent to this FltMgr’s FiDO and not completed yet
. This is very bad
for my filter.

I remember that some similar FltMgr’s issue was discussed on this list
around half a year ago - something related to worker threads?

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation