What happens to the requests issued by a process after its termiation?

NTFSD
1

Hi!
I wanted to know what happens to the outstanding IRPS of a process after its termination.
Are these IRPs processed or just cancelled?
What should i do if during the processing of an IRP in my mini filter, its requestor process gets terminated. Should i stop processing it and return a FLT_PREOP_SUCCESS_XXX or should i Cancel the request.
I have used the Cancel safe queue in my minifilter.
So i need not worry if the IRPs are cancelled when they r in the queue. But what if the process terminates while i am processing the CallbackData( in my case i am reading the file for which a write operation was issued ). Should i make a FltReadFile() call or simply skip the processing of the Callbackdata assuming that it will be cancelled by some lower driver?
Can i expect to see any IRPs( callbackdata) in my minifilter whose requestor process has terminated?

2

> I wanted to know what happens to the outstanding IRPS of a process after its

termination.

Process/thread cannot terminate till it has outstanding IRPs.

Are these IRPs processed or just cancelled?

They are tried to be cancelled during TerminateThread/Process.

What should i do if during the processing of an IRP in my mini filter, its
requestor
process gets terminated. Should i stop processing it and return a
FLT_PREOP_SUCCESS_XXX or should i Cancel the request.
I have used the Cancel safe queue in my minifilter.

Then the request will be cancelled automatically.

So i need not worry if the IRPs are cancelled when they r in the queue. But
what
if the process terminates while i am processing the CallbackData( in my case i
am reading the file for which a write operation was issued ).

Then the termination will be postponed till you will done with CallbackData.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

3

Thanks Maxim!
Just one more question…
If the application does not close the open handles to files before terminating, i could receive the CLEANUP and CLOSE IRPs in my mini-filter. Is my assumption correct?
The closing of all open handles is done as part of the termination procedure. So, is it done after the actual termination or before termination.

4

> If the application does not close the open handles to files before
terminating, i

could receive the CLEANUP and CLOSE IRPs in my mini-filter. Is my
assumption correct?

Handles are closed anyway on process death.

The closing of all open handles is done as part of the termination procedure.
So, is it done after the actual termination or before termination.

What is “actual termination”? :slight_smile:

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

5

By “Actual termination”, i mean the point in time when the PROCESS OBJECT is signalled.

You have mentioned that “Handles are closed anyway on process death.”. Will i see IRP_MJ_CLEANUP for the object in the context of the terminating process or in the system context?

Thanks!

6

> You have mentioned that “Handles are closed anyway on process death.”. Will i

see IRP_MJ_CLEANUP for the object in the context of the terminating process
or in the system context?

In the context of the last terminating thread of the terminating process.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com