When to release an entry refering to a PFILE_OBJECT ?

NTFSD
1

Sorry for the inappropriate title. My question is very simple actually.

My driver filters files (no kiddin’!). For this I have a driver
allocated structure that keeps the PFILTER_OBJECT of the filtered files
(a linked list if you’re curious). Nothing unusual. I add the entry when
I get an IRP_MJ_CREATE for the file(s) I’m interested in, and remove it
in IRP_MJ_CLOSE.

However, sometimes, in IRP_MJ_READ (or another MJ), I get handles to
files created by the system with the same FSB than the files filtered.
So I add these files to my structure as well because there’s no reason
why I wouldn’t want to filter these access.

My question is simple, when is it safe to release the entry in my linked
list ? I don’t get the IRP_MJ_CLOSE for the file. Or perhaps my method
is incorrect ?

Thanks!

–

EA

2

Edouard A. wrote:

Sorry for the inappropriate title. My question is very simple actually.

My driver filters files (no kiddin’!). For this I have a driver
allocated structure that keeps the PFILTER_OBJECT of the filtered files
(a linked list if you’re curious). Nothing unusual. I add the entry when
I get an IRP_MJ_CREATE for the file(s) I’m interested in, and remove it
in IRP_MJ_CLOSE.

However, sometimes, in IRP_MJ_READ (or another MJ), I get handles to
files created by the system with the same FSB than the files filtered.
So I add these files to my structure as well because there’s no reason
why I wouldn’t want to filter these access.

I meant FCB, File Control Block, I was thinking about Front Side Bus,
sorry. :wink:

–

EA

3

> My question is simple, when is it safe to release the entry in my linked

list ? I don’t get the IRP_MJ_CLOSE for the file. Or perhaps my method
is incorrect ?

From what you say, you might want to look at Stream Contexts - then you can
be called when the FCB goes away.