Why my minifilter program cannot clear the cache when I enable verifier?

NTFSD
1

Hi everyone, may I ask why my minifilter program cannot clear the cache when I enable verifier? And when I didn't turn on the verifier, I was able to clear the cache normally。thanks!
this is my code:

NTSTATUS FlushAndPurgeCache(
	IN PFLT_INSTANCE Instance,
	IN PFILE_OBJECT FileObject)
{
	if (NULL == Instance)
	{
		return STATUS_INVALID_PARAMETER;
	}

	if (NULL == FileObject)
	{
		return STATUS_INVALID_PARAMETER;
	}

	NTSTATUS Status = STATUS_UNSUCCESSFUL;

	PFLT_CALLBACK_DATA Data = NULL;

	Status = FltAllocateCallbackData(Instance, FileObject, &Data);

	if (STATUS_SUCCESS != Status)
	{
		return Status;
	}

	Data->Iopb->MajorFunction = IRP_MJ_FLUSH_BUFFERS;
	Data->Iopb->MinorFunction = IRP_MN_FLUSH_AND_PURGE;
	Data->Iopb->IrpFlags = IRP_SYNCHRONOUS_API;


	FltPerformSynchronousIo(Data);

	FltFreeCallbackData(Data);

	return Data->IoStatus.Status;
}
2

UR freeing the callback data and then using it to return a value. Most likely Verifier always catches it, otherwise it rarely is seen but might give you wrong memory reads

1 Like
3

Thanks ! Dejan. I can not understand your says 'UR',what is 'UR'?

4

UR = You are. Now I feel young, thanks :slight_smile:

3 Likes