ECP_LIST not being freed

NTFSD
1

Hi,

I have two minifilter drivers running, the lower one makes some virtualization using shadow file object technique.

When the lower has to redirect, it calls FltCreateFileEx2 and I send the ECP_LIST from current request, if any (obtained via FltGetEcpListFromCallbackData).

The problem is the following:

If upper driver creates an ECP_LIST and the lower driver pass the request down because it doesn’t do a redirection, the list is deleted by the system.

But if the lower driver calls FltCreateFileEx2, then I have a leak.

Should I create a cloned list or is there an API to tell FltMgr I’m reusing a list?

Regards,
Mauro.

2

I have always cloned the ECP list and passed it through via the
FltCreateFileEx2() API.

Pete

–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295

------ Original Message ------
From: xxxxx@mauroleggieri.com
To: “Windows File Systems Devs Interest List”
Sent: 3/15/2017 2:09:58 PM
Subject: [ntfsd] ECP_LIST not being freed

>Hi,
>
>I have two minifilter drivers running, the lower one makes some
>virtualization using shadow file object technique.
>
>When the lower has to redirect, it calls FltCreateFileEx2 and I send
>the ECP_LIST from current request, if any (obtained via
>FltGetEcpListFromCallbackData).
>
>The problem is the following:
>
>If upper driver creates an ECP_LIST and the lower driver pass the
>request down because it doesn’t do a redirection, the list is deleted
>by the system.
>
>But if the lower driver calls FltCreateFileEx2, then I have a leak.
>
>Should I create a cloned list or is there an API to tell FltMgr I’m
>reusing a list?
>
>Regards,
>Mauro.
>
>—
>NTFSD is sponsored by OSR
>
>
>MONTHLY seminars on crash dump analysis, WDF, Windows internals and
>software drivers!
>Details at http:
>
>To unsubscribe, visit the List Server section of OSR Online at
>http:</http:></http:>

3

Thanks Pete, straight to the point. :slight_smile:

4

Pete,

I have always cloned the ECP list and passed it through via the
FltCreateFileEx2() API.

Out of interest, clone the list and the contents or clone the list and
remove/copy the contents up and down?

Also a free tip for the OP you cannot use the FltXXXECP functions since they
don’t believe in a filter doing work on behalf of another one and will
bugcheck. I know Christian said he’d fix it but I’ guessing that hasn’t
made its way back to Win7.

5

Hi Rod, good question.

If I take FLT_CREATEFILE_TARGET_ECP_CONTEXT as an example, the caller will expect a result.

I think we should move the items from caller’s list to ours so the list is not freed and after the FltCreateFileEx2 call, move the items back to the original list.

If we clone, then we must copy back modified data.

Also not sure if it is normal for a driver to call FltCreateFileEx2 and expect a new ECP item on return.

Regards.