I’m writing a mini-filter that needs to grab the name of a file during a
rename operation. Since the PostOp could be called at IPC_DISPATCH I’m
using FltDoCompletionProcessingWhenSafe to get to a safe IRQL so I can get
the filename.
My question is, do I just return FLT_POSTOP_FINISHED_PROCESSING after having
called FltDoCompletionProcessingWhenSafe?
Please see the example code below:
FLT_POSTOP_CALLBACK_STATUS
AppPostOperationCallback (
IN OUT PFLT_CALLBACK_DATA Data,
IN PCFLT_RELATED_OBJECTS FltObjects,
IN PVOID CompletionContext,
IN FLT_POST_OPERATION_FLAGS Flags
)
{
switch(Data->Iopb->MajorFunction)
{
case IRP_MJ_SET_INFORMATION:
{
if(FileRenameInformation ==
Data->Iopb->Parameters.SetFileInformation.FileInformationClass)
{
//we need to make some calls that aren’t safe at
IRQL DISPATCH_LEVEL, and we might be at that level right now, so defer if
needed
if(KeGetCurrentIrql() >= DISPATCH_LEVEL)
{
FLT_POSTOP_CALLBACK_STATUS stat = 0;
FltDoCompletionProcessingWhenSafe(Data,
FltObjects, CompletionContext, Flags, AppPostOperationCallback, &stat);
//it either worked or it didn’t – can’t do
much about it either way, so ignoring return codes
}
else
{
//OK to proceed because now at APC_LEVEL or
lower
Call FltGetDestinationFileNameInformation,
etc …
}
}
}
break;
}
return FLT_POSTOP_FINISHED_PROCESSING; //is this correct even after
having called FltDoCompletionProcessingWhenSafe?
}
Thanks for any help.
Doug