Hello Ntfsd,
We have a legacy file system filter driver which has a per stream context
set ( through FSRTL*streamcontext api) to keep track of changes happening
on files, we are running into an odd situation where for some files on
which we have per stream context set dont get their teardown callbacks
invoked, in some cases it is invoked really late ~15-20 minutes after the
last irp_mj_close was seen on the file (files are regular files, no
patterns found yet).
We have ensured that file objects that were allocated for those files have
received their respective irp_mj_close. Also a clean shutdown doesnt
result in the callback getting invoked as well.
Is this expected? If not then let me know if someone has any pointers
around debugging it.
Platforms we are testing this on is windows 7 and xp as of now.
Regards,
Johri
Ping! any inputs will help.
Thanks!
On Thu, Nov 20, 2014 at 4:04 PM, Amritanshu wrote:
> Hello Ntfsd,
>
> We have a legacy file system filter driver which has a per stream context
> set ( through FSRTL*streamcontext api) to keep track of changes happening
> on files, we are running into an odd situation where for some files on
> which we have per stream context set dont get their teardown callbacks
> invoked, in some cases it is invoked really late ~15-20 minutes after the
> last irp_mj_close was seen on the file (files are regular files, no
> patterns found yet).
>
> We have ensured that file objects that were allocated for those files have
> received their respective irp_mj_close. Also a clean shutdown doesnt
> result in the callback getting invoked as well.
>
> Is this expected? If not then let me know if someone has any pointers
> around debugging it.
>
> Platforms we are testing this on is windows 7 and xp as of now.
>
> Regards,
> Johri
>
>
>
>
>