Read file using original FILE_OBJECT

Hello all,

I’d like to create a simple minifilter which makes a file copy for further processing if it was written. I based the driver on msdn sample:
https://github.com/Microsoft/Windows-driver-samples/blob/master/filesys/miniFilter/scanner/filter/scanner.c

The logic is simple:

  1. If file was succesfully created I’m allocating the context (FLT_STREAMHANDLE_CONTEXT) in post IRP_MJ_CREATE
  2. Then in post IRP_MJ_WRITE I’m marking that file was written
  3. In pre IRP_MJ_CLEANUP I’m reading the file content using FILE_OBJECT I was given in FLT_RELATED_OBJECTS structure

Is it safe/fine to read the file using that FILE_OBJECT, in reference to potential locks/oplocks? I think it is as I’m using the same file object in the process context but I couldn’t find the confirmation.