FltSendMessage and STATUS_THREAD_IS_TERMINATING

NTFSD
1

Hi,

FltSendMessage can fail with STATUS_THREAD_IS_TERMINATING error if the
thread in whose context is running is being terminated. This behavior was
introduced in Vista, where FltSendMessage uses
FsRtlCancellableWaitForMultipleObjects (waiting for two unknown objects).

I have actually four questions:

  1. Is this just a concidence that I always got this error only on Win7 x64
    and never on Win7 x86?

  2. I get this error only if I kill the application with ZwTerminateProcess
    (EPROCESS.ProcessSelfDelete is 0), if it’s closed normally (using Close
    button, EPROCESS.ProcessSelfDelete is 1) then FltSendMessage doesn’t fail.
    Callstack is same for both calls.

  3. After I got STATUS_THREAD_IS_TERMINATING error, I called FltSendMessage
    again and now the message was delivered to user-mode, the second call is
    always successful. Why?

  4. I use “async” FltSendMessage call, I don’t use ReplyBuffer/ReplyLength
    and Timeout. Is there any reason to return here such error? Probably yes,
    because async calls are not supported.

Thanks,

Petr