How should I check the returned OldContext of FltSetStreamContext?

NTFSD
1

The WDK documentation describes FltSetStreamContext as follows:

“After calling FltSetStreamContext, the caller must call FltReleaseContext to decrement the reference count on NewContext, even if the call to FltSetStreamContext was unsuccessful. If the call was successful, or if FltSetStreamContext returned an error code (such as STATUS_FLT_CONTEXT_ALREADY_DEFINED), the caller must also call FltReleaseContext for OldContext if OldContext is not NULL and does not point to NULL_CONTEXT.”

What makes me confused is the last statement: “if OldContext is not NULL and does not point to NULL_CONTEXT.”

Given NULL_CONTEXT was defined as NULL, and OldContext was defined as PVOID, I have written code like this:

PFLT_CONTEXT old_ctx = 0;
FltSetStreamContext(…, &old_ctx);

if (old_ctx && *old_ctx != NULL_CONTEXT) // Oops! this line is illegal to compile!
{}

My question is:

How should I check the returned value of OldContext?

Any help will be highly appreciated! Thanks in advance.

2

Another weird case:

After calling FltSetStreamContext(…, &old_ctx);, and the returned old_ctx is not null. Yet the returned status is STATUS_SUCCESS rather than STATUS_FLT_CONTEXT_ALREADY_DEFINED as expected.

What’s the cause?

3

I’m sorry for my stupid error in my first posting. I misunderstood the documentation. I’ve got it now.

However, the question in my second posting is still unaswered, please help me. Thanks!

I repost the second problem as follows:

After calling FltSetStreamContext(…, &old_ctx);, and the returned old_ctx is
not null. Yet the returned status is STATUS_SUCCESS rather than
STATUS_FLT_CONTEXT_ALREADY_DEFINED as expected.

What’s the cause?

4

I also found the answer to the second post. Because I used FLT_SET_CONTEXT_REPLACE_IF_EXISTS as the third argument, so FltSetStreamContext returns STATUS_SUCCESS rather than STATUS_FLT_CONTEXT_ALREADY_DEFINED.

Thanks to all who viewed this post.