How to pend IRP in minifilter driver?

Viewed 220

iam trying to Cancel IRP Related to create, Here is my code related to PreCreate. Currently it is blocking IRP, i want to cancel IRP by puting it in Pending state i did not want to implement Cancel-Safe IRP Queues because i have very few IRP to cancel say one or two how can i cancel IRP ?, plz help

my code

FltLockUserBuffer(Data);

        FltWorkItem = FltAllocateDeferredIoWorkItem();

        if (FltWorkItem != NULL)
        {

            if (NT_SUCCESS(FltQueueDeferredIoWorkItem(FltWorkItem, Data, WorkItemCallback, DelayedWorkQueue, NULL)))
                return FLT_PREOP_PENDING;

        }



//Callback that notify when is file is accessed
VOID WorkItemCallback(IN PFLT_DEFERRED_IO_WORKITEM  FltWorkItem,
    IN PFLT_CALLBACK_DATA  Data,
    IN PVOID  Context)
{
    UNICODE_STRING  UniFilePathName = { 0 };
    UNICODE_STRING  UniParentFileName = { 0 };
    ULONG           replyLength;
    NTSTATUS        status;

    FLT_PREOP_CALLBACK_STATUS       Result = FLT_PREOP_SUCCESS_WITH_CALLBACK;
    DWORD                           SafeToOpen = 1;



    __try
    {

        // Extract file name Information        
        if (!NT_SUCCESS(GetFileName(Data, &UniFilePathName, &UniParentFileName)))
        {
            __leave;
        }


        //communicate with service
        SafeToOpen = SendFileInfo(UniFilePathName);

        if (!SafeToOpen)
        {   

                // ACCESS DENIED
                Data->IoStatus.Status = STATUS_ACCESS_DENIED;               
                Data->IoStatus.Information = 0;             
                Result = FLT_PREOP_COMPLETE;
                __leave;

        }
    }
    __finally
    {


        FltCompletePendedPreOperation(Data, Result, Context);
        FltFreeDeferredIoWorkItem(FltWorkItem);
    }

}
1 Answers

Use FltDoCompletionProcessingWhenSafe functions instead of FltQueueDeferredIoWorkItem.

Related