minifilter - 如何在微过滤器驱动程序中挂起 IRP？

Question

我正在尝试取消与创建相关的 IRP，这是我与 PreCreate 相关的代码。
目前它正在阻止 IRP，我想通过将其置于 Pending 状态来取消 IRP
我不想实现取消安全 IRP 队列，因为我只有很少的 IRP 可以取消
说一两个我怎样才能取消 IRP？，请帮忙

我的代码

FltLockUserBuffer(Data);

        FltWorkItem = FltAllocateDeferredIoWorkItem();

        if (FltWorkItem != NULL)
        {

            if (NT_SUCCESS(FltQueueDeferredIoWorkItem(FltWorkItem, Data, WorkItemCallback, DelayedWorkQueue, NULL)))
                return FLT_PREOP_PENDING;

        }



//Callback that notify when is file is accessed
VOID WorkItemCallback(IN PFLT_DEFERRED_IO_WORKITEM  FltWorkItem,
    IN PFLT_CALLBACK_DATA  Data,
    IN PVOID  Context)
{
    UNICODE_STRING  UniFilePathName = { 0 };
    UNICODE_STRING  UniParentFileName = { 0 };
    ULONG           replyLength;
    NTSTATUS        status;

    FLT_PREOP_CALLBACK_STATUS       Result = FLT_PREOP_SUCCESS_WITH_CALLBACK;
    DWORD                           SafeToOpen = 1;



    __try
    {

        // Extract file name Information        
        if (!NT_SUCCESS(GetFileName(Data, &UniFilePathName, &UniParentFileName)))
        {
            __leave;
        }


        //communicate with service
        SafeToOpen = SendFileInfo(UniFilePathName);

        if (!SafeToOpen)
        {   

                // ACCESS DENIED
                Data->IoStatus.Status = STATUS_ACCESS_DENIED;               
                Data->IoStatus.Information = 0;             
                Result = FLT_PREOP_COMPLETE;
                __leave;

        }
    }
    __finally
    {


        FltCompletePendedPreOperation(Data, Result, Context);
        FltFreeDeferredIoWorkItem(FltWorkItem);
    }

}

Answer 1

使用 FltDoCompletionProcessingWhenSafe 函数代替 FltQueueDeferredIoWorkItem。