如何在微过滤器驱动中挂起IRP？

Question

我正在尝试取消与创建相关的IRP，这是我的与PreCreate相关的代码。当前正在阻止IRP，我想通过将其置于挂起状态来取消IRP我不想实现取消安全的IRP队列，因为我只有很少的IRP可以取消比如说一两个，我如何才能取消IRP ?，请帮助

我的代码

FltLockUserBuffer(Data);

        FltWorkItem = FltAllocateDeferredIoWorkItem();

        if (FltWorkItem != NULL)
        {

            if (NT_SUCCESS(FltQueueDeferredIoWorkItem(FltWorkItem, Data, WorkItemCallback, DelayedWorkQueue, NULL)))
                return FLT_PREOP_PENDING;

        }



//Callback that notify when is file is accessed
VOID WorkItemCallback(IN PFLT_DEFERRED_IO_WORKITEM  FltWorkItem,
    IN PFLT_CALLBACK_DATA  Data,
    IN PVOID  Context)
{
    UNICODE_STRING  UniFilePathName = { 0 };
    UNICODE_STRING  UniParentFileName = { 0 };
    ULONG           replyLength;
    NTSTATUS        status;

    FLT_PREOP_CALLBACK_STATUS       Result = FLT_PREOP_SUCCESS_WITH_CALLBACK;
    DWORD                           SafeToOpen = 1;



    __try
    {

        // Extract file name Information        
        if (!NT_SUCCESS(GetFileName(Data, &UniFilePathName, &UniParentFileName)))
        {
            __leave;
        }


        //communicate with service
        SafeToOpen = SendFileInfo(UniFilePathName);

        if (!SafeToOpen)
        {   

                // ACCESS DENIED
                Data->IoStatus.Status = STATUS_ACCESS_DENIED;               
                Data->IoStatus.Information = 0;             
                Result = FLT_PREOP_COMPLETE;
                __leave;

        }
    }
    __finally
    {


        FltCompletePendedPreOperation(Data, Result, Context);
        FltFreeDeferredIoWorkItem(FltWorkItem);
    }

}

Answer 1

使用FltDoCompletionProcessingWhenSafe函数而不是FltQueueDeferredIoWorkItem。