none
Question on function FsRtlNotifyFullChangeDirectory ?_ RRS feed

  • Question

  • What happens if i use this function FsRtlNotifyFullChangeDirectory 'in IRP_MN_NOTIFY_CHANGE_DIRECTORY'

    but never use the function FsRtlNotifyCleanup ?

    If i use the function FsRtlNotifyFullReportChange but we never use the function FsRtlNotifyCleanup, can i have BSOD ?

    Thank

    Saturday, July 28, 2018 10:16 AM

Answers

  • Sooner or later the memory leak will cause problems.  Asking whether it will BSOD is one of those impossible questions, a lot of things that did not BSOD in earlier revisions do now as more checks are applied, also driver verifier may catch it now or in the future.   The right answer here is to code the driver so that you cleanup at a reasonable point before the file object goes away.


    Don Burn Windows Driver Consulting Website: http://www.windrvr.com

    Tuesday, July 31, 2018 10:18 AM
  • THERE IS NO DEFINITIVE ANSWER ON "WILL THIS EVER IN THE FUTURE CREATE A BSOD!!!!"    Kernel programming is a skill and part of that skill is doing everything you can to make sure you are not in a situation where you have to ask "This is a little questionable, but I think I can get away with it".   If you have to ask that question, you are doing things wrong.


    Don Burn Windows Driver Consulting Website: http://www.windrvr.com

    Tuesday, July 31, 2018 2:06 PM

All replies

  • If you don't use FsRtlNotifyCleanup at some point you have a memory leak, since FsRtlNotifyFullReportChange creates the structure, but you are not deleting it.


    Don Burn Windows Driver Consulting Website: http://www.windrvr.com

    Monday, July 30, 2018 4:09 PM
  • Yes i have a memory leak it's logic,

    but can i have a BSOD ?

    lien for post

    Thank.

    Monday, July 30, 2018 6:16 PM
  • Sooner or later the memory leak will cause problems.  Asking whether it will BSOD is one of those impossible questions, a lot of things that did not BSOD in earlier revisions do now as more checks are applied, also driver verifier may catch it now or in the future.   The right answer here is to code the driver so that you cleanup at a reasonable point before the file object goes away.


    Don Burn Windows Driver Consulting Website: http://www.windrvr.com

    Tuesday, July 31, 2018 10:18 AM
  • Now i use correctly FsRtlNotifyCleanup  and FsRtlNotifyFullReportChange ,

    and I am unable to know if this BSOD will reproduce  on function FsRtlNotifyFullReportChange .

    Tuesday, July 31, 2018 2:03 PM
  • THERE IS NO DEFINITIVE ANSWER ON "WILL THIS EVER IN THE FUTURE CREATE A BSOD!!!!"    Kernel programming is a skill and part of that skill is doing everything you can to make sure you are not in a situation where you have to ask "This is a little questionable, but I think I can get away with it".   If you have to ask that question, you are doing things wrong.


    Don Burn Windows Driver Consulting Website: http://www.windrvr.com

    Tuesday, July 31, 2018 2:06 PM