在SfCreate中,发现 FileCtxPtr->FsContext 做为关键项进行RtlLookupElementGenericTable查找帮定有问题?

经过跟踪后发现,在RtlLookupElementGenericTable查找中,同一个文件怎么会对应两个FileCtxPtr->FsContext ,当然通过它去查出来也找到了两个 FileCtxPtr2 ?

SfCreate()
{
                    .......

                     FileCtxPtr->FsContext = FileObject->FsContext;
    ExAcquireFastMutex(&DevExt->FsCtxTableMutex);
    FileCtxPtr2 = RtlLookupElementGenericTable(&DevExt->FsCtxTable, FileCtxPtr);
    if (FileCtxPtr2)
    {
        ++FileCtxPtr2->RefCount;
    }
    else
    {

        FileCtxPtr2 = RtlInsertElementGenericTable(
                    &DevExt->FsCtxTable,
                    FileCtxPtr,
                    sizeof(FILE_CONTEXT),
                    &NewElement
                    );
                
        FileCtxPtr2->RefCount = 1;
        
                       }
                      ExReleaseFastMutex(&DevExt->FsCtxTableMutex);

                     .......

}
 
这样就会碰到和文件帮定的标记量错位的情况了.
如何才能防止在这张表中,作到里面存的记录和文件是一一对应的?

You need to know the difference between FileObject and FsContext. Here is description from IFS document:

-----------------------------------------
When a file system opens a file stream for the first time, it creates a file-system-specific stream context structure, such as a file control block (FCB) or stream control block (SCB), and stores the address of this structure in the FsContext member of the resulting file object.

For local file systems, if the already opened file stream is opened again (for shared read access, for example), the I/O subsystem creates another file object, but the file system does not create a new stream context. Both file objects receive the address of the same stream context structure. Thus, for local file systems, the stream context pointer uniquely identifies a file stream.
-----------------------------------------

And there's a bug in your code, ExReleaseFastMutex() should be called outside else{}.

谢谢 michaelgz  对我问题的回答.
在你给出的回答中,是说一个文件被打开之后,无论创建多少个fileobject都只会有一个FsContext.但是我现在发现的是,在GenericTable中竟然会同时存在两个不同的FsContext 指向一个 文件(比如 D:\test\aa.txt).


SfClose()
{
......
if ((0 == FileCtxPtr->RefCount) &&
    (!FileObject->SectionObjectPointer ||
    (!FileObject->SectionObjectPointer->DataSectionObject &&
    !FileObject->SectionObjectPointer->ImageSectionObject)))
    {

    RtlDeleteElementGenericTable(&DevExt->FsCtxTable, &FileCtxHdr);
    }
......
}
因为删除这个表中的记录是在sfclose中调用 RtlDeleteElementGenericTable 这个函数删除的.因为调用这个删除函数需要满足一定的条件才能执行的,否则即使当FileCtxPtr2->RefCount = 0了,还是没有能把东西删掉,是否会发生我说的这种情况?

如果有一个新的FsContext 创建了,则如果以前有一个旧的FsContext ,操作系统似乎不会把旧的FsContext 作废了.所以造成了可以同时存在2个不同的FsContext 都是活的指向同一个文件的,请问我的这种现象应该如何解决?

Then your reference counting mechanism is flawed. Have a look at OSR's article "Tracking State and Context - Reference Counting for File System Filter Drivers"

再次感谢 michaelgz !
你这里有这片文章吗,能否先发上来我看看.
我正在OSR中注册身份.