如何在MjCreate中安全地关闭打开的fileobject?

osr上是这样说的：
IoCancelFileOpen is unsafe under any circumstances (the FAQ item should
be changed) - there\'s a front page www.osronline.com article about this
now. The alternative is to have your filter open its own reference to
the file (either a handle with the Zw* APIs through shadow DO\'s or a
file object created with IoCreateStreamFileObject* sent down on the
original IRP_MJ_CREATE IRP), post-process, then close the reference and
send down the original IRP with the original file object.


我下面的代码有没有问题，请大虾指点：
KeInitializeEvent();
IoCopyCurrentIrpStackLocationToNext();
IoSetCompletionRoutine();
IoCallDriver();
KeWaitForSingleObject();

PFILE_OBJECT streamFileObject = NULL;
try
{
streamFileObject = IoCreateStreamFileObject(IrpSp->FileObject, NULL);
}
except (STATUS_INSUFFICIENT_RESOURCES)
{
Irp->IoStatus.Status = STATUS_INSUFFICIENT_RESOURCES;
Irp->IoStatus.Information = 0;
IoCompleteRequest(Irp, IO_NO_INCREMENT);
return Irp->IoStatus.Status;
}

if (streamFileObject)
{
ObDereferenceObject(streamFileObject);
}

Irp->IoStatus.Status = STATUS_ACCESS_DENIED;
Irp->IoStatus.Information = 0;
IoCompleteRequest(Irp, IO_NO_INCREMENT);
return Irp->IoStatus.Status;

http://www.osronline.com/article.cfm?id=219

打不开，:(

感谢 wowocock ！正在消化中...

继续请教： :D
DDK 中说:
File system filter driver writers should note that IoCreateStreamFileObject causes an IRP_MJ_CLEANUP request to be sent to the file system driver stack for the volume.

请问IRP_MJ_CLEANUP是何时发出的，在IoCreateStreamFileObject中发出，还是后面调用ObDereferenceObject时发出??