如何在微筛选器驱动程序中挂起IRP

Question

iam正在尝试取消IRP相关创建，这是我的预创建相关代码。目前它正在阻止IRP，我想通过将其置于挂起状态来取消IRP我不想实现取消安全IRP队列，因为我要取消的IRP很少比如说一两个如何取消IRP？，plz帮助

我的代码

FltLockUserBuffer(Data);
FltWorkItem = FltAllocateDeferredIoWorkItem();
if (FltWorkItem != NULL)
{
if (NT_SUCCESS(FltQueueDeferredIoWorkItem(FltWorkItem, Data, WorkItemCallback, DelayedWorkQueue, NULL)))
return FLT_PREOP_PENDING;
}

//Callback that notify when is file is accessed
VOID WorkItemCallback(IN PFLT_DEFERRED_IO_WORKITEM  FltWorkItem,
IN PFLT_CALLBACK_DATA  Data,
IN PVOID  Context)
{
UNICODE_STRING  UniFilePathName = { 0 };
UNICODE_STRING  UniParentFileName = { 0 };
ULONG           replyLength;
NTSTATUS        status;
FLT_PREOP_CALLBACK_STATUS       Result = FLT_PREOP_SUCCESS_WITH_CALLBACK;
DWORD                           SafeToOpen = 1;

__try
{
// Extract file name Information        
if (!NT_SUCCESS(GetFileName(Data, &UniFilePathName, &UniParentFileName)))
{
__leave;
}

//communicate with service
SafeToOpen = SendFileInfo(UniFilePathName);
if (!SafeToOpen)
{   
// ACCESS DENIED
Data->IoStatus.Status = STATUS_ACCESS_DENIED;               
Data->IoStatus.Information = 0;             
Result = FLT_PREOP_COMPLETE;
__leave;
}
}
__finally
{

FltCompletePendedPreOperation(Data, Result, Context);
FltFreeDeferredIoWorkItem(FltWorkItem);
}
}

Answer 1

使用FltDoCompletionProcessingWhenSafe函数，而不是FltQueueDeferredIoWorkItem。