IRP_MJ_CLOSE (FS and filter drivers)
When Sent
The I/O Manager sends an IRP_MJ_CLOSE request to indicate that the reference count on a file object has reached zero, usually because a file system driver or other kernel-mode component has called ObDereferenceObject on the file object. This request normally follows a cleanup request. However, though the close request might not be received immediately after the cleanup request.
Operation: File System Drivers
If the target device object is the file system's control device object, the file system driver must complete the IRP after performing any needed processing.
Otherwise, the file system driver should process the close request.
Operation: Legacy File System Filter Drivers
If the target device object is the filter driver's control device object, the filter driver should do what is necessary to end communication with the control device object and then complete the IRP.
Otherwise, the filter driver should perform any needed processing and then pass the IRP down to the next-lower driver on the stack. Processing could include operations such as deleting the per-file and per-file object context information that the filter maintains.
File system filter driver writers should note that IoCreateStreamFileObject causes an IRP_MJ_CLEANUP request to be sent to the file system driver stack for the volume. Because file systems often create stream file objects as a side effect of operations other than IRP_MJ_CREATE, it's difficult for filter drivers to reliably detect stream file object creation. Thus a filter driver should expect to receive IRP_MJ_CLEANUP and IRP_MJ_CLOSE requests for previously unseen file objects.
Filter driver writers should also note that, unlike IoCreateStreamFileObject, IoCreateStreamFileObjectLite doesn't cause an IRP_MJ_CLEANUP request to be sent to the file system driver stack. For this reason, and because file systems often create stream file objects as a side effect of operations other than IRP_MJ_CREATE, it's difficult for filter drivers to reliably detect stream file object creation. Thus filter drivers should expect to receive IRP_MJ_CLOSE requests for previously unseen file objects.
Parameters
A file system or filter driver calls IoGetCurrentIrpStackLocation with the given IRP to get a pointer to its own stack location in the IRP, shown in the following list as IrpSp. (The IRP is shown as Irp.) The driver can use the information that is set in the following members of the IRP and the IRP stack location in processing a close request.
DeviceObject
Pointer to the target device object.
Irp->Flags
The following flags are set for this request:
- IRP_CLOSE_OPERATION
- IRP_SYNCHRONOUS_API
Irp->IoStatus
Pointer to an IO_STATUS_BLOCK structure that receives the final completion status and information about the requested operation.
Irp->FileObject
Pointer to the file object that is associated with DeviceObject.
The Irp->FileObject parameter contains a pointer to the RelatedFileObject field, which is also a FILE_OBJECT structure. The RelatedFileObject field of the FILE_OBJECT structure isn't valid during the processing of IRP_MJ_CLEANUP and shouldn't be used.
Irp->MajorFunction
Specifies IRP_MJ_CLOSE.
See also
Feedback
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback.
Submit and view feedback for