Skip to content

Conversation

@zefklop
Copy link
Contributor

@zefklop zefklop commented Dec 2, 2025

Hello,

I'm creating this pull request to clear up a potential confusion about the context where FltCreateSectionForDataScan can be called.
This is referring to that part of the FsRtlCreateSectionForDataScan documentation, in the remarks section:

Important The FsRtlCreateSectionForDataScan routine should only be used in cases where a handle to the file object specified in the FileObject parameter has not yet been created (typically while processing a post-create operation). If the driver has a handle to the file object or can obtain a handle to the file object, the driver should use the ZwCreateSection routine instead.

You may consider this PR as an ask to clear up that point: is it safe to call this API on a file object with FO_HANDLE_CREATED and without FO_CLEANUP_COMPLETE set? The documented limitation of FsRtlCreateSectionForDataScan dates from Windows 7 and this API was introduced in Windows 8. Also, does this limitation still exist for FsRtlCreateSectionForDataScan ?

Thanks a lot

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants