microsoft / microsoft/Windows-driver-samples

[filesys/miniFilter/delete]: Potential FLT_CONTEXT leak issue

Open
#1,360 2 comments 0 reactions 2 assignees View on GitHub

@jrixie is already working on this.

Since Apr 28, 2026.

Dominant language
C
Stars
7.8k
Forks
5k
Avg merge
3d 17h
Merged PRs (30d)
7

Description

### Which is the area where the sample lives?

/filesys/miniFilter/

### Describe the issue

I set the `StartType` to 1 (`SERVICE_SYSTEM_START`). After installing the sample driver and rebooting the system:

In `DfPostCreateCallback`, if `Data->Iopb->TargetFileObject->FileName` is `"\pagefile.sys"` or `"\swapfile.sys"`, the call to `DfGetOrSetContext` returns error `0xC00000BB` (`STATUS_NOT_SUPPORTED`).

In this scenario, `FltReleaseContext` is not called to release the `streamContext` in either `DfPostCreateCallback` or `DfGetOrSetContext`. This causes the driver to fail to unload properly.

Checking with the WinDbg command `!fltkd.filter 8 1` shows that two `FLT_CONTEXT` references remain unreleased:
```
Object usage/reference information:
References to FLT_CONTEXT : 2
Allocations of FLT_CALLBACK_DATA : 0
Allocations of FLT_DEFERRED_IO_WORKITEM : 0
Allocations of FLT_GENERIC_WORKITEM : 0
References to FLT_FILE_NAME_INFORMATION : 0
Open files : 0
References to FLT_OBJECT : 0
List of objects used/referenced::
FLT_VERIFIER_OBJECT: ffffb289c1607b90
Object: ffffe688e6d6d620 Type: FLT_CONTEXT RefCount: 00000001
FLT_VERIFIER_OBJECT: ffffb289c16072f0
Object: ffffe688e6d6f4c0 Type: FLT_CONTEXT RefCount: 00000001
```

Relevant code locations:
[delete.inf#L95](https://github.com/microsoft/Windows-driver-samples/blob/main/filesys/miniFilter/delete/delete.inf#L95)
[delete.c#L2716](https://github.com/microsoft/Windows-driver-samples/blob/main/filesys/miniFilter/delete/delete.c#L2716)
[delete.c#L1241](https://github.com/microsoft/Windows-driver-samples/blob/main/filesys/miniFilter/delete/delete.c#L1241)
[delete.c#L2742](https://github.com/microsoft/Windows-driver-samples/blob/main/filesys/miniFilter/delete/delete.c#L2742)

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.