microsoft / microsoft/Windows-driver-samples
[filesys/miniFilter/delete]: Potential FLT_CONTEXT leak issue
@jrixie is already working on this.
Since Apr 28, 2026.
- Dominant language
- C
- Stars
- 7.8k
- Forks
- 5k
- Avg merge
- 3d 17h
- Merged PRs (30d)
- 7
Description
### Which is the area where the sample lives?
/filesys/miniFilter/
### Describe the issue
I set the `StartType` to 1 (`SERVICE_SYSTEM_START`). After installing the sample driver and rebooting the system:
In `DfPostCreateCallback`, if `Data->Iopb->TargetFileObject->FileName` is `"\pagefile.sys"` or `"\swapfile.sys"`, the call to `DfGetOrSetContext` returns error `0xC00000BB` (`STATUS_NOT_SUPPORTED`).
In this scenario, `FltReleaseContext` is not called to release the `streamContext` in either `DfPostCreateCallback` or `DfGetOrSetContext`. This causes the driver to fail to unload properly.
Checking with the WinDbg command `!fltkd.filter 8 1` shows that two `FLT_CONTEXT` references remain unreleased:
```
Object usage/reference information:
References to FLT_CONTEXT : 2
Allocations of FLT_CALLBACK_DATA : 0
Allocations of FLT_DEFERRED_IO_WORKITEM : 0
Allocations of FLT_GENERIC_WORKITEM : 0
References to FLT_FILE_NAME_INFORMATION : 0
Open files : 0
References to FLT_OBJECT : 0
List of objects used/referenced::
FLT_VERIFIER_OBJECT: ffffb289c1607b90
Object: ffffe688e6d6d620 Type: FLT_CONTEXT RefCount: 00000001
FLT_VERIFIER_OBJECT: ffffb289c16072f0
Object: ffffe688e6d6f4c0 Type: FLT_CONTEXT RefCount: 00000001
```
Relevant code locations:
[delete.inf#L95](https://github.com/microsoft/Windows-driver-samples/blob/main/filesys/miniFilter/delete/delete.inf#L95)
[delete.c#L2716](https://github.com/microsoft/Windows-driver-samples/blob/main/filesys/miniFilter/delete/delete.c#L2716)
[delete.c#L1241](https://github.com/microsoft/Windows-driver-samples/blob/main/filesys/miniFilter/delete/delete.c#L1241)
[delete.c#L2742](https://github.com/microsoft/Windows-driver-samples/blob/main/filesys/miniFilter/delete/delete.c#L2742)
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.