FltRetainSwappedBufferMdlAddress function (fltkernel.h)

Article
02/22/2024

FltRetainSwappedBufferMdlAddress prevents the Filter Manager from freeing the memory descriptor list (MDL) for a buffer that was swapped in by a minifilter driver.

Syntax

void FltRetainSwappedBufferMdlAddress(
  [in] PFLT_CALLBACK_DATA CallbackData
);

Parameters

[in] CallbackData

Pointer to the callback data structure for the operation.

Return value

None

Remarks

When a minifilter driver swaps in a new buffer in a preoperation callback (PFLT_PRE_OPERATION_CALLBACK) routine, the Filter Manager automatically frees the buffer's MDL when the corresponding postoperation (PFLT_POST_OPERATION_CALLBACK) callback routine returns.

The minifilter driver can prevent the Filter Manager from freeing the MDL by calling FltRetainSwappedBufferMdlAddress from the postoperation callback routine.

After calling FltRetainSwappedBufferMdlAddress, the caller is responsible for freeing the MDL by calling a routine such as IoFreeMdl.

FltRetainSwappedBufferMdlAddress can only be called from a postoperation callback routine.

Requirements

Requirement	Value
Target Platform	Universal
Header	fltkernel.h (include Fltkernel.h)
Library	FltMgr.lib
DLL	Fltmgr.sys
IRQL	Any level