FltCancelIo function (fltkernel.h)

Article
10/21/2021

The FltCancelIo routine cancels an I/O operation.

Syntax

BOOLEAN FLTAPI FltCancelIo(
  [in] PFLT_CALLBACK_DATA CallbackData
);

Parameters

[in] CallbackData

Pointer to the callback data (FLT_CALLBACK_DATA) structure for the I/O operation.

Return value

FltCancelIo returns TRUE if the I/O operation was canceled successfully. Otherwise, it returns FALSE.

Remarks

A minifilter driver that initiates an I/O operation by calling a routine such as FltPerformAsynchronousIo can cancel the operation by calling FltCancelIo. The operation must be an IRP-based I/O operation, it must not be currently posted to the minifilter driver's own work queue, and it must not have been completed.

If the IRP has a cancel routine, FltCancelIo sets the IRP's cancel bit and calls the cancel routine.

If the IRP does not have a cancel routine, and therefore the IRP is not cancelable, FltCancelIo sets the IRP's cancel bit and returns FALSE. The IRP should be canceled at a later time when it becomes cancelable.

If a minifilter driver that did not initiate the IRP-based I/O operation calls FltCancelIo, the results are unpredictable. For example, the IRP might be completed with a success NTSTATUS code even though its cancel bit was set.

FltCancelIo returns FALSE if any of the following conditions are true:

The operation is not an IRP-based I/O operation.
No cancel routine is specified for the I/O operation.
The I/O operation has already been canceled.

To determine whether a given callback data structure represents an IRP-based I/O operation, use the FLT_IS_IRP_OPERATION macro.

To specify a cancel routine for an I/O operation, call FltSetCancelCompletion.

To clear a cancel routine that was set for an I/O operation, call FltClearCancelCompletion.

Requirements

Requirement	Value
Target Platform	Universal
Header	fltkernel.h (include FltKernel.h)
Library	FltMgr.lib
IRQL	<= DISPATCH_LEVEL