Receipt of the IRP_MJ_CLOSE request indicates that the reference count on a file object has reached zero, usually because a file system driver or other kernel-mode component has called ObDereferenceObject on the file object. This request normally follows a cleanup request. However, this does not necessarily mean that the close request will be received immediately after the cleanup request.
Operation: File System Drivers
If the target device object is the file system's control device object, the file system driver must complete the IRP after performing any needed processing.
Otherwise, the file system driver should process the close request.
Operation: File System Filter Drivers
If the target device object is the filter driver's control device object, the filter driver should do what is necessary to end communication with the control device object and complete the IRP.
Otherwise, the filter driver should pass the IRP down to the next-lower driver on the stack after performing any needed processing, such as deleting the per-file and per-file object context information that is maintained by the filter driver.
File system filter driver writers should note that IoCreateStreamFileObject causes an IRP_MJ_CLEANUP request to be sent to the file system driver stack for the volume. Because file systems often create stream file objects as a side effect of operations other than IRP_MJ_CREATE, it is difficult for filter drivers to reliably detect stream file object creation. Thus a filter driver should expect to receive IRP_MJ_CLEANUP and IRP_MJ_CLOSE requests for previously unseen file objects.
Filter driver writers should also note that, unlike IoCreateStreamFileObject, IoCreateStreamFileObjectLite does not cause an IRP_MJ_CLEANUP request to be sent to the file system driver stack. For this reason, and because file systems often create stream file objects as a side effect of operations other than IRP_MJ_CREATE, it is difficult for filter drivers to reliably detect stream file object creation. Thus filter drivers should expect to receive IRP_MJ_CLOSE requests for previously unseen file objects.
A file system or filter driver calls IoGetCurrentIrpStackLocation with the given IRP to get a pointer to its own stack location in the IRP, shown in the following list as IrpSp. (The IRP is shown as Irp.) The driver can use the information that is set in the following members of the IRP and the IRP stack location in processing a close request:
Irp->IoStatus Pointer to an IO_STATUS_BLOCK structure that receives the final completion status and information about the requested operation.
The IrpSp->FileObject parameter contains a pointer to the RelatedFileObject field, which is also a FILE_OBECT structure. The RelatedFileObject field of the FILE_OBJECT structure is not valid during the processing of IRP_MJ_CLOSE and should not be used.