From: "Zebediah Figura (she/her)" Subject: Re: [PATCH 4/6] ntoskrnl.exe: Send IRP_MN_SURPRISE_REMOVAL before removing children. Message-Id: Date: Fri, 18 Jun 2021 10:59:34 -0500 In-Reply-To: <20210618120611.703993-4-rbernon@codeweavers.com> References: <20210618120611.703993-1-rbernon@codeweavers.com> <20210618120611.703993-4-rbernon@codeweavers.com> On 6/18/21 7:06 AM, Rémi Bernon wrote: > So that mini driver gets notified first and has a chance to cancel > pending IRPs. Which minidriver? Isn't it the responsibility of the child to terminate all pending IRPs (and disallow further ones) on removal? See also [0], [1], [2], which say that queued requests should be completed in (both, for some reason) IRP_MN_SURPRISE_REMOVAL and IRP_MN_REMOVE_DEVICE. I think this deserves tests. [0] https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/removing-a-device-in-a-function-driver [1] https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/handling-an-irp-mn-surprise-removal-request [2] https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/removing-a-device-in-a-bus-drive