// fltkernel.h
PMDL FltGetSwappedBufferMdlAddress(
[in] PFLT_CALLBACK_DATA CallbackData
);
View the official Windows Driver Kit DDI referenceNo description available.
The FltGetSwappedBufferMdlAddress routine returns the memory descriptor list (MDL) address for a buffer that was swapped in by a minifilter driver.
CallbackData [in]Pointer to the callback data structure for the operation.
FltGetSwappedBufferMdlAddress returns the MDL address for the buffer that was swapped in by the caller. FltGetSwappedBufferMdlAddress returns NULL in the following cases:
A minifilter driver that swaps in a new buffer in a preoperation callback routine can get the MDL address for the buffer by calling FltGetSwappedBufferMdlAddress from the corresponding postoperation callback routine.
The FltGetSwappedBufferMdlAddress routine is necessary because the postoperation callback routine receives a callback data structure that contains the original buffer and MDL address, not the ones that were swapped in by the caller's preoperation callback routine.
It is possible for FltGetSwappedBufferMdlAddress to return a non-NULL MDL value even if the caller did not create an MDL for the buffer that it swapped in. This happens when an MDL is created for the buffer by a minifilter driver, legacy filter driver, or file system driver that is below the caller in the minifilter driver or file system driver stack.
It is also possible for FltGetSwappedBufferMdlAddress to return a non-NULL MDL value even if the caller did not swap in a new buffer in its preoperation callback routine. This happens in operations, such as paging I/O, where the buffer is NULL, and the caller swaps in a new MDL address.
The MDL for the buffer that was swapped in by the caller is automatically freed by the Filter Manager when the postoperation callback routine returns. To prevent this MDL from being freed, call FltRetainSwappedBufferMdlAddress.
FltGetSwappedBufferMdlAddress can only be called from a postoperation callback routine.
FltRetainSwappedBufferMdlAddress