[PATCH 4/6] ntoskrnl.exe: Send IRP_MN_SURPRISE_REMOVAL before removing children.

[Zebediah Figura (she/her)]

On 6/18/21 7:06 AM, Rémi Bernon wrote:
> So that mini driver gets notified first and has a chance to cancel
> pending IRPs.

Which minidriver?

Isn't it the responsibility of the child to terminate all pending IRPs 
(and disallow further ones) on removal? See also [0], [1], [2], which 
say that queued requests should be completed in (both, for some reason) 
IRP_MN_SURPRISE_REMOVAL and IRP_MN_REMOVE_DEVICE.

I think this deserves tests.

[0] 
https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/removing-a-device-in-a-function-driver

[1] 
https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/handling-an-irp-mn-surprise-removal-request

[2] 
https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/removing-a-device-in-a-bus-drive