Export (0) Print
Expand All
This topic has not yet been rated - Rate this topic

ObDereferenceObjectDeferDeleteWithTag routine

The ObDereferenceObjectDeferDeleteWithTag routine decrements the reference count for the specified object, defers deletion of the object to avoid deadlocks, and writes a four-byte tag value to the object to support object reference tracing.

Syntax


VOID ObDereferenceObjectDeferDeleteWithTag(
  _In_  PVOID Object,
  _In_  ULONG Tag
);

Parameters

Object [in]

A pointer to the object. The caller obtains this pointer either when it creates the object, or from a previous call to the ObReferenceObjectByHandleWithTag routine after it opens the object.

Tag [in]

Specifies a four-byte, custom tag value. For more information, see the following Remarks section.

Return value

None

Remarks

ObDereferenceObjectDeferDeleteWithTag is similar to ObDereferenceObjectWithTag except that, when the reference count of the object reaches zero, ObDereferenceObjectDeferDeleteWithTag passes the object deletion request to a worker thread. The worker thread, which runs at IRQL = PASSIVE_LEVEL, later deletes the object.

If the immediate deletion of an object by the current thread might cause a deadlock, do not call ObDereferenceObjectWithTag to dereference the object. Instead, call ObDereferenceObjectDeferDeleteWithTag to dereference the object.

For example, such a deadlock can occur if ObDereferenceObjectWithTag is used to dereference a Kernel Transaction Manager (KTM) object when a higher-level driver on the driver stack is holding a lock.

For more information about object permanence and object attributes, see ObDereferenceObjectWithTag. For more information about object references, see Life Cycle of an Object.

The ObDereferenceObjectDeferDelete routine is similar to ObDereferenceObjectDeferDeleteWithTag, except that it does not enable the caller to write a custom tag to an object. In Windows 7 and later versions of Windows, ObDereferenceObjectDeferDelete always writes a default tag value ('tlfD') to the object. A call to ObDereferenceObjectDeferDelete has the same effect as a call to ObDereferenceObjectDeferDeleteWithTag that specifies Tag = 'tlfD'.

To view an object reference trace in the Windows debugging tools, use the !obtrace kernel-mode debugger extension. In Windows 7, the !obtrace extension is enhanced to display object reference tags, if object reference tracing is enabled. By default, object reference tracing is turned off. Use the Global Flags Editor (Gflags) to enable object reference tracing. For more information, see Object Reference Tracing with Tags.

Requirements

Version

Available in Windows 7 and later versions of the Windows operating system.

Header

Wdm.h (include Wdm.h, Ntddk.h, Ntifs.h, or Fltkernel.h)

Library

Ntoskrnl.lib

IRQL

<= DISPATCH_LEVEL

See also

ObDereferenceObjectDeferDelete
ObDereferenceObjectWithTag
ObReferenceObjectByHandleWithTag

 

 

Send comments about this topic to Microsoft

Did you find this helpful?
(1500 characters remaining)
Thank you for your feedback
Show:
© 2014 Microsoft. All rights reserved.