Home/ Questions/Q 4025012
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-20T10:47:37+00:00

As I understand, one can iterate the device stack of WDM devices only from

  • 0

As I understand, one can iterate the device stack of WDM devices only from the bottoms up, because DEVICE_OBJECT has an AttachedDevice member (but not a LowerDevice member). Luckily, the AddDevice callback receives the PhysicalDeviceObject so you can iterate over the entire stack.

From within my filter driver I’m trying to determine whether I’m already filtering a certain device object. (Let’s say I have a legit reason for this. Bear with me.) My idea was to go over every DEVICE_OBJECT in the stack and compare its DriverObject member to mine.

Judging from the existence of IoGetAttachedDeviceReference, I assume just accessing AttachedDevice isn’t a safe thing to do, for the risk of the device suddenly going away. However, IoGetAttachedDeviceReference brings me straight to the top of the stack, which is no good for me.

So, is there a safe way to iterate over a device stack?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Correct, you can’t safely walk the AttachedDevice chain unless you can somehow guarantee that the stack will not be torn down (e.g. if you have an active file object referencing the stack). On Win2K this is pretty much your only option.

    On XP and later, the preferred method is actually to walk from the top of the stack down. You can do this by calling IoGetAttachedDeviceReference and then calling IoGetLowerDeviceObject.

    -scott

    • 0