path: root/private/ntos/cntfs/cleanup.c

/*++

Copyright (c) 1991  Microsoft Corporation

Module Name:

    Cleanup.c

Abstract:

    This module implements the File Cleanup routine for Ntfs called by the
    dispatch driver.

Author:

    Your Name       [Email]         dd-Mon-Year

Revision History:

--*/

#include "NtfsProc.h"

//
//  The Bug check file id for this module
//

#define BugCheckFileId                   (NTFS_BUG_CHECK_CLEANUP)

//
//  The local debug trace level
//

#define Dbg                              (DEBUG_TRACE_CLEANUP)

VOID
NtfsContractQuotaToFileSize (
    IN PIRP_CONTEXT IrpContext,
    IN PSCB Scb
    );

#ifdef ALLOC_PRAGMA
#pragma alloc_text(PAGE, NtfsCommonCleanup)
#pragma alloc_text(PAGE, NtfsFsdCleanup)
#pragma alloc_text(PAGE, NtfsContractQuotaToFileSize)
#endif


NTSTATUS
NtfsFsdCleanup (
    IN PVOLUME_DEVICE_OBJECT VolumeDeviceObject,
    IN PIRP Irp
    )

/*++

Routine Description:

    This routine implements the FSD part of Cleanup.

Arguments:

    VolumeDeviceObject - Supplies the volume device object where the
        file exists

    Irp - Supplies the Irp being processed

Return Value:

    NTSTATUS - The FSD status for the IRP

--*/

{
    TOP_LEVEL_CONTEXT TopLevelContext;
    PTOP_LEVEL_CONTEXT ThreadTopLevelContext;

    NTSTATUS Status = STATUS_SUCCESS;
    PIRP_CONTEXT IrpContext = NULL;
    ULONG LogFileFullCount = 0;

    ASSERT_IRP( Irp );

    PAGED_CODE();

    //
    //  If we were called with our file system device object instead of a
    //  volume device object, just complete this request with STATUS_SUCCESS
    //

    if (VolumeDeviceObject->DeviceObject.Size == (USHORT)sizeof(DEVICE_OBJECT)) {

        Irp->IoStatus.Status = STATUS_SUCCESS;
        Irp->IoStatus.Information = FILE_OPENED;

        IoCompleteRequest( Irp, IO_DISK_INCREMENT );

        return STATUS_SUCCESS;
    }

    DebugTrace( +1, Dbg, ("NtfsFsdCleanup\n") );

    //
    //  Call the common Cleanup routine
    //

    FsRtlEnterFileSystem();

    ThreadTopLevelContext = NtfsSetTopLevelIrp( &TopLevelContext, FALSE, FALSE );

    //
    //  Do the following in a loop to catch the log file full and cant wait
    //  calls.
    //

    do {

        try {

            //
            //  We are either initiating this request or retrying it.
            //

            if (IrpContext == NULL) {

                IrpContext = NtfsCreateIrpContext( Irp, CanFsdWait( Irp ) );
                NtfsUpdateIrpContextWithTopLevel( IrpContext, ThreadTopLevelContext );

            } else if (Status == STATUS_LOG_FILE_FULL) {

                NtfsCheckpointForLogFileFull( IrpContext );

                if (++LogFileFullCount >= 2) {

                    SetFlag( IrpContext->Flags, IRP_CONTEXT_FLAG_EXCESS_LOG_FULL );
                }
            }

            Status = NtfsCommonCleanup( IrpContext, Irp );
            break;

        } except(NtfsExceptionFilter( IrpContext, GetExceptionInformation() )) {

            //
            //  We had some trouble trying to perform the requested
            //  operation, so we'll abort the I/O request with
            //  the error status that we get back from the
            //  execption code
            //

            Status = NtfsProcessException( IrpContext, Irp, GetExceptionCode() );
        }

    } while (Status == STATUS_CANT_WAIT ||
             Status == STATUS_LOG_FILE_FULL);

    if (ThreadTopLevelContext == &TopLevelContext) {
        NtfsRestoreTopLevelIrp( ThreadTopLevelContext );
    }

    FsRtlExitFileSystem();

    //
    //  And return to our caller
    //

    DebugTrace( -1, Dbg, ("NtfsFsdCleanup -> %08lx\n", Status) );

    return Status;
}


NTSTATUS
NtfsCommonCleanup (
    IN PIRP_CONTEXT IrpContext,
    IN PIRP Irp
    )

/*++

Routine Description:

    This is the common routine for Cleanup called by both the fsd and fsp
    threads.

Arguments:

    Irp - Supplies the Irp to process

Return Value:

    NTSTATUS - The return status for the operation

--*/

{
    NTSTATUS Status;
    PIO_STACK_LOCATION IrpSp;
    PFILE_OBJECT FileObject;

    TYPE_OF_OPEN TypeOfOpen;
    PVCB Vcb;
    PFCB Fcb;
    PSCB Scb;
    PCCB Ccb;
    PLCB Lcb;
    PLCB LcbForUpdate;
    PLCB LcbForCounts;
    PSCB ParentScb = NULL;
    PFCB ParentFcb = NULL;

    PLCB ThisLcb;
    PSCB ThisScb;
    ATTRIBUTE_ENUMERATION_CONTEXT AttrContext;

    PLONGLONG TruncateSize = NULL;
    LONGLONG LocalTruncateSize;

    BOOLEAN DeleteFile = FALSE;
    BOOLEAN DeleteStream = FALSE;
    BOOLEAN OpenById;
    BOOLEAN RemoveLink;

    BOOLEAN AcquiredParentScb = FALSE;
    BOOLEAN AcquiredScb = FALSE;

    BOOLEAN CleanupAttrContext = FALSE;

    BOOLEAN UpdateDuplicateInfo = FALSE;
    BOOLEAN AddToDelayQueue = TRUE;

    USHORT TotalLinkAdj = 0;
    PLIST_ENTRY Links;

    NAME_PAIR NamePair;

    ASSERT_IRP_CONTEXT( IrpContext );
    ASSERT_IRP( Irp );

    PAGED_CODE();

    NtfsInitializeNamePair(&NamePair);

    //
    //  Get the current Irp stack location
    //

    IrpSp = IoGetCurrentIrpStackLocation( Irp );

    DebugTrace( +1, Dbg, ("NtfsCommonCleanup\n") );
    DebugTrace( 0, Dbg, ("IrpContext = %08lx\n", IrpContext) );
    DebugTrace( 0, Dbg, ("Irp        = %08lx\n", Irp) );

    //
    //  Extract and decode the file object
    //

    FileObject = IrpSp->FileObject;

    TypeOfOpen = NtfsDecodeFileObject( IrpContext, FileObject, &Vcb, &Fcb, &Scb, &Ccb, FALSE );

    Status = STATUS_SUCCESS;

    //
    //  Special case the unopened file object and stream files.
    //

    if ((TypeOfOpen == UnopenedFileObject) ||
        (TypeOfOpen == StreamFileOpen)) {

        //
        //  Just set the FO_CLEANUP_COMPLETE flag, and get outsky...
        //

        SetFlag( FileObject->Flags, FO_CLEANUP_COMPLETE );

        //
        //  Theoretically we should never hit this case.  It means an app
        //  tried to close a handle he didn't open (call NtClose with a handle
        //  value that happens to be in the handle table).  It is safe to
        //  simply return SUCCESS in this case.
        //
        //  Trigger an assert so we can find the bad app though.
        //

        ASSERT( TypeOfOpen != StreamFileOpen );

        NtfsCompleteRequest( &IrpContext, &Irp, Status );

        DebugTrace( -1, Dbg, ("NtfsCommonCleanup -> %08lx\n", Status) );

        return Status;
    }

    //
    //  Let's make sure we can wait.
    //

    if (!FlagOn(IrpContext->Flags, IRP_CONTEXT_FLAG_WAIT)) {

        Status = NtfsPostRequest( IrpContext, Irp );

        DebugTrace( -1, Dbg, ("NtfsCommonCleanup -> %08lx\n", Status) );

        return Status;
    }

    //
    //  Remember if this is an open by file Id open.
    //

    OpenById = BooleanFlagOn( Ccb->Flags, CCB_FLAG_OPEN_BY_FILE_ID );

    //
    //  Acquire exclusive access to the Vcb and enqueue the irp if we didn't
    //  get access
    //

    if (TypeOfOpen == UserVolumeOpen) {

        SetFlag( IrpContext->Flags, IRP_CONTEXT_FLAG_ACQUIRE_VCB_EX );
    }

    if (FlagOn( IrpContext->Flags, IRP_CONTEXT_FLAG_ACQUIRE_VCB_EX )) {

        NtfsAcquireExclusiveVcb( IrpContext, Vcb, TRUE );

    } else {

        NtfsAcquireSharedVcb( IrpContext, Vcb, TRUE );
    }

    //
    //  Use a try-finally to facilitate cleanup.
    //

    try {

        LcbForUpdate = LcbForCounts = Lcb = Ccb->Lcb;

        if (Lcb != NULL) {

            ParentScb = Lcb->Scb;

            if (ParentScb != NULL) {

                ParentFcb = ParentScb->Fcb;
            }
        }

        //
        //  Acquire Paging I/O first, since we may be deleting or truncating.
        //  Testing for the PagingIoResource is not really safe without
        //  holding the main resource, so we correct for that below.
        //

        if (Fcb->PagingIoResource != NULL) {

            NtfsAcquireExclusivePagingIo( IrpContext, Fcb );
            NtfsAcquireExclusiveScb( IrpContext, Scb );

        } else {

            NtfsAcquireExclusiveScb( IrpContext, Scb );

            //
            //  If we now do not see a paging I/O resource we are golden,
            //  othewise we can absolutely release and acquire the resources
            //  safely in the right order, since a resource in the Fcb is
            //  not going to go away.
            //

            if (Fcb->PagingIoResource != NULL) {
                NtfsReleaseScb( IrpContext, Scb );
                NtfsAcquireExclusivePagingIo( IrpContext, Fcb );
                NtfsAcquireExclusiveScb( IrpContext, Scb );
            }
        }

        AcquiredScb = TRUE;

        //
        //  Update the Lcb/Scb to reflect the case where this opener had
        //  specified delete on close.
        //

        if (FlagOn( Ccb->Flags, CCB_FLAG_DELETE_ON_CLOSE )) {

            if (FlagOn( Ccb->Flags, CCB_FLAG_OPEN_AS_FILE )) {

                BOOLEAN LastLink;
                BOOLEAN NonEmptyIndex;

                //
                //  It is ok to get rid of this guy.  All we need to do is
                //  mark this Lcb for delete and decrement the link count
                //  in the Fcb.  If this is a primary link, then we
                //  indicate that the primary link has been deleted.
                //

                if (!LcbLinkIsDeleted( Lcb ) &&
                    (!IsDirectory( &Fcb->Info ) ||
                    NtfsIsLinkDeleteable( IrpContext, Fcb, &NonEmptyIndex, &LastLink))) {

                    if (FlagOn( Lcb->FileNameAttr->Flags, FILE_NAME_DOS | FILE_NAME_NTFS )) {

                        SetFlag( Fcb->FcbState, FCB_STATE_PRIMARY_LINK_DELETED );
                    }

                    Fcb->LinkCount -= 1;

                    SetFlag( Lcb->LcbState, LCB_STATE_DELETE_ON_CLOSE );

                    //
                    //  Call into the notify package to close any handles on
                    //  a directory being deleted.
                    //

                    if (IsDirectory( &Fcb->Info )) {

                        FsRtlNotifyFullChangeDirectory( Vcb->NotifySync,
                                                        &Vcb->DirNotifyList,
                                                        FileObject->FsContext,
                                                        NULL,
                                                        FALSE,
                                                        FALSE,
                                                        0,
                                                        NULL,
                                                        NULL,
                                                        NULL );
                    }

                }

            //
            //  Otherwise we are simply removing the attribute.
            //

            } else {

                SetFlag( Scb->ScbState, SCB_STATE_DELETE_ON_CLOSE );
            }

            //
            //  Clear the flag so we will ignore it in the log file full case.
            //

            ClearFlag( Ccb->Flags, CCB_FLAG_DELETE_ON_CLOSE );
        }

        //
        //  If we are going to try and delete something, anything, knock the file
        //  size and valid data down to zero.  Then update the snapshot
        //  so that the sizes will be zero even if the operation fails.
        //
        //  If we're deleting the file, go through all of the Scb's.
        //

        if ((Fcb->CleanupCount == 1) &&
            (Fcb->LinkCount == 0)) {

            DeleteFile = TRUE;
            NtfsFreeSnapshotsForFcb( IrpContext, Scb->Fcb );

            for (Links = Fcb->ScbQueue.Flink;
                 Links != &Fcb->ScbQueue;
                 Links = Links->Flink) {

                ThisScb = CONTAINING_RECORD( Links, SCB, FcbLinks );

                //
                //  Set the Scb sizes to zero except for the attribute list.
                //

                if (ThisScb->AttributeTypeCode != $ATTRIBUTE_LIST) {

                    ThisScb->Header.FileSize =
                    ThisScb->Header.ValidDataLength = Li0;
                }

                if (FlagOn( ThisScb->ScbState, SCB_STATE_FILE_SIZE_LOADED )) {

                    NtfsSnapshotScb( IrpContext, ThisScb );
                }
            }

        //
        //  Otherwise we may only be deleting this stream.
        //

        } else if ((Scb->CleanupCount == 1) &&
                   FlagOn( Scb->ScbState, SCB_STATE_DELETE_ON_CLOSE )) {

            DeleteStream = TRUE;
            Scb->Header.FileSize =
            Scb->Header.ValidDataLength = Li0;

            NtfsFreeSnapshotsForFcb( IrpContext, Scb->Fcb );

            if (FlagOn( Scb->ScbState, SCB_STATE_FILE_SIZE_LOADED )) {

                NtfsSnapshotScb( IrpContext, Scb );
            }
        }

        //
        //  Let's do a sanity check.
        //

        ASSERT( Fcb->CleanupCount != 0 );
        ASSERT( Scb->CleanupCount != 0 );

        //
        //  If the cleanup count on the file will go to zero and there is
        //  a large security descriptor and we haven't exceeded the security
        //  creation count for this Fcb then dereference and possibly deallocate
        //  the security descriptor for the Fcb.  This is to prevent us from
        //  holding onto pool while waiting for closes to come in.
        //

        if ((Fcb->CleanupCount == 1) &&
            (Fcb->SharedSecurity != NULL) &&
            (Fcb->CreateSecurityCount < FCB_CREATE_SECURITY_COUNT) &&
            (GetSharedSecurityLength( Fcb->SharedSecurity ) > FCB_LARGE_ACL_SIZE)) {

            NtfsAcquireFcbSecurity( Fcb->Vcb );
            NtfsDereferenceSharedSecurity( Fcb );
            NtfsReleaseFcbSecurity( Fcb->Vcb );
        }

        //
        //  Case on the type of open that we are trying to cleanup.
        //

        switch (TypeOfOpen) {

        case UserVolumeOpen :

            DebugTrace( 0, Dbg, ("Cleanup on user volume\n") );

            //
            //  First set the FO_CLEANUP_COMPLETE flag.
            //

            SetFlag( FileObject->Flags, FO_CLEANUP_COMPLETE );

            //
            //  For a volume open, we check if this open locked the volume.
            //  All the other work is done in common code below.
            //

            if (FlagOn( Vcb->VcbState, VCB_STATE_LOCKED ) &&
                ((Vcb->FileObjectWithVcbLocked == FileObject) ||
                 ((ULONG)Vcb->FileObjectWithVcbLocked == ((ULONG)FileObject)+1))) {

                if ((ULONG)Vcb->FileObjectWithVcbLocked == ((ULONG)FileObject)+1) {

                    NtfsPerformDismountOnVcb( IrpContext, Vcb, TRUE );

                //
                //  Purge the volume for the autocheck case.
                //

                } else if (FlagOn( FileObject->Flags, FO_FILE_MODIFIED )) {

                    //
                    //  Drop the Scb for the volume Dasd around this call.
                    //

                    NtfsReleaseScb( IrpContext, Scb );
                    AcquiredScb = FALSE;

                    NtfsFlushVolume( IrpContext, Vcb, FALSE, TRUE, TRUE, FALSE );

                    NtfsAcquireExclusiveScb( IrpContext, Scb );
                    AcquiredScb = TRUE;

                    //
                    //  If this is not the boot partition then dismount the Vcb.
                    //

                    if ((Vcb->CleanupCount == 1) &&
                        ((Vcb->CloseCount - Vcb->SystemFileCloseCount) == 1)) {

                        NtfsPerformDismountOnVcb( IrpContext, Vcb, TRUE );
                    }
                }

                ClearFlag( Vcb->VcbState, VCB_STATE_LOCKED | VCB_STATE_EXPLICIT_LOCK );
                Vcb->FileObjectWithVcbLocked = NULL;

#ifdef _CAIRO_

                //
                //  If the quota tracking has been requested and the quotas
                //  need to be repaired then try to repair them now.
                //

                if (FlagOn( Vcb->QuotaFlags, QUOTA_FLAG_TRACKING_REQUESTED) &&
                    FlagOn( Vcb->QuotaFlags, QUOTA_FLAG_OUT_OF_DATE |
                                             QUOTA_FLAG_CORRUPT |
                                             QUOTA_FLAG_PENDING_DELETES)) {

                    NtfsPostRepairQuotaIndex( IrpContext, Vcb );
                }

#endif // _CAIRO_

            }

            break;

        case UserDirectoryOpen :

            DebugTrace( 0, Dbg, ("Cleanup on user directory/file\n") );

            NtfsSnapshotScb( IrpContext, Scb );

            //
            //  Capture any changes to the time stamps for this file.
            //

            NtfsUpdateScbFromFileObject( IrpContext, FileObject, Scb, TRUE );

            //
            //  Now set the FO_CLEANUP_COMPLETE flag.
            //

            SetFlag( FileObject->Flags, FO_CLEANUP_COMPLETE );

            //
            //  To perform cleanup on a directory, we first complete any
            //  Irps watching from this directory.  If we are deleting the
            //  file then we remove all prefix entries for all the Lcb's going
            //  into this directory and delete the file.  We then report to
            //  dir notify that this file is going away.
            //

            //
            //  Complete any Notify Irps on this file handle.
            //

            if (FlagOn( Ccb->Flags, CCB_FLAG_DIR_NOTIFY )) {

                FsRtlNotifyCleanup( Vcb->NotifySync, &Vcb->DirNotifyList, Ccb );
                ClearFlag( Ccb->Flags, CCB_FLAG_DIR_NOTIFY );
                InterlockedDecrement( &Vcb->NotifyCount );
            }

            //
            //  When cleaning up a user directory, we always remove the
            //  share access and modify the file counts.  If the Fcb
            //  has been marked as delete on close and this is the last
            //  open file handle, we remove the file from the Mft and
            //  remove it from it's parent index entry.
            //

            if (FlagOn( Vcb->VcbState, VCB_STATE_VOLUME_MOUNTED ) &&
                (NodeType( Scb ) == NTFS_NTC_SCB_INDEX)) {

                if (DeleteFile) {

                    ASSERT( (Lcb == NULL) ||
                            (LcbLinkIsDeleted( Lcb ) && Lcb->CleanupCount == 1 ));

                    //
                    //  If we don't have an Lcb and there is one on the Fcb then
                    //  let's use it.
                    //

                    if ((Lcb == NULL) && !IsListEmpty( &Fcb->LcbQueue )) {

                        Lcb = CONTAINING_RECORD( Fcb->LcbQueue.Flink,
                                                 LCB,
                                                 FcbLinks );

                        ParentScb = Lcb->Scb;
                        if (ParentScb != NULL) {

                            ParentFcb = ParentScb->Fcb;
                        }
                    }

                    //
                    //  Now acquire the Parent Scb exclusive while still holding
                    //  the Vcb, to avoid deadlocks.  The Parent Scb is required
                    //  since we will be deleting index entries in it.
                    //

                    if (ParentScb != NULL) {

                        NtfsAcquireExclusiveScb( IrpContext, ParentScb );
                        AcquiredParentScb = TRUE;
                    }

                    try {

                        NtfsDeleteFile( IrpContext, Fcb, ParentScb, NULL);
                        TotalLinkAdj += 1;

                        //
                        //  Remove all tunneling entries for this directory
                        //

                        FsRtlDeleteKeyFromTunnelCache(&Vcb->Tunnel, *(PULONGLONG)&Fcb->FileReference);

                        if (ParentFcb != NULL) {

                            NtfsUpdateFcb( ParentFcb );
                        }

                    } except( (((Status = GetExceptionCode()) == STATUS_LOG_FILE_FULL) ||
                               (Status == STATUS_CANT_WAIT) ||
                               !FsRtlIsNtstatusExpected( Status ))
                              ? EXCEPTION_CONTINUE_SEARCH
                              : EXCEPTION_EXECUTE_HANDLER ) {

                        NOTHING;
                    }

                    if (!OpenById && (Vcb->NotifyCount != 0)) {

                        NtfsReportDirNotify( IrpContext,
                                             Vcb,
                                             &Ccb->FullFileName,
                                             Ccb->LastFileNameOffset,
                                             NULL,
                                             ((FlagOn( Ccb->Flags, CCB_FLAG_PARENT_HAS_DOS_COMPONENT ) &&
                                               Ccb->Lcb != NULL &&
                                               Ccb->Lcb->Scb->ScbType.Index.NormalizedName.Buffer != NULL) ?
                                              &Ccb->Lcb->Scb->ScbType.Index.NormalizedName :
                                              NULL),
                                             FILE_NOTIFY_CHANGE_DIR_NAME,
                                             FILE_ACTION_REMOVED,
                                             ParentFcb );
                    }

                    SetFlag( Fcb->FcbState, FCB_STATE_FILE_DELETED );

                    //
                    //  We need to mark all of the links on the file as gone.
                    //  If there is a parent Scb then it will be the parent
                    //  for all of the links.
                    //

                    for (Links = Fcb->LcbQueue.Flink;
                         Links != &Fcb->LcbQueue;
                         Links = Links->Flink) {

                        ThisLcb = CONTAINING_RECORD( Links, LCB, FcbLinks );

                        //
                        //  Remove all remaining prefixes on this link.
                        //

                        NtfsRemovePrefix( ThisLcb );

                        SetFlag( ThisLcb->LcbState, LCB_STATE_LINK_IS_GONE );

                        //
                        //  We don't need to report any changes on this link.
                        //

                        ThisLcb->InfoFlags = 0;
                    }

                    //
                    //  We need to mark all of the Scbs as gone.
                    //

                    for (Links = Fcb->ScbQueue.Flink;
                         Links != &Fcb->ScbQueue;
                         Links = Links->Flink) {

                        ThisScb = CONTAINING_RECORD( Links, SCB, FcbLinks );

                        ClearFlag( Scb->ScbState,
                                   SCB_STATE_NOTIFY_ADD_STREAM |
                                   SCB_STATE_NOTIFY_REMOVE_STREAM |
                                   SCB_STATE_NOTIFY_RESIZE_STREAM |
                                   SCB_STATE_NOTIFY_MODIFY_STREAM );

                        if (!FlagOn( ThisScb->ScbState, SCB_STATE_ATTRIBUTE_DELETED )) {

                            NtfsSnapshotScb( IrpContext, ThisScb );

                            ThisScb->ValidDataToDisk =
                            ThisScb->Header.AllocationSize.QuadPart =
                            ThisScb->Header.FileSize.QuadPart =
                            ThisScb->Header.ValidDataLength.QuadPart = 0;

                            SetFlag( ThisScb->ScbState, SCB_STATE_ATTRIBUTE_DELETED );
                        }
                    }

                    //
                    //  We certainly don't need to any on disk update for this
                    //  file now.
                    //

                    Fcb->InfoFlags = 0;
                    ClearFlag( Fcb->FcbState, FCB_STATE_UPDATE_STD_INFO );

                    ClearFlag( Ccb->Flags,
                               CCB_FLAG_USER_SET_LAST_MOD_TIME |
                               CCB_FLAG_USER_SET_LAST_CHANGE_TIME |
                               CCB_FLAG_USER_SET_LAST_ACCESS_TIME );
                    AddToDelayQueue = FALSE;
                }

            } else {

                AddToDelayQueue = FALSE;
            }

            //
            //  Determine if we should put this on the delayed close list.
            //  The following must be true.
            //
            //  - This is not the root directory
            //  - This directory is not about to be deleted
            //  - This is the last handle and last file object for this
            //      directory.
            //  - There are no other file objects on this file.
            //  - We are not currently reducing the delayed close queue.
            //

            NtfsAcquireFsrtlHeader( Scb );
            if (AddToDelayQueue &&
                !FlagOn( Scb->ScbState, SCB_STATE_DELAY_CLOSE ) &&
                (NtfsData.DelayedCloseCount <= NtfsMaxDelayedCloseCount) &&
                (Fcb->CloseCount == 1)) {

                SetFlag( Scb->ScbState, SCB_STATE_DELAY_CLOSE );

            } else {

                ClearFlag( Scb->ScbState, SCB_STATE_DELAY_CLOSE );
            }
            NtfsReleaseFsrtlHeader( Scb );

            break;

        case UserFileOpen :
#ifdef _CAIRO_
        case UserPropertySetOpen :
#endif  //  _CAIRO_

            DebugTrace( 0, Dbg, ("Cleanup on user file\n") );

            //
            //  If the Scb is uninitialized, we read it from the disk.
            //

            if (!FlagOn( Scb->ScbState, SCB_STATE_HEADER_INITIALIZED )) {

                try {

                    NtfsUpdateScbFromAttribute( IrpContext, Scb, NULL );

                } except( (((Status = GetExceptionCode()) == STATUS_LOG_FILE_FULL) ||
                           (Status == STATUS_CANT_WAIT) ||
                           !FsRtlIsNtstatusExpected( Status ))
                          ? EXCEPTION_CONTINUE_SEARCH
                          : EXCEPTION_EXECUTE_HANDLER ) {

                    NOTHING;
                }
            }

            NtfsSnapshotScb( IrpContext, Scb );

            //
            //  Coordinate the cleanup operation with the oplock state.
            //  Cleanup operations can always cleanup immediately.
            //

            FsRtlCheckOplock( &Scb->ScbType.Data.Oplock,
                              Irp,
                              IrpContext,
                              NULL,
                              NULL );

            //
            //  In this case, we have to unlock all the outstanding file
            //  locks, update the time stamps for the file and sizes for
            //  this attribute, and set the archive bit if necessary.
            //

            if (Scb->ScbType.Data.FileLock != NULL) {

                (VOID) FsRtlFastUnlockAll( Scb->ScbType.Data.FileLock,
                                           FileObject,
                                           IoGetRequestorProcess( Irp ),
                                           NULL );
            }

            //
            //  Update the FastIoField.
            //

            NtfsAcquireFsrtlHeader( Scb );
            Scb->Header.IsFastIoPossible = NtfsIsFastIoPossible( Scb );
            NtfsReleaseFsrtlHeader( Scb );

            //
            //  If the Fcb is in valid shape, we check on the cases where we delete
            //  the file or attribute.
            //

            if (FlagOn( Vcb->VcbState, VCB_STATE_VOLUME_MOUNTED )) {

                //
                //  Capture any changes to the time stamps for this file.
                //

                NtfsUpdateScbFromFileObject( IrpContext, FileObject, Scb, TRUE );

                //
                //  Now set the FO_CLEANUP_COMPLETE flag.
                //

                SetFlag( FileObject->Flags, FO_CLEANUP_COMPLETE );

                //
                //  We are checking here for special actions we take when
                //  we have the last user handle on a link and the link has
                //  been marked for delete.  We could either be removing the
                //  file or removing a link.
                //

                if ((Lcb == NULL) || (LcbLinkIsDeleted( Lcb ) && (Lcb->CleanupCount == 1))) {

                    if (DeleteFile) {

                        //
                        //  If we don't have an Lcb and the Fcb has some entries then
                        //  grab one of these to do the update.
                        //

                        if (Lcb == NULL) {

                            for (Links = Fcb->LcbQueue.Flink;
                                 Links != &Fcb->LcbQueue;
                                 Links = Links->Flink) {

                                ThisLcb = CONTAINING_RECORD( Fcb->LcbQueue.Flink,
                                                             LCB,
                                                             FcbLinks );

                                if (!FlagOn( ThisLcb->LcbState, LCB_STATE_LINK_IS_GONE )) {

                                    Lcb = ThisLcb;

                                    ParentScb = Lcb->Scb;
                                    if (ParentScb != NULL) {

                                        ParentFcb = ParentScb->Fcb;
                                    }

                                    break;
                                }
                            }
                        }

                        //  Now acquire the Parent Scb exclusive while still holding
                        //  the Vcb, to avoid deadlocks.  The Parent Scb is required
                        //  since we will be deleting index entries in it.
                        //

                        if (ParentScb != NULL) {

                            NtfsAcquireExclusiveScb( IrpContext, ParentScb );
                            AcquiredParentScb = TRUE;
                        }

                        try {

                            AddToDelayQueue = FALSE;
                            NtfsDeleteFile( IrpContext, Fcb, ParentScb, &NamePair );
                            TotalLinkAdj += 1;

                            //
                            //  Stash property information in the tunnel if the object was
                            //  opened by name, has a parent directory caller was treating it
                            //  as a non-POSIX object and we had an good, active link
                            //

                            if (!OpenById &&
                                ParentScb &&
                                Ccb->Lcb &&
                                !FlagOn(FileObject->Flags, FO_OPENED_CASE_SENSITIVE)) {

                                FsRtlAddToTunnelCache(  &Vcb->Tunnel,
                                                        *(PULONGLONG)&ParentScb->Fcb->FileReference,
                                                        &NamePair.Short,
                                                        &NamePair.Long,
                                                        BooleanFlagOn(Ccb->Lcb->FileNameAttr->Flags, FILE_NAME_DOS),
                                                        sizeof(LONGLONG),
                                                        &Fcb->Info.CreationTime);
                            }

                            if (ParentFcb != NULL) {

                                NtfsUpdateFcb( ParentFcb );
                            }

                        } except( (((Status = GetExceptionCode()) == STATUS_LOG_FILE_FULL) ||
                                   (Status == STATUS_CANT_WAIT) ||
                                   !FsRtlIsNtstatusExpected( Status ))
                                  ? EXCEPTION_CONTINUE_SEARCH
                                  : EXCEPTION_EXECUTE_HANDLER ) {

                            NOTHING;
                        }

                        if (!OpenById && (Vcb->NotifyCount != 0)) {

                            NtfsReportDirNotify( IrpContext,
                                                 Vcb,
                                                 &Ccb->FullFileName,
                                                 Ccb->LastFileNameOffset,
                                                 NULL,
                                                 ((FlagOn( Ccb->Flags, CCB_FLAG_PARENT_HAS_DOS_COMPONENT ) &&
                                                   Ccb->Lcb != NULL &&
                                                   Ccb->Lcb->Scb->ScbType.Index.NormalizedName.Buffer != NULL) ?
                                                  &Ccb->Lcb->Scb->ScbType.Index.NormalizedName :
                                                  NULL),
                                                 FILE_NOTIFY_CHANGE_FILE_NAME,
                                                 FILE_ACTION_REMOVED,
                                                 ParentFcb );
                        }

                        SetFlag( Fcb->FcbState, FCB_STATE_FILE_DELETED );

                        //
                        //  We need to mark all of the links on the file as gone.
                        //

                        for (Links = Fcb->LcbQueue.Flink;
                             Links != &Fcb->LcbQueue;
                             Links = Links->Flink) {

                            ThisLcb = CONTAINING_RECORD( Links, LCB, FcbLinks );

                            if (ThisLcb->Scb == ParentScb) {

                                //
                                //  Remove all remaining prefixes on this link.
                                //

                                NtfsRemovePrefix( ThisLcb );
                                SetFlag( ThisLcb->LcbState, LCB_STATE_LINK_IS_GONE );

                                //
                                //  We don't need to report any changes on this link.
                                //

                                ThisLcb->InfoFlags = 0;
                            }
                        }

                        //
                        //  We need to mark all of the Scbs as gone.
                        //

                        for (Links = Fcb->ScbQueue.Flink;
                             Links != &Fcb->ScbQueue;
                             Links = Links->Flink) {

                            ThisScb = CONTAINING_RECORD( Links, SCB, FcbLinks );

                            ClearFlag( Scb->ScbState,
                                       SCB_STATE_NOTIFY_ADD_STREAM |
                                       SCB_STATE_NOTIFY_REMOVE_STREAM |
                                       SCB_STATE_NOTIFY_RESIZE_STREAM |
                                       SCB_STATE_NOTIFY_MODIFY_STREAM );

                            if (!FlagOn( ThisScb->ScbState, SCB_STATE_ATTRIBUTE_DELETED )) {

                                NtfsSnapshotScb( IrpContext, ThisScb );

                                ThisScb->ValidDataToDisk =
                                ThisScb->Header.AllocationSize.QuadPart =
                                ThisScb->Header.FileSize.QuadPart =
                                ThisScb->Header.ValidDataLength.QuadPart = 0;

                                SetFlag( ThisScb->ScbState, SCB_STATE_ATTRIBUTE_DELETED );
                            }
                        }

                        //
                        //  We certainly don't need to any on disk update for this
                        //  file now.
                        //

                        Fcb->InfoFlags = 0;
                        ClearFlag( Fcb->FcbState, FCB_STATE_UPDATE_STD_INFO );

                        ClearFlag( Ccb->Flags,
                                   CCB_FLAG_USER_SET_LAST_MOD_TIME |
                                   CCB_FLAG_USER_SET_LAST_CHANGE_TIME |
                                   CCB_FLAG_USER_SET_LAST_ACCESS_TIME );

                        //
                        //  We will truncate the attribute to size 0.
                        //

                        TruncateSize = (PLONGLONG)&Li0;

                    //
                    //  Now we want to check for the last user's handle on a
                    //  link (or the last handle on a Ntfs/8.3 pair).  In this
                    //  case we want to remove the links from the disk.
                    //

                    } else if (Lcb != NULL) {

                        ThisLcb = NULL;
                        RemoveLink = TRUE;

                        if (FlagOn( Lcb->FileNameAttr->Flags, FILE_NAME_DOS | FILE_NAME_NTFS ) &&
                            (Lcb->FileNameAttr->Flags != (FILE_NAME_NTFS | FILE_NAME_DOS))) {

                            //
                            //  Walk through all the links looking for a link
                            //  with a flag set which is not the same as the
                            //  link we already have.
                            //

                            for (Links = Fcb->LcbQueue.Flink;
                                 Links != &Fcb->LcbQueue;
                                 Links = Links->Flink) {

                                ThisLcb = CONTAINING_RECORD( Links, LCB, FcbLinks );

                                //
                                //  If this has a flag set and is not the Lcb
                                //  for this cleanup, then we check if there
                                //  are no Ccb's left for this.
                                //

                                if (FlagOn( ThisLcb->FileNameAttr->Flags, FILE_NAME_DOS | FILE_NAME_NTFS )

                                            &&

                                    (ThisLcb != Lcb)) {

                                    if (ThisLcb->CleanupCount != 0) {

                                         RemoveLink = FALSE;
                                    }

                                    break;
                                }

                                ThisLcb = NULL;
                            }
                        }

                        //
                        //  If we are to remove the link, we do so now.  This removes
                        //  the filename attributes and the entries in the parent
                        //  indexes for this link.  In addition, we mark the links
                        //  as having been removed and decrement the number of links
                        //  left on the file.
                        //

                        if (RemoveLink) {

                            NtfsAcquireExclusiveScb( IrpContext, ParentScb );
                            AcquiredParentScb = TRUE;

                            try {

                                AddToDelayQueue = FALSE;
                                NtfsRemoveLink( IrpContext,
                                                Fcb,
                                                ParentScb,
                                                Lcb->ExactCaseLink.LinkName,
                                                &NamePair );

                                //
                                //  Stash property information in the tunnel if caller opened the
                                //  object by name and was treating it as a non-POSIX object
                                //

                                if (!OpenById && !FlagOn(FileObject->Flags, FO_OPENED_CASE_SENSITIVE)) {

                                    FsRtlAddToTunnelCache(  &Vcb->Tunnel,
                                                            *(PULONGLONG)&ParentScb->Fcb->FileReference,
                                                            &NamePair.Short,
                                                            &NamePair.Long,
                                                            BooleanFlagOn(Lcb->FileNameAttr->Flags, FILE_NAME_DOS),
                                                            sizeof(LONGLONG),
                                                            &Fcb->Info.CreationTime);
                                }

                                TotalLinkAdj += 1;
                                NtfsUpdateFcb( ParentFcb );

                            } except( (((Status = GetExceptionCode()) == STATUS_LOG_FILE_FULL) ||
                                       (Status == STATUS_CANT_WAIT) ||
                                       !FsRtlIsNtstatusExpected( Status ))
                                      ? EXCEPTION_CONTINUE_SEARCH
                                      : EXCEPTION_EXECUTE_HANDLER ) {

                                NOTHING;
                            }

                            if (!OpenById && (Vcb->NotifyCount != 0)) {

                                NtfsReportDirNotify( IrpContext,
                                                     Vcb,
                                                     &Ccb->FullFileName,
                                                     Ccb->LastFileNameOffset,
                                                     NULL,
                                                     ((FlagOn( Ccb->Flags, CCB_FLAG_PARENT_HAS_DOS_COMPONENT ) &&
                                                       Ccb->Lcb != NULL &&
                                                       Ccb->Lcb->Scb->ScbType.Index.NormalizedName.Buffer != NULL) ?
                                                      &Ccb->Lcb->Scb->ScbType.Index.NormalizedName :
                                                      NULL),
                                                     FILE_NOTIFY_CHANGE_FILE_NAME,
                                                     FILE_ACTION_REMOVED,
                                                     ParentFcb );
                            }

                            //
                            //  Remove all remaining prefixes on this link.
                            //

                            NtfsRemovePrefix( Lcb );

                            //
                            //  Mark the links as being removed.
                            //

                            SetFlag( Lcb->LcbState, LCB_STATE_LINK_IS_GONE );

                            if (ThisLcb != NULL) {

                                //
                                //  Remove all remaining prefixes on this link.
                                //

                                NtfsRemovePrefix( ThisLcb );
                                SetFlag( ThisLcb->LcbState, LCB_STATE_LINK_IS_GONE );
                                ThisLcb->InfoFlags = 0;
                            }

                            //
                            //  Since the link is gone we don't want to update the
                            //  duplicate information for this link.
                            //

                            Lcb->InfoFlags = 0;
                            LcbForUpdate = NULL;

                            //
                            //  Update the time stamps for removing the link.  Clear the
                            //  FO_CLEANUP_COMPLETE flag around this call so the time
                            //  stamp change is not nooped.
                            //

                            SetFlag( Ccb->Flags, CCB_FLAG_UPDATE_LAST_CHANGE );
                            ClearFlag( FileObject->Flags, FO_CLEANUP_COMPLETE );
                            NtfsUpdateScbFromFileObject( IrpContext, FileObject, Scb, TRUE );
                            SetFlag( FileObject->Flags, FO_CLEANUP_COMPLETE );
                        }
                    }
                }

                //
                //  If the file/attribute is not going away, we update the
                //  attribute size now rather than waiting for the Lazy
                //  Writer to catch up.  If the cleanup count isn't 1 then
                //  defer the following actions.
                //

                if ((Scb->CleanupCount == 1) && (Fcb->LinkCount != 0)) {

                    //
                    //  We may also have to delete this attribute only.
                    //

                    if (DeleteStream) {

                        ClearFlag( Scb->ScbState, SCB_STATE_DELETE_ON_CLOSE );

                        try {

                            //
                            //  Delete the attribute only.
                            //

                            if (CleanupAttrContext) {

                                NtfsCleanupAttributeContext( &AttrContext );
                            }

                            NtfsInitializeAttributeContext( &AttrContext );
                            CleanupAttrContext = TRUE;

                            NtfsLookupAttributeForScb( IrpContext, Scb, NULL, &AttrContext );

                            do {

                                NtfsDeleteAttributeRecord( IrpContext, Fcb, TRUE, FALSE, &AttrContext );

                            } while (NtfsLookupNextAttributeForScb( IrpContext, Scb, &AttrContext ));

                        } except( (((Status = GetExceptionCode()) == STATUS_LOG_FILE_FULL) ||
                                   (Status == STATUS_CANT_WAIT) ||
                                   !FsRtlIsNtstatusExpected( Status ))
                                   ? EXCEPTION_CONTINUE_SEARCH
                                   : EXCEPTION_EXECUTE_HANDLER ) {

                            SetFlag( Scb->ScbState, SCB_STATE_DELETE_ON_CLOSE );
                        }

                        //
                        //  Set the Scb flag to indicate that the attribute is
                        //  gone.
                        //

                        Scb->ValidDataToDisk =
                        Scb->Header.AllocationSize.QuadPart =
                        Scb->Header.FileSize.QuadPart =
                        Scb->Header.ValidDataLength.QuadPart = 0;

                        SetFlag( Scb->ScbState, SCB_STATE_ATTRIBUTE_DELETED );

                        SetFlag( Scb->ScbState, SCB_STATE_NOTIFY_REMOVE_STREAM );

                        ClearFlag( Scb->ScbState,
                                   SCB_STATE_NOTIFY_RESIZE_STREAM |
                                   SCB_STATE_NOTIFY_MODIFY_STREAM |
                                   SCB_STATE_NOTIFY_ADD_STREAM );

                        //
                        //  Update the time stamps for removing the link.  Clear the
                        //  FO_CLEANUP_COMPLETE flag around this call so the time
                        //  stamp change is not nooped.
                        //

                        SetFlag( Ccb->Flags,
                                 CCB_FLAG_UPDATE_LAST_CHANGE | CCB_FLAG_SET_ARCHIVE );
                        ClearFlag( FileObject->Flags, FO_CLEANUP_COMPLETE );
                        NtfsUpdateScbFromFileObject( IrpContext, FileObject, Scb, TRUE );
                        SetFlag( FileObject->Flags, FO_CLEANUP_COMPLETE );

                        TruncateSize = (PLONGLONG)&Li0;

                    //
                    //  Check if we're to modify the allocation size or file size.
                    //

                    } else {

                        if (FlagOn( Scb->ScbState, SCB_STATE_CHECK_ATTRIBUTE_SIZE )) {

                            //
                            //  Acquire the parent now so we enforce our locking
                            //  rules that the Mft Scb must be acquired after
                            //  the normal file resources.
                            //

                            NtfsPrepareForUpdateDuplicate( IrpContext,
                                                           Fcb,
                                                           &LcbForUpdate,
                                                           &ParentScb,
                                                           TRUE );

                            ClearFlag( Scb->ScbState, SCB_STATE_CHECK_ATTRIBUTE_SIZE );

                            //
                            //  For the non-resident streams we will write the file
                            //  size to disk.
                            //


                            if (!FlagOn( Scb->ScbState, SCB_STATE_ATTRIBUTE_RESIDENT )) {

                                //
                                //  Setting AdvanceOnly to FALSE guarantees we will not
                                //  incorrectly advance the valid data size.
                                //

                                try {

                                    NtfsWriteFileSizes( IrpContext,
                                                        Scb,
                                                        &Scb->Header.ValidDataLength.QuadPart,
                                                        FALSE,
                                                        TRUE );

                                } except( (((Status = GetExceptionCode()) == STATUS_LOG_FILE_FULL) ||
                                           (Status == STATUS_CANT_WAIT) ||
                                           !FsRtlIsNtstatusExpected( Status ))
                                           ? EXCEPTION_CONTINUE_SEARCH
                                           : EXCEPTION_EXECUTE_HANDLER ) {

                                    SetFlag( Scb->ScbState, SCB_STATE_CHECK_ATTRIBUTE_SIZE );
                                }

                            //
                            //  For resident streams we will write the correct size to
                            //  the resident attribute.
                            //

                            } else {

                                //
                                //  We need to lookup the attribute and change
                                //  the attribute value.  We can point to
                                //  the attribute itself as the changing
                                //  value.
                                //

                                NtfsInitializeAttributeContext( &AttrContext );
                                CleanupAttrContext = TRUE;

                                try {

                                    NtfsLookupAttributeForScb( IrpContext, Scb, NULL, &AttrContext );

                                    NtfsChangeAttributeValue( IrpContext,
                                                              Fcb,
                                                              Scb->Header.FileSize.LowPart,
                                                              NULL,
                                                              0,
                                                              TRUE,
                                                              TRUE,
                                                              FALSE,
                                                              FALSE,
                                                              &AttrContext );

                                } except( (((Status = GetExceptionCode()) == STATUS_LOG_FILE_FULL) ||
                                           (Status == STATUS_CANT_WAIT) ||
                                           !FsRtlIsNtstatusExpected( Status ))
                                           ? EXCEPTION_CONTINUE_SEARCH
                                           : EXCEPTION_EXECUTE_HANDLER ) {

                                    SetFlag( Scb->ScbState, SCB_STATE_CHECK_ATTRIBUTE_SIZE );
                                }

                                //
                                //  Verify the allocation size is now correct.
                                //

                                if (QuadAlign( Scb->Header.FileSize.LowPart ) != Scb->Header.AllocationSize.LowPart) {

                                    Scb->Header.AllocationSize.LowPart = QuadAlign(Scb->Header.FileSize.LowPart);
                                }
                            }

                            //
                            //  Update the size change to the Fcb.
                            //

                            NtfsUpdateScbFromFileObject( IrpContext, FileObject, Scb, TRUE );
                        }

#ifdef _CAIRO_
                        if (NtfsPerformQuotaOperation( Fcb )) {

                            if ( FlagOn( Scb->ScbState, SCB_STATE_QUOTA_ENLARGED )) {

                                ASSERT( NtfsIsTypeCodeSubjectToQuota( Scb->AttributeTypeCode ));

                                ASSERT( FlagOn( Scb->ScbState, SCB_STATE_SUBJECT_TO_QUOTA ));

                                //
                                //  Acquire the parent now so we enforce our locking
                                //  rules that the Mft Scb must be acquired after
                                //  the normal file resources.
                                //

                                NtfsPrepareForUpdateDuplicate( IrpContext,
                                                               Fcb,
                                                               &LcbForUpdate,
                                                               &ParentScb,
                                                               TRUE );

                                NtfsContractQuotaToFileSize( IrpContext, Scb );
                            }

                            SetFlag( IrpContext->Flags,
                                     IRP_CONTEXT_FLAG_QUOTA_DISABLE );

                        }
#endif // _CAIRO_

                        if (FlagOn( Scb->ScbState, SCB_STATE_TRUNCATE_ON_CLOSE )) {

                            //
                            //  Acquire the parent now so we enforce our locking
                            //  rules that the Mft Scb must be acquired after
                            //  the normal file resources.
                            //
                            NtfsPrepareForUpdateDuplicate( IrpContext,
                                                           Fcb,
                                                           &LcbForUpdate,
                                                           &ParentScb,
                                                           TRUE );

                            ClearFlag( Scb->ScbState, SCB_STATE_TRUNCATE_ON_CLOSE );

                            //
                            //  We have two cases:
                            //
                            //      Resident:  We are looking for the case where the
                            //          valid data length is less than the file size.
                            //          In this case we shrink the attribute.
                            //
                            //      NonResident:  We are looking for unused clusters
                            //          past the end of the file.
                            //
                            //  We skip the following if we had any previous errors.
                            //

                            if (!FlagOn( Scb->ScbState, SCB_STATE_ATTRIBUTE_RESIDENT )) {

                                //
                                //  We don't need to truncate if the file size is 0.
                                //

                                if (Scb->Header.AllocationSize.QuadPart != 0) {

                                    VCN StartingCluster;
                                    VCN EndingCluster;

                                    //
                                    //  ****    Do we need to give up the Vcb for this
                                    //          call.
                                    //

                                    StartingCluster = LlClustersFromBytes( Vcb, Scb->Header.FileSize.QuadPart );
                                    EndingCluster = LlClustersFromBytes( Vcb, Scb->Header.AllocationSize.QuadPart );

                                    //
                                    //  If there are clusters to delete, we do so now.
                                    //

                                    if (EndingCluster != StartingCluster) {

                                        try {
                                            NtfsDeleteAllocation( IrpContext,
                                                                  FileObject,
                                                                  Scb,
                                                                  StartingCluster,
                                                                  MAXLONGLONG,
                                                                  TRUE,
                                                                  TRUE );

                                        } except( (((Status = GetExceptionCode()) == STATUS_LOG_FILE_FULL) ||
                                                   (Status == STATUS_CANT_WAIT) ||
                                                   !FsRtlIsNtstatusExpected( Status ))
                                                   ? EXCEPTION_CONTINUE_SEARCH
                                                   : EXCEPTION_EXECUTE_HANDLER ) {

                                            SetFlag( Scb->ScbState, SCB_STATE_TRUNCATE_ON_CLOSE );
                                        }
                                    }

                                    LocalTruncateSize = Scb->Header.FileSize.QuadPart;
                                    TruncateSize = &LocalTruncateSize;
                                }

                            //
                            //  This is the resident case.
                            //

                            } else {

                                //
                                //  Check if the file size length is less than
                                //  the allocated size.
                                //

                                if (QuadAlign( Scb->Header.FileSize.LowPart ) < Scb->Header.AllocationSize.LowPart) {

                                    //
                                    //  We need to lookup the attribute and change
                                    //  the attribute value.  We can point to
                                    //  the attribute itself as the changing
                                    //  value.
                                    //

                                    if (CleanupAttrContext) {

                                        NtfsCleanupAttributeContext( &AttrContext );
                                    }

                                    NtfsInitializeAttributeContext( &AttrContext );
                                    CleanupAttrContext = TRUE;

                                    try {

                                        NtfsLookupAttributeForScb( IrpContext, Scb, NULL, &AttrContext );

                                        NtfsChangeAttributeValue( IrpContext,
                                                                  Fcb,
                                                                  Scb->Header.FileSize.LowPart,
                                                                  NULL,
                                                                  0,
                                                                  TRUE,
                                                                  TRUE,
                                                                  FALSE,
                                                                  FALSE,
                                                                  &AttrContext );

                                    } except( (((Status = GetExceptionCode()) == STATUS_LOG_FILE_FULL) ||
                                               (Status == STATUS_CANT_WAIT) ||
                                               !FsRtlIsNtstatusExpected( Status ))
                                               ? EXCEPTION_CONTINUE_SEARCH
                                               : EXCEPTION_EXECUTE_HANDLER ) {

                                        SetFlag( Scb->ScbState, SCB_STATE_TRUNCATE_ON_CLOSE );
                                    }

                                    //
                                    //  Remember the smaller allocation size
                                    //

                                    Scb->Header.AllocationSize.LowPart = QuadAlign(Scb->Header.FileSize.LowPart);
                                    Scb->TotalAllocated = Scb->Header.AllocationSize.QuadPart;
                                }
                            }

                            NtfsUpdateScbFromFileObject( IrpContext, FileObject, Scb, TRUE );
                        }
                    }
                }

                //
                //  If this was the last cached open, and there are open
                //  non-cached handles, attempt a flush and purge operation
                //  to avoid cache coherency overhead from these non-cached
                //  handles later.  We ignore any I/O errors from the flush
                //  except for CANT_WAIT and LOG_FILE_FULL.
                //

                if (!FlagOn( FileObject->Flags, FO_NO_INTERMEDIATE_BUFFERING ) &&
                    (Scb->NonCachedCleanupCount != 0) &&
                    (Scb->CleanupCount == (Scb->NonCachedCleanupCount + 1)) &&
                    (Scb->CompressionUnit == 0) &&
                    (Scb->NonpagedScb->SegmentObject.DataSectionObject != NULL) &&
                    (Scb->NonpagedScb->SegmentObject.ImageSectionObject == NULL) &&
                    MmCanFileBeTruncated( &Scb->NonpagedScb->SegmentObject, NULL )) {

                    //
                    //  Flush and purge the stream.
                    //

                    NtfsFlushAndPurgeScb( IrpContext,
                                          Scb,
                                          NULL );

                    //
                    //  Ignore any errors in this path.
                    //

                    IrpContext->ExceptionStatus = STATUS_SUCCESS;
                }

                if (AddToDelayQueue &&
                    !FlagOn( Scb->ScbState, SCB_STATE_DELAY_CLOSE ) &&
                    NtfsData.DelayedCloseCount <= NtfsMaxDelayedCloseCount &&
                    Fcb->CloseCount == 1) {

                    SetFlag( Scb->ScbState, SCB_STATE_DELAY_CLOSE );

                } else {

                    ClearFlag( Scb->ScbState, SCB_STATE_DELAY_CLOSE );
                }

            //
            //  If the Fcb is bad, we will truncate the cache to size zero.
            //

            } else {

                //
                //  Now set the FO_CLEANUP_COMPLETE flag.
                //

                SetFlag( FileObject->Flags, FO_CLEANUP_COMPLETE );

                TruncateSize = (PLONGLONG)&Li0;
            }

            break;

        default :

            NtfsBugCheck( TypeOfOpen, 0, 0 );
        }

        //
        //  If any of the Fcb Info flags are set we call the routine
        //  to update the duplicated information in the parent directories.
        //  We need to check here in case none of the flags are set but
        //  we want to update last access time.
        //

        if (Fcb->Info.LastAccessTime != Fcb->CurrentLastAccess) {

            if (FlagOn( Fcb->FcbState, FCB_STATE_UPDATE_STD_INFO )) {

                Fcb->Info.LastAccessTime = Fcb->CurrentLastAccess;
                SetFlag( Fcb->InfoFlags, FCB_INFO_CHANGED_LAST_ACCESS );

            } else if (!FlagOn( Fcb->FcbState, FCB_STATE_FILE_DELETED )) {

                NtfsCheckLastAccess( IrpContext, Fcb );
            }
        }

        //
        //  We check if we have to the standard information attribute.
        //  We can only update attributes on mounted volumes.
        //

        if (FlagOn( Fcb->FcbState, FCB_STATE_UPDATE_STD_INFO ) &&
            (Status == STATUS_SUCCESS) &&
            !FlagOn( Scb->ScbState, SCB_STATE_VOLUME_DISMOUNTED )) {

            ASSERT( !FlagOn( Fcb->FcbState, FCB_STATE_FILE_DELETED ));
            ASSERT( TypeOfOpen != UserVolumeOpen );

            try {

                NtfsUpdateStandardInformation( IrpContext, Fcb );

            } except( (((Status = GetExceptionCode()) == STATUS_LOG_FILE_FULL) ||
                       (Status == STATUS_CANT_WAIT) ||
                       !FsRtlIsNtstatusExpected( Status ))
                      ? EXCEPTION_CONTINUE_SEARCH
                      : EXCEPTION_EXECUTE_HANDLER ) {

                NOTHING;
            }
        }

        //
        //  Now update the duplicate information as well for volumes that are still mounted.
        //

        if (!FlagOn( Vcb->VcbState, VCB_STATE_VOLUME_MOUNTED )) {

            //
            //  We shouldn't try to write the duplicate info to a dismounted volume.
            //

            UpdateDuplicateInfo = FALSE;

        } else if (FlagOn( Fcb->InfoFlags, FCB_INFO_DUPLICATE_FLAGS ) ||
                   ((LcbForUpdate != NULL) &&
                    FlagOn( LcbForUpdate->InfoFlags, FCB_INFO_DUPLICATE_FLAGS ))) {

            ASSERT( !FlagOn( Fcb->FcbState, FCB_STATE_FILE_DELETED ));

            NtfsPrepareForUpdateDuplicate( IrpContext, Fcb, &LcbForUpdate, &ParentScb, TRUE );

            //
            //  Now update the duplicate info.
            //

            try {

                NtfsUpdateDuplicateInfo( IrpContext, Fcb, LcbForUpdate, ParentScb );

            } except( (((Status = GetExceptionCode()) == STATUS_LOG_FILE_FULL) ||
                       (Status == STATUS_CANT_WAIT) ||
                       !FsRtlIsNtstatusExpected( Status ))
                      ? EXCEPTION_CONTINUE_SEARCH
                      : EXCEPTION_EXECUTE_HANDLER ) {

                NOTHING;
            }

            UpdateDuplicateInfo = TRUE;
        }

        //
        //  If we have modified the Info structure or security, we report this
        //  to the dir-notify package (except for OpenById cases).
        //

        if (!OpenById) {

            ULONG FilterMatch;

            //
            //  Check whether we need to report on file changes.
            //

            if ((Vcb->NotifyCount != 0) &&
                (UpdateDuplicateInfo || FlagOn( Fcb->InfoFlags, FCB_INFO_MODIFIED_SECURITY ))) {

                //
                //  We map the Fcb info flags into the dir notify flags.
                //

                FilterMatch = NtfsBuildDirNotifyFilter( IrpContext,
                                                        (Fcb->InfoFlags |
                                                         (LcbForUpdate ? LcbForUpdate->InfoFlags : 0) ));

                //
                //  If the filter match is non-zero, that means we also need to do a
                //  dir notify call.
                //

                if (FilterMatch != 0) {

                    NtfsReportDirNotify( IrpContext,
                                         Vcb,
                                         &Ccb->FullFileName,
                                         Ccb->LastFileNameOffset,
                                         NULL,
                                         ((FlagOn( Ccb->Flags, CCB_FLAG_PARENT_HAS_DOS_COMPONENT ) &&
                                           Ccb->Lcb != NULL &&
                                           Ccb->Lcb->Scb->ScbType.Index.NormalizedName.Buffer != NULL) ?
                                          &Ccb->Lcb->Scb->ScbType.Index.NormalizedName :
                                          NULL),
                                         FilterMatch,
                                         FILE_ACTION_MODIFIED,
                                         ParentFcb );
                }
            }

            ClearFlag( Fcb->InfoFlags, FCB_INFO_MODIFIED_SECURITY );

            //
            //  If this is a named stream with changes then report them as well.
            //

            if ((Scb->AttributeName.Length != 0) &&
                NtfsIsTypeCodeUserData( Scb->AttributeTypeCode )) {

                if ((Vcb->NotifyCount != 0) &&
                    FlagOn( Scb->ScbState,
                            SCB_STATE_NOTIFY_REMOVE_STREAM |
                            SCB_STATE_NOTIFY_RESIZE_STREAM |
                            SCB_STATE_NOTIFY_MODIFY_STREAM )) {

                    ULONG Action;

                    FilterMatch = 0;

                    //
                    //  Start by checking for a delete.
                    //

                    if (FlagOn( Scb->ScbState, SCB_STATE_NOTIFY_REMOVE_STREAM )) {

                        FilterMatch = FILE_NOTIFY_CHANGE_STREAM_NAME;
                        Action = FILE_ACTION_REMOVED_STREAM;

                    } else {

                        //
                        //  Check if the file size changed.
                        //

                        if (FlagOn( Scb->ScbState, SCB_STATE_NOTIFY_RESIZE_STREAM )) {

                            FilterMatch = FILE_NOTIFY_CHANGE_STREAM_SIZE;
                        }

                        //
                        //  Now check if the stream data was modified.
                        //

                        if (FlagOn( Scb->ScbState, SCB_STATE_NOTIFY_MODIFY_STREAM )) {

                            SetFlag( FilterMatch, FILE_NOTIFY_CHANGE_STREAM_WRITE );
                        }

                        Action = FILE_ACTION_MODIFIED_STREAM;
                    }

                    NtfsReportDirNotify( IrpContext,
                                         Vcb,
                                         &Ccb->FullFileName,
                                         Ccb->LastFileNameOffset,
                                         &Scb->AttributeName,
                                         ((FlagOn( Ccb->Flags, CCB_FLAG_PARENT_HAS_DOS_COMPONENT ) &&
                                           Ccb->Lcb != NULL &&
                                           Ccb->Lcb->Scb->ScbType.Index.NormalizedName.Buffer != NULL) ?
                                          &Ccb->Lcb->Scb->ScbType.Index.NormalizedName :
                                          NULL),
                                         FilterMatch,
                                         Action,
                                         ParentFcb );
                }

                ClearFlag( Scb->ScbState,
                           SCB_STATE_NOTIFY_ADD_STREAM |
                           SCB_STATE_NOTIFY_REMOVE_STREAM |
                           SCB_STATE_NOTIFY_RESIZE_STREAM |
                           SCB_STATE_NOTIFY_MODIFY_STREAM );
            }
        }

        if (UpdateDuplicateInfo) {

            NtfsUpdateLcbDuplicateInfo( Fcb, LcbForUpdate );
            Fcb->InfoFlags = 0;
        }

        //
        //  Always clear the update standard information flag.
        //

        ClearFlag( Fcb->FcbState, FCB_STATE_UPDATE_STD_INFO );

        //
        //  Let's give up the parent Fcb if we have acquired it.  This will
        //  prevent deadlocks in any uninitialize code below.
        //

        if (AcquiredParentScb) {

            NtfsReleaseScb( IrpContext, ParentScb );
            AcquiredParentScb = FALSE;
        }

        //
        //  Uninitialize the cache map if this file has been cached or we are
        //  trying to delete.
        //

        if ((FileObject->PrivateCacheMap != NULL) || (TruncateSize != NULL)) {

            CcUninitializeCacheMap( FileObject, (PLARGE_INTEGER)TruncateSize, NULL );
        }

        //
        //  Check that the non-cached handle count is consistent.
        //

        ASSERT( !FlagOn( FileObject->Flags, FO_NO_INTERMEDIATE_BUFFERING ) ||
                (Scb->NonCachedCleanupCount != 0 ));

        if (CleanupAttrContext) {

            NtfsCleanupAttributeContext( &AttrContext );
            CleanupAttrContext = FALSE;
        }

        //
        //  Now decrement the cleanup counts.
        //

        NtfsDecrementCleanupCounts( Scb,
                                    LcbForCounts,
                                    BooleanFlagOn( FileObject->Flags, FO_NO_INTERMEDIATE_BUFFERING ));

        //
        //  We remove the share access from the Scb.
        //

        IoRemoveShareAccess( FileObject, &Scb->ShareAccess );

        //
        //  Modify the delete counts in the Fcb.
        //

        if (FlagOn( Ccb->Flags, CCB_FLAG_DELETE_FILE )) {

            Fcb->FcbDeleteFile -= 1;
            ClearFlag( Ccb->Flags, CCB_FLAG_DELETE_FILE );
        }

        if (FlagOn( Ccb->Flags, CCB_FLAG_DENY_DELETE )) {

            Fcb->FcbDenyDelete -= 1;
            ClearFlag( Ccb->Flags, CCB_FLAG_DENY_DELETE );
        }

        //
        //  Since this request has completed we can adjust the total link count
        //  in the Fcb.
        //

        Fcb->TotalLinks -= TotalLinkAdj;

#ifdef _CAIRO_

        //
        //  Release the quota control block.  This does not have to be done
        //  here however, it allows us to free up the quota control block
        //  before the fcb is removed from the table.  This keeps the assert
        //  about quota table empty from triggering in
        //  NtfsClearAndVerifyQuotaIndex.
        //

        if (NtfsPerformQuotaOperation(Fcb) &&
            FlagOn( Fcb->FcbState, FCB_STATE_FILE_DELETED )) {
            NtfsDereferenceQuotaControlBlock( Vcb,
                                              &Fcb->QuotaControl );
        }

#endif // _CAIRO_


    } finally {

        DebugUnwind( NtfsCommonCleanup );

        ClearFlag( IrpContext->Flags, IRP_CONTEXT_FLAG_QUOTA_DISABLE );

        //
        //  Release any resources held.
        //

        NtfsReleaseVcb( IrpContext, Vcb );

        //
        //  We clear the file object pointer in the Ccb.
        //  This prevents us from trying to access this in a
        //  rename operation.
        //

        SetFlag( Ccb->Flags, CCB_FLAG_CLEANUP );

        if (AcquiredScb) {

            NtfsReleaseScb( IrpContext, Scb );
        }

        if (CleanupAttrContext) {

            NtfsCleanupAttributeContext( &AttrContext );
        }

        if (NamePair.Long.Buffer != NamePair.LongBuffer) {

            NtfsFreePool(NamePair.Long.Buffer);
        }

        if (!AbnormalTermination()) {

            NtfsCompleteRequest( &IrpContext, &Irp, Status );
        }

        //
        //  And return to our caller
        //

        DebugTrace( -1, Dbg, ("NtfsCommonCleanup -> %08lx\n", Status) );
    }

    return Status;
}

#ifdef _CAIRO_
VOID
NtfsContractQuotaToFileSize (
    IN PIRP_CONTEXT IrpContext,
    IN PSCB Scb
    )

/*++

Routine Description:

    This routine converts the quota charged for a stream from allocation size
    to file size.  This should only be called for cleanup.

Arguments:

    Scb - Supplies a pointer to the being changed.

Return Value:

    None.

--*/

{
    LONGLONG Delta;
    NTSTATUS Status;

    PAGED_CODE();
    ASSERT( IrpContext->MajorFunction == IRP_MJ_CLEANUP );
    ASSERT(!FlagOn( IrpContext->Flags, IRP_CONTEXT_FLAG_QUOTA_DISABLE ));

    try {

        ASSERT( NtfsIsTypeCodeSubjectToQuota( Scb->AttributeTypeCode ));
        ASSERT( FlagOn( Scb->ScbState, SCB_STATE_SUBJECT_TO_QUOTA ));

        if (FlagOn( Scb->ScbState, SCB_STATE_ATTRIBUTE_RESIDENT )) {

            Delta = (LONG) Scb->Header.FileSize.LowPart -
                           NtfsResidentStreamQuota( Scb->Vcb );
        } else {
            Delta = Scb->Header.FileSize.QuadPart -
                    Scb->Header.AllocationSize.QuadPart;
        }

        if (Delta != 0) {

            NtfsUpdateFileQuota( IrpContext,
                                 Scb->Fcb,
                                 &Delta,
                                 TRUE,
                                 FALSE );
        }

        ClearFlag( Scb->ScbState, SCB_STATE_QUOTA_ENLARGED );

    } except( (((Status = GetExceptionCode()) == STATUS_LOG_FILE_FULL) ||
               (Status == STATUS_CANT_WAIT) ||
               !FsRtlIsNtstatusExpected( Status ))
              ? EXCEPTION_CONTINUE_SEARCH
              : EXCEPTION_EXECUTE_HANDLER ) {

        NOTHING;
    }

}
#endif // _CAIRO_