FltCreateFile/Ex STATUS_INVALID_DEVICE_REQUEST

Heya,

I am trying to create a file in our temp folder, during boot. I do
get some calls to succeed but then it fails.
All calls have the same parameters, whether they succeed or not
(apart from the file name).
I am sure the files are on the same volume as my instance, as there
is only one volume.

What things can cause that error?

I’ve never seen the same create parameters fail or not fail with STATUS_INVALID_DEVICE_REQUEST I get that status all the time but it is always to do with me specifying the wrong parameters (so it’s consistent).

If this is NTFS I’d turn on break on status and see if the stack trace tells you anything - having tested it first with a known good fail because I usually immediately jump to the conclusion that its a lower filter and all I’ve done it not set up the values correctly.

I cannot tell you how to set this up (it seems to move with time, but some spelunking in the debugger starting with x ntfs!*status* should get you going.

The other approach is Scott’s wonder status hack

That won’t work, as I cannot do anything with WinDBG at that point yet :frowning:
What’s Scott\s wonder status hack?

When did you see this status in your tests?

I am doubting this is from NTFS, I think it is from FltMgr.

Scott’s hack is basically grepping the sys file for the status (follow the link).

When did you see this status in your tests?
This like `FILE_DELETE_ON_CLOSE’ without correct access specified. Its very picky - it usually takes me a couple of shits with Filetest to get it right.

I am doubting this is from NTFS, I think it is from FltMgr.
That’s ringing vague memories But it was a long time ago that I diagnosed one of those. FltInstance going away maybe? Or perhaps a reparse point issue (reparse point is a hard link to another volume)?

The always same accesss is 0x100020 (which is SYNC and FILE_EXECUTE),
with full share and IO_NONALERT flags.
The incorrect access was my first instinct.

No, the file is surely on the volume, this is a vanilla installation,
and only one volume.

Hmm, “kinda” new information… setting FILE_CREATE instead of FILE_OPEN_IF produces the desired result. But that is very bad.
For me, FILE_CREATE works (and no need to open the file if it does exist), but why that change causes the error is the question.

Still getting some oddball errors here and there, it did not clean up eerything.