STATUS_IO_REPARSE_DATA_INVALID - modifying reparse point buffers

NTFSD
1

Hello.

I am trying to modify a reparse buffer for a FSCTL_SET_REPARSE_POINT operation. The change is done via modifying the buffer with an extra folder name and using FltFsControlFile, although identical results arise when the call is just passed through and result checked in the postop.

I am getting STATUS_IO_REPARSE_DATA_INVALID error. I verified that the size is correct:

  • InputBufferSize is >8 and <16384 :slight_smile:
  • InputBufferSize = ReparseBuffer.ReparseDataLength + 8
  • ReparseBuffer.ReparseDataLength is PrintNameOffset+PrintNameLength (since the print name offset is larger than the reparse name offset)
    Also verified that:
  • PrintNameOffset is < ReparseNameLength + ReparseNameOffset
  • The file name is correct

What else could be causing this NTSTATUS?

2

I’ve never encountered this, so the best I can suggest is Scott’s article on chasing status’s to their source in ntfs

Please share when you find out what’s up.

3

I was afraid of that :frowning:

Turns out it was quick and easy. NTFS calls
FsRtlValidateReparseBuffer, which does the validation.
The buffer in question had PrintNameOffset set to a value other than
SubstituteNameOffset+SubstituteNameLength+2 (yes, NULL presumed, and
location presumed!). This means that the buffer cannot move the stuff
around, as the documentation states (at least for NTFS).

Dejan.

On 4/8/20, rod_widdowson wrote:
> OSR https://community.osr.com/
>
> rod_widdowson commented on STATUS_IO_REPARSE_DATA_INVALID - modifying
> reparse point buffers
>
> I’ve never encountered this, so the best I can suggest is Scott’s article on
> chasing status’s to their source in ntfs
>
> Please share when you find out what’s up.

4

I should note that this was tested on Server 2008 R2.
Windows 10 is likely to be different in that regard.