I am getting the following error in my pre-read callback in my minifilter on W2K8 R2, but I don’t understand why, b/c as you can see below I am not violating the conditions defined in the message (i.e. IRQL is PASSIVE, IrpFlags says this is a non-cached op, and according to the message APCs are enabled).
I am seeing this for calls to FltCreateFileEx, FltQueryInformationFile, and FltClose.
Any ideas?
FILTER VERIFIER ERROR: A filter tried to issue IO at an incorrect IRQL level, or with Special Kernel APCs disabled.
(Filter = FFFFFA80018C45B0 (MyDriver), MajorCode = 0x0, IsPaging = 0x0, NonCached = 0x0, IRP_MN_MDL = 0x0, IRQL = 0x0, Special Kernel APCs Enabled = 0x1)
kd> !irql
Debugger saved IRQL for processor 0x0 – 0 (LOW_LEVEL)
kd> ?? Data->Iopb
struct _FLT_IO_PARAMETER_BLOCK * 0xfffffa8002729338 +0x000 IrpFlags : 0x40000101 +0x004 MajorFunction : 0x3 '' +0x005 MinorFunction : 0 '' +0x006 OperationFlags : 0 '' +0x007 Reserved : 0 '' +0x008 TargetFileObject : 0xfffffa80
018b8090 _FILE_OBJECT
+0x010 TargetInstance : 0xfffffa80`01e9ac30 _FLT_INSTANCE
+0x018 Parameters : _FLT_PARAMETERS
I am calling FltCreateFileEx like this, but I suspect the parameters don’t really matter since it fails the same way calling FltClose at times.
status = FltCreateFileEx(g_FilterHandle,
Instance,
&hFile,
&pOfflineFO,
FILE_READ_ATTRIBUTES | SYNCHRONIZE,
&oa,
&Iosb,
NULL,
0,
FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
FILE_OPEN,
FILE_NON_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_ALERT,
NULL,
0,
0);