Completing a minifilter I/O without being a name provider?

NTFSD
1

Heya,

I got this message via WinDBG, while checking a filter of mine:
“A filter has completed an operation but does not implement name
provider callbacks.”
What I did was complete a rename operation via
FltSetFileInformation and FLT_PREOP_COMPLETE rather than the usual
PREOP_SUCCESS_xxx_CALLBACK way.

Why is the little filter prick complaining about that :slight_smile:

2

I’d guess that by completing the CBD you are making it possible for a cached FLT_FILENAME_INFORMATION entry to not be invalidated. Or something. The ways of filter manager are weird.

3

Possibly if I were to do it directly, without sending the data down to
the FS, but this was sent down (via FltSetInformationFile)

On 3/1/19, rod_widdowson wrote:
> OSR https://community.osr.com/
> rod_widdowson commented on Completing a minifilter I/O without being a name
> provider?
>
> I’d guess that by completing the CBD you are making it possible for a cached
> FLT_FILENAME_INFORMATION entry to not be invalidated. Or something. The
> ways of filter manager are weird.
>
> –
> Reply to this email directly or follow the link below to check it out:
> https://community.osr.com/discussion/comment/292825#Comment_292825
>
> Check it out:
> https://community.osr.com/discussion/comment/292825#Comment_292825
>

4

this was sent down (via FltSetInformationFile)
yea, but filter verifier doesn’t know that…

5

Good point. At least this is a debugger complaint and not a “Verifier
will crash the system during testing” type error.

At least this is not something my filter is doing bad.

On 3/2/19, rod_widdowson wrote:
> OSR https://community.osr.com/
> rod_widdowson commented on Completing a minifilter I/O without being a name
> provider?
>
>> this was sent down (via FltSetInformationFile)
>
> yea, but filter verifier doesn’t know that…
>
> –
> Reply to this email directly or follow the link below to check it out:
> https://community.osr.com/discussion/comment/292837#Comment_292837
>
> Check it out:
> https://community.osr.com/discussion/comment/292837#Comment_292837
>

6

Related to this: why is replacing the FILE_RENAME_INFORMATION buffer
and passing I/O down not doable? I.e. if I want to redirect a rename.
This was giving me grief, until I noticed the NameChanger sample was
issuing I/O via FltSetInformationFile and explicitly said the regular
“set data dirty” way would cause issues?

7

This old post provides a bit more information on these questions: https://community.osr.com/discussion/162641