BUFFER_TOO_SMALL to ObOpenObjectByPointer

NTFSD
1

I have occasionary got an error STATUS_BUFFER_TOO_SMALL
to ObOpenObjectByPointer() in my filter driver.

The code is like this.
status = ObOpenObjectByPointer(fobp,
orignalHandleAttribute,
0,
FILE_WRITE_DATA,
0,
KernelMode,
&handle);

The fobp points an ordinary file opend at loading time.
Even the same thread repeats success and fail to this code.

What does the error code mean and when occurs?
Is there any restriction to call the function for any
particular thread?

Thanks in advance.

Moriwake

2

In writing file system filters I’ve observed that ObOpenObjectByPointer
sometimes sends an IRP_MJ_QUERY_SECURITY to the underlying FSD presumably to
obtain security credentials to perform an access check before it creates a
new handle with additional access. The FSD will return
STATUS_BUFFER_TOO_SMALL if the buffer passed in the IRP_MJ_QUERY_SECURITY
request is too small to contain the security descriptor. I’ve also observed
that ObOpenObjectByPointer passes these errors on to the caller. If you are
developing a filter driver, you could work around the problem there.

Regards,

Rob

-----Original Message-----
From: xxxxx@suri.co.jp [mailto:xxxxx@suri.co.jp]
Sent: Tuesday, March 21, 2000 7:06 AM
To: File Systems Developers
Cc: xxxxx@suri.co.jp
Subject: [ntfsd] BUFFER_TOO_SMALL to ObOpenObjectByPointer

I have occasionary got an error STATUS_BUFFER_TOO_SMALL
to ObOpenObjectByPointer() in my filter driver.

The code is like this.
status = ObOpenObjectByPointer(fobp,
orignalHandleAttribute,
0,
FILE_WRITE_DATA,
0,
KernelMode,
&handle);

The fobp points an ordinary file opend at loading time.
Even the same thread repeats success and fail to this code.

What does the error code mean and when occurs?
Is there any restriction to call the function for any
particular thread?

Thanks in advance.

Moriwake

You are currently subscribed to ntfsd as: xxxxx@nsisw.com
To unsubscribe send a blank email to $subst(‘Email.Unsub’)

3

Thank you for your suggestion.

Still it sounds peculiar, the same thread got error then succeeds to
obtain a handle while no one change the security of the file.
Object Maneger ‘sometimes’ checks accesibility?

Moriwake

In article <lyr1477-1104-2000.03.21-08.58.12–mori>
xxxxx@NSISW.COM writes:
>In writing file system filters I’ve observed that ObOpenObjectByPointer
>sometimes sends an IRP_MJ_QUERY_SECURITY to the underlying FSD presumably to
>obtain security credentials to perform an access check before it creates a
>new handle with additional access. The FSD will return
>STATUS_BUFFER_TOO_SMALL if the buffer passed in the IRP_MJ_QUERY_SECURITY
>request is too small to contain the security descriptor. I’ve also observed
>that ObOpenObjectByPointer passes these errors on to the caller. If you are
>developing a filter driver, you could work around the problem there.
>
>Regards,
>
>Rob
>
>-----Original Message-----
>From: xxxxx@suri.co.jp [mailto:xxxxx@suri.co.jp]
>Sent: Tuesday, March 21, 2000 7:06 AM
>To: File Systems Developers
>Cc: xxxxx@suri.co.jp
>Subject: [ntfsd] BUFFER_TOO_SMALL to ObOpenObjectByPointer
>
>
>I have occasionary got an error STATUS_BUFFER_TOO_SMALL
>to ObOpenObjectByPointer() in my filter driver.
>
>The code is like this.
> status = ObOpenObjectByPointer(fobp,
> orignalHandleAttribute,
> 0,
> FILE_WRITE_DATA,
> 0,
> KernelMode,
> &handle);
>
>The fobp points an ordinary file opend at loading time.
>Even the same thread repeats success and fail to this code.
>
>What does the error code mean and when occurs?
>Is there any restriction to call the function for any
>particular thread?
>
>Thanks in advance.
>----
>Moriwake
>
>—
>You are currently subscribed to ntfsd as: xxxxx@nsisw.com
>To unsubscribe send a blank email to $subst(‘Email.Unsub’)
>
>—
>You are currently subscribed to ntfsd as: xxxxx@suri.co.jp
>To unsubscribe send a blank email to $subst(‘Email.Unsub’)
>
></lyr1477-1104-2000.03.21-08.58.12–mori>

4

I said, “sometimes sends an IRP_MJ_QUERY_SECURITY.” This isn’t necessary
for filesystems that don’t support security, such as FASTFAT. Does this
clarify things?

-----Original Message-----
From: xxxxx@suri.co.jp [mailto:xxxxx@suri.co.jp]
Sent: Tuesday, March 21, 2000 11:46 PM
To: File Systems Developers
Cc: xxxxx@suri.co.jp
Subject: [ntfsd] RE: BUFFER_TOO_SMALL to ObOpenObjectByPointer

Thank you for your suggestion.

Still it sounds peculiar, the same thread got error then succeeds to
obtain a handle while no one change the security of the file.
Object Maneger ‘sometimes’ checks accesibility?

Moriwake

In article <lyr1477-1104-2000.03.21-08.58.12–mori>
xxxxx@NSISW.COM writes:
>In writing file system filters I’ve observed that ObOpenObjectByPointer
>sometimes sends an IRP_MJ_QUERY_SECURITY to the underlying FSD presumably
to
>obtain security credentials to perform an access check before it creates a
>new handle with additional access. The FSD will return
>STATUS_BUFFER_TOO_SMALL if the buffer passed in the IRP_MJ_QUERY_SECURITY
>request is too small to contain the security descriptor. I’ve also
observed
>that ObOpenObjectByPointer passes these errors on to the caller. If you
are
>developing a filter driver, you could work around the problem there.
>
>Regards,
>
>Rob
>
>-----Original Message-----
>From: xxxxx@suri.co.jp [mailto:xxxxx@suri.co.jp]
>Sent: Tuesday, March 21, 2000 7:06 AM
>To: File Systems Developers
>Cc: xxxxx@suri.co.jp
>Subject: [ntfsd] BUFFER_TOO_SMALL to ObOpenObjectByPointer
>
>
>I have occasionary got an error STATUS_BUFFER_TOO_SMALL
>to ObOpenObjectByPointer() in my filter driver.
>
>The code is like this.
> status = ObOpenObjectByPointer(fobp,
> orignalHandleAttribute,
> 0,
> FILE_WRITE_DATA,
> 0,
> KernelMode,
> &handle);
>
>The fobp points an ordinary file opend at loading time.
>Even the same thread repeats success and fail to this code.
>
>What does the error code mean and when occurs?
>Is there any restriction to call the function for any
>particular thread?
>
>Thanks in advance.
>----
>Moriwake
>
>—
>You are currently subscribed to ntfsd as: xxxxx@nsisw.com
>To unsubscribe send a blank email to $subst(‘Email.Unsub’)
>
>—
>You are currently subscribed to ntfsd as: xxxxx@suri.co.jp
>To unsubscribe send a blank email to $subst(‘Email.Unsub’)
>
>

—
You are currently subscribed to ntfsd as: xxxxx@nsisw.com
To unsubscribe send a blank email to $subst(‘Email.Unsub’)</lyr1477-1104-2000.03.21-08.58.12–mori>