Can't complete pre IRP_MJ_QUERY_INFORMATION request

NTFSD
1

Hi,

I have a very strange issue.

In my mini filter i try to complete pre IRP_MJ_QUERY_INFORMATION request, most of the
time it is ok, but sometime it will still pass down to the lower filter.

The code very simple as following:

if( this is my file )
{
…
fill the buffer with my data.
…
pCallbackData->IoStatus.Status = STATUS_SUCCESS;
FltSetCallbackDataDirty(pCallbackData);
return FLT_PREOP_COMPLETE;
}

I installed another test filter which is lower than my filter, it can get the request.

Anyone know why it can’t complete the pre request?

Thanks.

Tsang

2

After more test, i found that when the following Scenario my filter always can’t complete the pre operation.

STACK_TEXT:
f66fd694 f7130038 f66fd780 88ab0ab8 f66fd6d4 Ntfs!NtfsDecodeFileObject+0x39
f66fd708 f7136ff6 f66fd780 89b3ce28 80a55c86 Ntfs!NtfsCommonQueryInformation+0x56
f66fd76c f713702f f66fd780 89b3ce28 00000001 Ntfs!NtfsFsdDispatchSwitch+0x12a
f66fd888 809ad50c 89641718 89b3ce28 89642280 Ntfs!NtfsFsdDispatchWait+0x1c
f66fd8b8 8081d591 f71b5d28 f66fd8f0 f71b5d28 nt!IovCallDriver+0x112
f66fd8c4 f71b5d28 00000000 89642280 80a55c86 nt!IofCallDriver+0x13
f66fd8f0 809ad50c 89642280 89b3ce28 89642280 fltMgr!FltpDispatch+0x152
f66fd920 8081d591 f71c536d f66fd958 f71c536d nt!IovCallDriver+0x112
f66fd92c f71c536d 00000000 895fe2d8 00000000 nt!IofCallDriver+0x13
f66fd958 f71c7b70 89642280 88ab0ab8 f66fd980 fltMgr!FltpQueryInformationFile+0x99
f66fd9a0 f71b7819 88c10008 00000000 8089589c fltMgr!SetStreamListStandardInformationFlags+0x7e
f66fd9d8 f71b7c94 00000000 88b14560 88b04f14 fltMgr!FltpGetFileNameInformation+0x18d
f66fda00 f6eb9074 06b04f14 00000402 88b14560 fltMgr!FltGetFileNameInformation+0x114
f66fda20 f6eb9a27 88b30f20 88b14528 01000001 msnfsflt!MsNfsFltUnRegisterDynamicThread+0x224
f66fda5c f6ebe748 88c0e030 88b04f14 88c0ff04 msnfsflt!MsNfsFltCheckFileForActivity+0x7e3
f66fdab4 f6ebe920 88b04f14 f66fdaec 00000006 msnfsflt!MsNfsFltPreOpGetFileContext+0x28c
f66fdacc f71b34ca 88b04f14 f66fdaec f66fdb08 msnfsflt!MsNfsFltPreOpFilterSetInformation+0x34
f66fdb2c f71b4f2a 006fdb74 00000000 f66fdb74 fltMgr!FltpPerformPreCallbacks+0x2d4
f66fdb40 f71b58d2 f66fdb74 00000000 88c11440 fltMgr!FltpPassThroughInternal+0x32
f66fdb5c f71b5ce3 f66fdb01 00000000 88c11440 fltMgr!FltpPassThrough+0x1c2
f66fdb8c 809ad50c 88c11440 89a4ae00 89a4afd8 fltMgr!FltpDispatch+0x10d
f66fdbbc 8081d591 808e9043 f66fdc50 808e9043 nt!IovCallDriver+0x112
f66fdbc8 808e9043 00000000 e2061220 0000000d nt!IofCallDriver+0x13
f66fdc50 ba9d39e0 000022ac f66fdca0 e2061220 nt!NtSetInformationFile+0x59f
f66fdcac ba9d3b85 88f4dfe0 e2061178 000003f5 srv!SetPathOrFileInformation+0x289
f66fdcec ba9d5650 88f4dfe0 88f4dfe0 8087ce50 srv!SrvSmbSetFileInformation+0x55b
f66fdd00 ba9d4267 ba9c680c 88f4dfe0 8922b1d8 srv!ExecuteTransaction+0x29e
f66fdd78 ba9b6e87 88f4dfe8 8922b1a0 ba9cb6c7 srv!SrvSmbTransaction+0x7ac
f66fdd84 ba9cb6c7 00000000 88b0a020 00000000 srv!SrvProcessSmb+0xb7
f66fddac 809418f4 0022b1a0 00000000 00000000 srv!WorkerThread+0x138
f66fdddc 80887f7a ba9cb602 8922b1a0 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

First there are a nt!NtSetInformationFile request, my filter didn’t get this request yet, Microsoft NFS filter get the request, it issue FltpQueryInformationFile request, my filter get this request, then i complete this request. But it still go down to the lower filter as stack trace showing.

Can the experts here give me some hint why it doesn’t work?

Thanks
Tsang

3

Are you above or below msnfsflt ?

Thanks,
Alex.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@hotmail.com
Sent: Wednesday, September 15, 2010 7:38 AM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] Can’t complete pre IRP_MJ_QUERY_INFORMATION request

After more test, i found that when the following Scenario my filter always
can’t complete the pre operation.

STACK_TEXT:
f66fd694 f7130038 f66fd780 88ab0ab8 f66fd6d4 Ntfs!NtfsDecodeFileObject+0x39
f66fd708 f7136ff6 f66fd780 89b3ce28 80a55c86
Ntfs!NtfsCommonQueryInformation+0x56
f66fd76c f713702f f66fd780 89b3ce28 00000001
Ntfs!NtfsFsdDispatchSwitch+0x12a
f66fd888 809ad50c 89641718 89b3ce28 89642280 Ntfs!NtfsFsdDispatchWait+0x1c
f66fd8b8 8081d591 f71b5d28 f66fd8f0 f71b5d28 nt!IovCallDriver+0x112
f66fd8c4 f71b5d28 00000000 89642280 80a55c86 nt!IofCallDriver+0x13
f66fd8f0 809ad50c 89642280 89b3ce28 89642280 fltMgr!FltpDispatch+0x152
f66fd920 8081d591 f71c536d f66fd958 f71c536d nt!IovCallDriver+0x112 f66fd92c
f71c536d 00000000 895fe2d8 00000000 nt!IofCallDriver+0x13
f66fd958 f71c7b70 89642280 88ab0ab8 f66fd980
fltMgr!FltpQueryInformationFile+0x99
f66fd9a0 f71b7819 88c10008 00000000 8089589c
fltMgr!SetStreamListStandardInformationFlags+0x7e
f66fd9d8 f71b7c94 00000000 88b14560 88b04f14
fltMgr!FltpGetFileNameInformation+0x18d
f66fda00 f6eb9074 06b04f14 00000402 88b14560
fltMgr!FltGetFileNameInformation+0x114
f66fda20 f6eb9a27 88b30f20 88b14528 01000001
msnfsflt!MsNfsFltUnRegisterDynamicThread+0x224
f66fda5c f6ebe748 88c0e030 88b04f14 88c0ff04
msnfsflt!MsNfsFltCheckFileForActivity+0x7e3
f66fdab4 f6ebe920 88b04f14 f66fdaec 00000006
msnfsflt!MsNfsFltPreOpGetFileContext+0x28c
f66fdacc f71b34ca 88b04f14 f66fdaec f66fdb08
msnfsflt!MsNfsFltPreOpFilterSetInformation+0x34
f66fdb2c f71b4f2a 006fdb74 00000000 f66fdb74
fltMgr!FltpPerformPreCallbacks+0x2d4
f66fdb40 f71b58d2 f66fdb74 00000000 88c11440
fltMgr!FltpPassThroughInternal+0x32
f66fdb5c f71b5ce3 f66fdb01 00000000 88c11440 fltMgr!FltpPassThrough+0x1c2
f66fdb8c 809ad50c 88c11440 89a4ae00 89a4afd8 fltMgr!FltpDispatch+0x10d
f66fdbbc 8081d591 808e9043 f66fdc50 808e9043 nt!IovCallDriver+0x112
f66fdbc8 808e9043 00000000 e2061220 0000000d nt!IofCallDriver+0x13
f66fdc50 ba9d39e0 000022ac f66fdca0 e2061220 nt!NtSetInformationFile+0x59f
f66fdcac ba9d3b85 88f4dfe0 e2061178 000003f5
srv!SetPathOrFileInformation+0x289
f66fdcec ba9d5650 88f4dfe0 88f4dfe0 8087ce50
srv!SrvSmbSetFileInformation+0x55b
f66fdd00 ba9d4267 ba9c680c 88f4dfe0 8922b1d8 srv!ExecuteTransaction+0x29e
f66fdd78 ba9b6e87 88f4dfe8 8922b1a0 ba9cb6c7 srv!SrvSmbTransaction+0x7ac
f66fdd84 ba9cb6c7 00000000 88b0a020 00000000 srv!SrvProcessSmb+0xb7 f66fddac
809418f4 0022b1a0 00000000 00000000 srv!WorkerThread+0x138 f66fdddc 80887f7a
ba9cb602 8922b1a0 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

First there are a nt!NtSetInformationFile request, my filter didn’t get this
request yet, Microsoft NFS filter get the request, it issue
FltpQueryInformationFile request, my filter get this request, then i
complete this request. But it still go down to the lower filter as stack
trace showing.

Can the experts here give me some hint why it doesn’t work?

Thanks
Tsang

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars (including our new fs
mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

4

Thanks Alex. I am below msnfsflt.

5

What do you do in your IRP_MJ_QUERY_INFORMATION ? Do you implement name provider callbacks ?

6

When the user query the information, i will fill my own data to the buffer.

I didn’t implement the name provider.

7

I think I just had a similar problem where my FO reached NTFS but it
wasn’t supposed to.

if( this is my file )

How do you detect this is your file? Are your *absolutely* sure you
always detect *your* files? In my case this was the exact problem.

On 14/09/2010 23:08, xxxxx@hotmail.com wrote:

Hi,

I have a very strange issue.

In my mini filter i try to complete pre IRP_MJ_QUERY_INFORMATION request, most of the
time it is ok, but sometime it will still pass down to the lower filter.

The code very simple as following:

if( this is my file )
{
…
fill the buffer with my data.
…
pCallbackData->IoStatus.Status = STATUS_SUCCESS;
FltSetCallbackDataDirty(pCallbackData);
return FLT_PREOP_COMPLETE;
}

I installed another test filter which is lower than my filter, it can get the request.

Anyone know why it can’t complete the pre request?

Thanks.

Tsang

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

–
Thanos Makatos
Junior Engineer
Storage Systems Research Group - Computer Science Department
Barcelona Supercomputing Center - Centro Nacional de Supercomputación
http://www.bsc.es/StorageSystems

WARNING / LEGAL TEXT: This message is intended only for the use of the
individual or entity to which it is addressed and may contain
information which is privileged, confidential, proprietary, or exempt
from disclosure under applicable law. If you are not the intended
recipient or the person responsible for delivering the message to the
intended recipient, you are strictly prohibited from disclosing,
distributing, copying, or in any way using this message. If you have
received this communication in error, please notify the sender and
destroy and delete any copies you may have received.

http://www.bsc.es/disclaimer.htm

8

>I think I just had a similar problem where my FO reached NTFS but it

wasn’t supposed to.

To get in ahead of Alex… “Do you implement the name providers?”

9

On 16/09/2010 14:40, Rod Widdowson wrote:

> I think I just had a similar problem where my FO reached NTFS but it
> wasn’t supposed to.

To get in ahead of Alex… “Do you implement the name providers?”

I do, the OP doesn’t.

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

–
Thanos Makatos
Junior Engineer
Storage Systems Research Group - Computer Science Department
Barcelona Supercomputing Center - Centro Nacional de Supercomputación
http://www.bsc.es/StorageSystems

WARNING / LEGAL TEXT: This message is intended only for the use of the
individual or entity to which it is addressed and may contain
information which is privileged, confidential, proprietary, or exempt
from disclosure under applicable law. If you are not the intended
recipient or the person responsible for delivering the message to the
intended recipient, you are strictly prohibited from disclosing,
distributing, copying, or in any way using this message. If you have
received this communication in error, please notify the sender and
destroy and delete any copies you may have received.

http://www.bsc.es/disclaimer.htm

10

Hi,Thanos

I am absolutely sure that’s my file.

I added a test filter lower than my filter driver, it can intercept the same request, and i can complete it there without problem.

Thansk
Tsang

11

Which information class are you trying to complete ? How are you completing
it (are you failing it or completing it successfully) ?

Thanks,
Alex.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@hotmail.com
Sent: Thursday, September 16, 2010 7:35 AM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] Can’t complete pre IRP_MJ_QUERY_INFORMATION request

Hi,Thanos

I am absolutely sure that’s my file.

I added a test filter lower than my filter driver, it can intercept the same
request, and i can complete it there without problem.

Thansk
Tsang

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars (including our new fs
mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

12

Hi,Alex

The Infomation class is:FileStandardInformation

I complete it as following.
pCallbackData->IoStatus.Status = STATUS_SUCCESS;
FltSetCallbackDataDirty(pCallbackData);
return FLT_PREOP_COMPLETE;

Thanks
Tsang

13

Ok, so I have a theory about what’s going on. When FltMgr needs to build the name for a file (when someone calls FltGetFileNameInformation) it issues some requests related to the name query. These operations include creates, closes, cleanups, query information and so on. These operations are only related to names and are only shown to name providers. I think this might be why you are not seeing this request in your minifilter.

Could you please explain why you need to com (plete this request ? In general a minifilter doesn’t need to worry about those request if it isn’t a name provider so perhaps it’s ok for you to ignore those requests ? Does anything bad happen or were you just wondering why you don’t see some requests ?

Which OS version is this ?

14

Hi, Alex

I need to complete the query request with my own data when user query some information.

My OS is windows 2003 R2.

I did test on windows 2008 R2, i didn’t see the problem, it will complete the request.

Thanks
Tsang

15

Well, the name cache code is very different between those two releases and I
don’t think the new code actually queries for FileStandardInformation. I’m
not sure whether the old code did so perhaps that’s not what’s going on
here. Could you please try implementing name provider callbacks as a test
and see if it makes the problem go away ?

When I was asking about why you need to complete this request I was hoping
you would explain which fields you change in the structure and what is the
high level architecture of your minifilter. The theory was that you wouldn’t
need to worry about operations generated in the name generation path unless
you actually were a name provider, and I was wondering if you found an
exception. By asking about the architecture of your minifilter I wanted to
see if you need to be a name provider or not…

Thanks,
Alex.