Completing PreCreate if FltGetFileNameInformation failed

NTFSD
1

Hello.

Is it normal to complete PreCreate with error status if FltGetFileNameInformation was failed?

I think, there is nothing harmful, because PostCreate will be failed with the same status (STATUS_OBJECT_PATH_NOT_FOUND / STATUS_OBJECT_NAME_INVALID / … ).
Is this correct?

Is following code correct?

FLT_PREOP_CALLBACK_STATUS
PtPreCreate (
__inout PFLT_CALLBACK_DATA Data,
__in PCFLT_RELATED_OBJECTS FltObjects,
__deref_out_opt PVOID *CompletionContext
)
{
NTSTATUS Status;
PFLT_FILE_NAME_INFORMATION NameInfo = NULL;

Status = FltGetFileNameInformation( Data, FLT_FILE_NAME_NORMALIZED|FLT_FILE_NAME_QUERY_DEFAULT, &NameInfo );

if (STATUS_SUCCESS != Status)
{
Status = FltGetFileNameInformation( Data, FLT_FILE_NAME_OPENED | FLT_FILE_NAME_QUERY_DEFAULT, &NameInfo);
}

if (NT_SUCCESS(Status))
{
Status = FltParseFileNameInformation( NameInfo );
if (NT_SUCCESS(Status))
{
DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, “PtPreCreate: <%wZ>\n”, &NameInfo->Name);
}
}

if (NameInfo)
{
FltReleaseFileNameInformation(NameInfo);
}

if (FALSE == NT_SUCCESS(Status))
{
DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, “PtPreCreate: Will complete request with Status=0x%08X\n”, Status);
Data->IoStatus.Status = Status;
Data->IoStatus.Information = 0;
return FLT_PREOP_COMPLETE;
}

return FLT_PREOP_SUCCESS_WITH_CALLBACK;
}

Best regards,
Alexey Barabash

2

That sounds right. That’s what I’ve generally been doing. The code looks
good to me at a high level.

However, just FYI, calling FltGetFileNameInformation in preCreate is pretty
bad for performance, particularly if you use FLT_FILE_NAME_NORMALIZED. Also,
the name might not be very reliable (might change when the create actually
reaches the file system).

Thanks,
Alex.

3

Thanks a lot for you reply, Alex.

Best regards,
Alexey Barabash