Filter driver driving me mad

NTFSD
1

A customer has been reporting a strange problem with my encryption driver
running with XP Pro and SP2 (volume is NTFS). Unfortunately I have never
been able to reproduce it in-house.

What is happening is that a sector of binary zeros is being written at the
end of the file. Almost as if FileEndOfFileInformation or
FileAllocationInformation is being set one sector too high. However, I am
filtering both of them, as well as IRP_MJ_WRITE and it does not appear to be
happening in any of them.

Are there other calls in XP that could affect the file size besides
IRP_MJ_WRITE or IRP_MJ_SET_INFORMATION? In this case, the file is being
opened with NIFB so there is no fastio (confirmed by Filemon). But even if
there was, it would still eventually have to make it down to
set_information, right?

At first I thought it was related to the AV software, but I had them disable
it and the problem was still there.

Any insights or guidance would be greatly appreciated.

Thanks.

2

Hate to ask a “stupid” question – but are you handling all the special
FileOffset sematics (FILE_WRITE_TO_END_OF_FILE, etc) seen in IRP_MJ_WRITE?

/ted

-----Original Message-----
From: Neil Weicher [mailto:xxxxx@netlib.com]
Sent: Thursday, January 26, 2006 9:37 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Filter driver driving me mad

A customer has been reporting a strange problem with my encryption driver
running with XP Pro and SP2 (volume is NTFS). Unfortunately I have never
been able to reproduce it in-house.

What is happening is that a sector of binary zeros is being written at the
end of the file. Almost as if FileEndOfFileInformation or
FileAllocationInformation is being set one sector too high. However, I am
filtering both of them, as well as IRP_MJ_WRITE and it does not appear to be

happening in any of them.

Are there other calls in XP that could affect the file size besides
IRP_MJ_WRITE or IRP_MJ_SET_INFORMATION? In this case, the file is being
opened with NIFB so there is no fastio (confirmed by Filemon). But even if
there was, it would still eventually have to make it down to
set_information, right?

At first I thought it was related to the AV software, but I had them disable

it and the problem was still there.

Any insights or guidance would be greatly appreciated.

Thanks.

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@livevault.com To unsubscribe
send a blank email to xxxxx@lists.osr.com