FltCbdqInsertIo: Query about return value


From MSDN documentation:
FltCbdqInsertIo returns STATUS_SUCCESS or an appropriate NTSTATUS value such as one of the following:

STATUS_PENDING: The callback data structure was inserted into the callback data queue.

From the documentation, it looks like STATUS_SUCCESS and STATUS_PENDING have the same meaning. Can somebody please clarify this?


Check return status with nt_success macro.
Success and pending both successful return statuses.

I would say that the documentation needs a case raised against it. But blindly speaking I would say that

  • STATUS_PENDING means that you do not own the CBD anymore (because it has been queued)
  • STATUS_SUCCESS means that some other condition means “it worked” but you do own the CBD

I cannot imagine for a minute what could cause the second bullet - which is why I would say that the documentation is incorrect. At the very best it needs to be clarified. I have never used this API and if I ever did I would actually add an assert against STATUS_SUCCESS (because I think its a meaningless return status) and treat it like STATUS_PENDING

It is interesting that cancelsafe sample checks directly for STATUS_SUCCESS and treats any over return status as failure

I thought I could provide some insight into this. But the more I looked into it, the more confused I got.

So, yeah… I’ve got nothin’


Hello All,

Thanks for the reply.

If FltCbdqInsertIo succeeds, I will return FLT_PREOP_PENDING from pre-callback and later after processing of queue, FltCompletePendedPreOperation will be called to resume processing of an I/O.

Till now, I found that FltCbdqInsertIo returning STATUS_SUCCESS(also, cancelsafe sample checks for STATUS_SUCCESS only). So if FltCbdqInsertIo returns STATUS_PENDING, can we consider it as a success(The callback data structure was inserted into the callback data queue) and return FLT_PREOP_PENDING from pre-callback or treat it as a failure like cancelsafe sample does?


So confusing…

FltCbdqInsertIo just calls IoCsqInsertIrpEx, which is documented to return either STATUS_SUCCESS or the result of the CsqInsertIrpEx callback. Presumably (though I have not confirmed) the latter would be the result of your insert callback specified in the call to FltCbdqInitialize.

In the end, I would say the docs are misleading by suggesting STATUS_PENDING as a possible result and it’s safe to just use NT_SUCCESS(status).

Hello Scott, thanks for the suggestion.