FltcreateFileEx not using the alloc size param

NTFSD
1

Hello everyone,

I am trying to allocate the size of the file during its creation itself. However, NTFS seems to be ignoring the allocation size parameter.

Here is the code:

desired_access = FILE_GENERIC_WRITE | FILE_GENERIC_READ;
options = FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE;

nt_status = FltCreateFileEx (p_flt_filter, p_instance, p_handle,
p_file_obj, desired_access, &obj_attr, &io_status, &alloc_size,
FILE_ATTRIBUTE_NORMAL, FILE_SHARE_DELETE | FILE_SHARE_WRITE |
FILE_SHARE_READ, FILE_CREATE, options, NULL, 0,
IO_IGNORE_SHARE_ACCESS_CHECK);
if (!NT_SUCCESS (nt_status))
{
goto cleanup;
}

I can see the correct value of the allocation size in the debugger. But somehow, the allocation size is not being applied to the file. The call to FltCreateFile however is completing successfully with io_status.Information being returned as 2 (which is FILE_CREATED).

Any idea what could be going on?

Thank you,
tushar

2

> Any idea what could be going on?

A bug? Me, I’d trace it down to a FAT create and see whether it is being set there.

Remember that Allocation can be trimmed back when the file is closed…

3

> A bug? Me, I’d trace it down to a FAT create and see whether it is being set

there.

Good idea. Let me give it a try with FAT (instead of NTFS where it is already happening) and see what happens.

Remember that Allocation can be trimmed back when the file is closed…
Can you please explain this point?

Thank you,
Tushar

4

Are you using a correct allocation size ?

5

> Remember that Allocation can be trimmed back when the file is closed…

Can you please explain this point?

Probably what Rod meant was that if the file allocation > round_up (eof,
cluster size) during close, then file allocation is trimmed down to round_up
(eof, cluster size).
Probably you were not setting the EOF and hence facing this problem?

Regards,
Ayush Gupta
Software Consultant & Owner,
AI Consulting
http://in.linkedin.com/in/guptaayush