fltqueryeafile getting failed

NTFSD
1

Hi,
I am writing a minifilter that store some extended attributes when a
file is created and read them for every read and write calls. I am handling
only non cached io calls . But when I try to read the extended attributes,
the call fails with status “STATUS_INVALID_PARAMETER”. I am not able to
understand why this may be happening and would appreciate any help with
this.

Thanks,
Dhirendra

2

How do you call FltQueryEaFile? [btw, this fn is supported Srv03 SP1 -
otherwise you need to use FltAllocateCallbackData+FltPerformSynchronousIo]

What I do:

FILE_EA_INFORMATION fileEA = {0};

NTSTATUS status = FltQueryInformationFile( pInstance, pOrigFO, &fileEA,
sizeof( fileEA ), FileEaInformation, &uLen );

if ( NT_SUCCESS( status ) && uLen && fileEA.EaSize ) {

PVOID pBuffer = myPagedAlloc( fileEA.EaSize );

if ( pBuffer ) {

status = MyFltQueryEaFile( pInstance, pOrigFO, pBuffer,
fileEA.EaSize, FALSE, NULL, 0, 0, TRUE, &uLen );

…

hope it helps,

Petr

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of DHIRENDRA ram
Sent: Monday, March 07, 2011 1:23 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] fltqueryeafile getting failed

Hi,
I am writing a minifilter that store some extended attributes when a
file is created and read them for every read and write calls. I am handling
only non cached io calls . But when I try to read the extended attributes,
the call fails with status “STATUS_INVALID_PARAMETER”. I am not able to
understand why this may be happening and would appreciate any help with
this.

Thanks,
Dhirendra
— NTFSD is sponsored by OSR For our schedule of debugging and file system
seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List
Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

3

Hi Petr,

On Mon, Mar 7, 2011 at 7:50 PM, Petr Kurtin wrote:

> How do you call FltQueryEaFile? [btw, this fn is supported Srv03 SP1 ?
> otherwise you need to use FltAllocateCallbackData+FltPerformSynchronousIo]
>
>
>
> What I do:
>
>
>
> FILE_EA_INFORMATION fileEA = {0};
>
>
>
> NTSTATUS status = FltQueryInformationFile( pInstance, pOrigFO, &fileEA,
> sizeof( fileEA ), FileEaInformation, &uLen );
>
> if ( NT_SUCCESS( status ) && uLen && fileEA.EaSize ) {
>
>
>
> PVOID pBuffer = myPagedAlloc( fileEA.EaSize );
>
> if ( pBuffer ) {
>
>
>
> status = MyFltQueryEaFile( pInstance, pOrigFO, pBuffer, fileEA
> .EaSize, FALSE, NULL, 0, 0, TRUE, &uLen );
>
> …
>
>
>
> hope it helps,
>
> Petr
>

Thanks for your reply.

Also I noticed that when I write to a file many write requests other than
the actual write to the file are also issued. I am able to read the extended
attribute for that file but it fails for the other requests. What are these
additional requests for?

Also are there any good references about file extended attributes in
windows?

Thanks,
Dhirendra.

4

Hi,

On Mon, Mar 7, 2011 at 7:50 PM, Petr Kurtin wrote:

> How do you call FltQueryEaFile? [btw, this fn is supported Srv03 SP1 ?
> otherwise you need to use FltAllocateCallbackData+FltPerformSynchronousIo]
>
>
>
> What I do:
>
>
>
> FILE_EA_INFORMATION fileEA = {0};
>
>
>
> NTSTATUS status = FltQueryInformationFile( pInstance, pOrigFO, &fileEA,
> sizeof( fileEA ), FileEaInformation, &uLen );
>
> if ( NT_SUCCESS( status ) && uLen && fileEA.EaSize ) {
>
>
>
> PVOID pBuffer = myPagedAlloc( fileEA.EaSize );
>
> if ( pBuffer ) {
>
>
>
> status = MyFltQueryEaFile( pInstance, pOrigFO, pBuffer, fileEA
> .EaSize, FALSE, NULL, 0, 0, TRUE, &uLen );
>
> …
>
>
>
> hope it helps,
>
> Petr
>
>
I am setting an extended attribute of size 55 bytes for a file but when I do
FltQueryInformationFile on that file, the fileEA.EaSize is 50 only. Then the
FltQueryEaFile function fails with “STATUS_INVALID_PARAMETER” status. This
remains same even when the buffer in which I query the extended is of size
55 bytes.

Thanks,
Dhirendra