how deal with this issue?

NTFSD
1

I am writing a filesystem filter driver,and i insert a block(512B) to file end,when I received IRP_MJ_CLEANUP,I wtite a block to file end then CallDriver() with IRP_MJ_CLEANUP to filesystem driver.and there is a error I found,I was use mspaint.exe to test the filter driver,when I change a bitmap from 24 bit map to 16 bit map,the file must be smaller,*But I found mapaint.exe write file from file end position,So the file become bigger.How deal with this error?Does I miss some process?please!

2

like this:

NTSTATUS
SecFSWriteFileHeader(
IN PDEVICE_OBJECT DeviceObject,
IN PFILE_OBJECT fileObject,
IN ULONG WriteOffset,
IN PVOID FileBuffer,
IN ULONG FileBufferSize,
IN BOOLEAN ExtendFile
)
{
…

KeInitializeEvent(&Event,SynchronizationEvent,FALSE);

Irp = IoAllocateIrp(DeviceObject->StackSize,FALSE);
if(!Irp){

return FALSE;
}

if(FlagOn(DeviceObject->Flags,DO_BUFFERED_IO )){
Irp->AssociatedIrp.SystemBuffer = FileBuffer;
}else{
Irp->AssociatedIrp.SystemBuffer = NULL;
Irp->UserBuffer = FileBuffer;
}

Irp->UserIosb = &IoStatusBlock;
Irp->UserEvent = &Event;
Irp->Tail.Overlay.Thread = PsGetCurrentThread();
Irp->Tail.Overlay.OriginalFileObject = fileObject;
Irp->RequestorMode = KernelMode;
Irp->Flags = 0;

IoStackLocation = IoGetNextIrpStackLocation(Irp);

IoStackLocation->FileObject = fileObject;
IoStackLocation->MajorFunction = IRP_MJ_WRITE;
IoStackLocation->MinorFunction = 0;
IoSetCompletionRoutine(Irp,SecFSWriteFileHeaderComplete,0, TRUE, TRUE, TRUE);

RC = IoCallDriver(DeviceObject,Irp);
if(RC == STATUS_PENDING){

KeWaitForSingleObject(&Event,Executive,KernelMode,TRUE,0);
}

if(!NT_SUCCESS(RC)){
// KdPrint((“[SecurityFileSystem] SecFSWriteFileHeader IoCallDriver returned error.rc=0x%x\n”,RC));
IoStatusBlock.Status = RC;
}else{
// KdPrint((“[SecurityFileSystem] SecFSWriteFileHeader IoCallDriver Successed.\n”));
}

return IoStatusBlock.Status;

}

NTSTATUS SecFSCleanup(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp)
{
…
RC = SecFSWriteFileHeader(
pdev_ext->AttachedToDeviceObject
,fileObject
,0
,hashEntry->FileHeader
,(SECURITY_FILE_HEADER_SIZE)
, FALSE);

Pass:
return SecFSPassThrough(DeviceObject,Irp);
}