Hi, all
I have a filter, which intercepts IRP_MJ_CREATE
with FILE_OPEN disposition and FILE_READ_DATA
access.
The filter passes the IRP down, and if the file open has succeeded,
it makes some checks (including one non-cached read from the file).
Sometimes it is necessary to deny file opening with
STATUS_ACCESS_DENIED. If so, the filter calls
IoCancelFileOpen on the successfully open file, sets the
Irp->IoStatus to STATUS_ACCESS_DENIED and
returns the same value
BUT. After returning denied status, Driver Verifier
complains that status value returned from my filter
is different from Irp->IoStatus.Status, even if I set this field.
I think this has something to do with the call of IoCompleteRequest,
which was made by underlying FS with STATUS_SUCCESS.
How to correctly do this thing ?
Should I define a completion routine, return
STATUS_MORE_PROCESSING_REQUIRED from it,
do the necessary checks and then resume the completion
with the new status ?
L.