IRP_MJ_QUERY_INFORMATION failed on remote file

In my filter driver, when I process IRP_MJ_CLEANUP, I call
IRP_MJ_QUERY_INFORMATION/FileStandardInformation.

If the fileobject is local (c:\test.txt), IRP_MJ_QUERY_INFORMATION works
fine, IoCallDriver() returns STATUS_SUCCESS.

If the fileobject is remote (\server\test.txt),
IRP_MJ_QUERY_INFORMATION fails on IoCallDriver()/KeWaitForSingleObject()
In this case, IoCallDriver() returns STATUS_PENDING, the Completion
routine is not called and KeWaitForSingleObject() never returns !

I have tried to remplace FileStandardInformation by FileNameInformation
In this case, all works fine. Even if the fileobject is remote, I can
get information correctly

Just for testing, I call my routine from IRP_MJ_CREATE/FILE_OPEN. In
this case all works fine.

In this thread, http://www.osronline.com/showThread.cfm?link=7511, there
are several suggestions:
* adding irp->Flags = IRP_NOCACHE;
there is no amelioration
* forcing FO_SYNCHRONOUS_IO on pFileObject->Flags
A very bad idea in this case. Now, IoCallDriver() returns
STATUS_OBJECT_NAME_NOT_FOUND !

Why IRP_MJ_QUERY_INFORMATION/FileNameInformation works fine and
IRP_MJ_QUERY_INFORMATION/FileStandardInformation
failed on remote file ?
IRP_MJ_CLEANUP can’t handle
IRP_MJ_QUERY_INFORMATION/FileStandardInformation for remote file?

Regards,

my code is as follows:
NTSTATUS MyCompletionRoutine(PDEVICE_OBJECT DeviceObject, PIRP Irp,
PVOID Context)
{
KdPrint((“MyCompletionRoutine()\n”));
*Irp->UserIosb = Irp->IoStatus;
KeSetEvent(Irp->UserEvent, 0, FALSE);
IoFreeIrp(Irp);
return STATUS_MORE_PROCESSING_REQUIRED;
}
NTSTATUS MyFileStandardInformation(PDEVICE_OBJECT DeviceObject,
PFILE_OBJECT FileObject)
{
PIRP irp;
KEVENT event;
IO_STATUS_BLOCK IoStatusBlock;
PIO_STACK_LOCATION ioStackLocation;
FILE_STANDARD_INFORMATION Buffer;
NTSTATUS status;

KeInitializeEvent(&event, SynchronizationEvent, FALSE);
irp = IoAllocateIrp(DeviceObject->StackSize, FALSE);
irp->AssociatedIrp.SystemBuffer = &Buffer;
irp->UserEvent = &event;
IoStatusBlock.Status = STATUS_SUCCESS;
irp->UserIosb = &IoStatusBlock;
irp->Tail.Overlay.Thread = PsGetCurrentThread();
irp->Tail.Overlay.OriginalFileObject = FileObject;
irp->RequestorMode = KernelMode;
irp->Flags = 0;
ioStackLocation = IoGetNextIrpStackLocation(irp);
ioStackLocation->MajorFunction = IRP_MJ_QUERY_INFORMATION;
ioStackLocation->DeviceObject = DeviceObject;
ioStackLocation->FileObject = FileObject;
ioStackLocation->Parameters.QueryFile.Length =
sizeof(FILE_STANDARD_INFORMATION);
ioStackLocation->Parameters.QueryFile.FileInformationClass =
FileStandardInformation;
IoSetCompletionRoutine(irp, MyCompletionRoutine, 0, TRUE, TRUE, TRUE);
status = IoCallDriver(DeviceObject, irp);
KeWaitForSingleObject(&event, Executive, KernelMode, TRUE, 0);
return IoStatusBlock.Status;
}

RDR behavior definitely is not the same as local file systems.

Have you monitored the server side to see if the request ever arrives? If it doesn’t, it sounds like there’s something that is just wrong with the request that you are sending RDR. If it does, verify the request is being satisifed by the server.

Can you confirm:

  • You are sending this in the dispatch entry point for cleanup?
  • Your code is running at PASSIVE_LEVEL?

Also, did YOU open this file, or did you piggyback on someone else’s open. If so, do you know what the open parameters were?

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

xxxxx@osr.com a écrit :

RDR behavior definitely is not the same as local file systems.

Have you monitored the server side to see if the request ever arrives? If it doesn’t, it sounds like there’s something that is just wrong with the request that you are sending RDR. If it does, verify the request is being satisifed by the server.

On server side, I never see these requests
in this case, RDR seems to handle locally some IRP_MJ_QUERY_INFORMATION
requests

Can you confirm:

  • You are sending this in the dispatch entry point for cleanup?
  • Your code is running at PASSIVE_LEVEL?

Yes, I create a new irp IRP_MJ_QUERY_INFORMATION from my IRP_MJ_CLEANUP
dispatch routine
As expected, KeGetCurrentIrql() returns PASSIVE_LEVEL.

Also, did YOU open this file, or did you piggyback on someone else’s open. If so, do you know what the open parameters were?

The file is open by user process, and my driver filters several IRP_*.
In case of IRP_MJ_CLEANUP, the file is open for deletion operation
for testing, I use DeleteFile API
void main(…)
{
DeleteFile(argv[1]);
}

When my driver is inactive, DeleteFile(“d:\local”) generates (trace from
filemon.exe)
IRP_MJ_CREATE D:\local SUCCESS Options: Open Access: 00010080
IRP_MJ_QUERY_INFORMATION D:\local SUCCESS
FileAttributeTagInformation
IRP_MJ_SET_INFORMATION D:\local SUCCESS Delete
IRP_MJ_CLEANUP D:\local SUCCESS
IRP_MJ_CLOSE D:\local SUCCESS

when my filter driver is active:
IRP_MJ_CREATE D:\local SUCCESS Options: Open Access: 00010080
IRP_MJ_QUERY_INFORMATION D:\local SUCCESS
FileAttributeTagInformation
IRP_MJ_QUERY_INFORMATION D:\local SUCCESS FileNameInformation
IRP_MJ_QUERY_INFORMATION D:\local SUCCESS
FileStandardInformation
IRP_MJ_CLEANUP D:\local SUCCESS
IRP_MJ_CLOSE D:\local SUCCESS
We can see my FileNameInformation & FileStandardInformation requests
from my driver

deletete on remote file
DeleteFile(“\server\share\remote”) generates on remote server
(“E:\share\remote” is “\server\share\remote”)
IRP_MJ_CREATE E:\share\remote SUCCESS Options: Open Access:
All
IRP_MJ_QUERY_INFORMATION E:\share\remote SUCCESS
FileBasicInformation
IRP_MJ_CLEANUP E:\share\remote SUCCESS
IRP_MJ_CLOSE E:\share\remote SUCCESS
IRP_MJ_CREATE E:\share\remote SUCCESS Options: Open Access:
All
IRP_MJ_QUERY_INFORMATION E:\share\remote SUCCESS
FileInternalInformation
IRP_MJ_CLEANUP E:\share\remote SUCCESS
IRP_MJ_CLOSE E:\share\remote SUCCESS
IRP_MJ_CREATE E:\share\remote SUCCESS Options: Open Access:
Delete
IRP_MJ_SET_INFORMATION E:\share\remote SUCCESS Delete
IRP_MJ_CLEANUP E:\share\remote SUCCESS
IRP_MJ_CLOSE E:…\share\remote SUCCESS
IRP_MJ_CLOSE E:\share\remote SUCCESS

But when my driver is active, the trace is identical : I never see
FileNameInformation & FileStandardInformation request

Regards,