IRP_MJ_WIRTE IRP with NULL mdl and write buffer

NTFSD
1

I have written a minifilter driver to do encryption on fly.

When I copy a file (say boo.txt) to a protected folder through a remote system( I have shared the protected folder).

I get the callback for “PreWrite”, the IRP i received has FLTFL_CALLBACK_DATA_IRP_OPERATION set & Iopb->IrpFlags is set with IRP_SYNCHRONOUS_API.
In the IRP, Parameters.Write.MdlAddress is NULL and Parameters.Write.WriteBuffer is NULL. But it has a valid Write.Length.

Why would the buffers be NULL with valid lenght? Do I need to look for the buffers in different place in the IRP? Or am I missing something.

I tried returning error status, but that didn’t help.

Please help,
Thanks,
Saran

2

This is normal. The SMB server expects the FSD to return an MDL into which the server will store the data being written. Normally the MDL is from the cache. This is distinguished by looking at the MinorFunction field of the FLT_IO_PARAMETER_BLOCK.

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

3

Thanks tony I appreciate your help.
I read the DDK and found how IRP_MJ_WRITE-IRP_MN_MDL works.

Looks like for IRP_MJ_READ-IRP_MN_MDL, the data is contained within the buffer upon completion of the initial IRP_MJ_READ-IRP_MN_MDL call.
That means, in my PostRead routine, the data I see in the supplied MDL would be encrypted.So can I decrypt the data right way in the same buffer in my PostRead routine?? or Do I need to do something special in my PreRead Routine?

4

The MDL is from the region in the cache. If you are doing the recommended thing and encrypting your non-cached I/O operations, the data in that MDL should NOT be encrypted.

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com