IRP_MJ_WRITE return STATUS_ACCESS_DENIED on Windows Server 2008

Hi, all
My driver is a disk class upperfilter. when I use IoBuildAsynchronousFsdRequest to build a IRP_MJ_WRITE Irp and send the Irp to the lower driver, I recieved error code as STATUS_ACCESS_DENIED. I only get one disk on my computer and the volume on it is C:. I can successfully write the disk on the platform Windows Server 2003. I want to know why it failed and how can I write that disk.

Thanks and regards.

Offhand I’d say because 2008 is a mite stricter on priviledge than 2003 and
2008 ain’t got rights on the 2003 generated media. I’d suggest you set
permissions to allow 2008 the priviledges it needs. Now that is just a
guess, but you really didn’t provide enough information to do more than just
guess.

The personal opinion of
Gary G. Little

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
kuangnuzhiren@163.com
Sent: Tuesday, October 27, 2009 7:05 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] IRP_MJ_WRITE return STATUS_ACCESS_DENIED on Windows Server
2008

Hi, all
My driver is a disk class upperfilter. when I use
IoBuildAsynchronousFsdRequest to build a IRP_MJ_WRITE Irp and send the Irp
to the lower driver, I recieved error code as STATUS_ACCESS_DENIED. I only
get one disk on my computer and the volume on it is C:. I can successfully
write the disk on the platform Windows Server 2003. I want to know why it
failed and how can I write that disk.

Thanks and regards.


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

__________ Information from ESET Smart Security, version of virus signature
database 4547 (20091027) __________

The message was checked by ESET Smart Security.

http://www.eset.com

__________ Information from ESET Smart Security, version of virus signature
database 4547 (20091027) __________

The message was checked by ESET Smart Security.

http://www.eset.com

I also think it is the priviledge that made my writing fail. But which priviledge? I can write the secend disk on that computer using the same code, but when it is the system partition it will fail. My user name is administrator and is a member of administrators.
My code is like this:

LargeInteger.QuadPart = Offset;

NewIrp = IoBuildAsynchronousFsdRequest(
MajorFunction,
DeviceObject,
Buffer,
Length,
&LargeInteger,
&IoStatus);
if (NULL == NewIrp)
{
return Status;
}

KeInitializeEvent(&Event, NotificationEvent, FALSE);

IoSetCompletionRoutine(
NewIrp,
ForwardIrpSynchronouslyCompletion,
&Event,
TRUE,
TRUE,
TRUE);

Status = IoCallDriver(DeviceObject, NewIrp);
if (STATUS_PENDING == Status)
{
(VOID)KeWaitForSingleObject(&Event, Executive, KernelMode, FALSE, NULL);

//lint -save -e40 -e63
Status = NewIrp->IoStatus.Status;
//lint -restore
}

IoCompleteRequest(NewIrp, IO_NO_INCREMENT);

return Status;

Is there anyone knows? Any help will be very grateful.

Thanks.

Theoretically you have the sources for disk.sys in the WDK. There
should be an answer there, guided by a bit of debugging.

On Wednesday, October 28, 2009, wrote:
> Is there anyone knows? Any help will be very grateful.
>
> Thanks.
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
>


Mark Roddy

To which I would like to add that I seriously doubt that
STATUS_ACCESS_DENIED is being directly returned by disk.sys for an
IRP_MJ_WRITE request initiated by a disk upper filter driver.

Mark Roddy

On Wed, Oct 28, 2009 at 6:19 AM, Mark Roddy wrote:
> Theoretically you have the sources for disk.sys in the WDK. There
> should be an answer there, guided by a bit of debugging.
>
>
>
> On Wednesday, October 28, 2009, ? wrote:
>> Is there anyone knows? Any help will be very grateful.
>>
>> Thanks.
>>
>> —
>> NTDEV is sponsored by OSR
>>
>> For our schedule of WDF, WDM, debugging and other seminars visit:
>> http://www.osr.com/seminars
>>
>> To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
>>
>
> –
> Mark Roddy
>

Alex,
You should run !Irp in WinDbg to see who returns this status. It may narrow your problem.

Igor Sharovar

You need to figure out who is failing the IRP. Whenever I need to do this I
usually put an access breakpoint on the IoStatus.Status field of the IRP,
which brings me to the code that’s about to fail the I/O request. You might
not immediately know anything futher from there, but at least it’s a start.
For example:

ba w4 82031ca8 + @@(#FIELD_OFFSET(IRP, IoStatus.Status))

Where 82031ca8 is the IRP address.

-scott


Scott Noone
Consulting Associate
OSR Open Systems Resources, Inc.
http://www.osronline.com

wrote in message news:xxxxx@ntdev…
> Is there anyone knows? Any help will be very grateful.
>
> Thanks.
>

That’s evry helpfull, thanks all.

It seems like the Partmgr called volmgr to judge whether the IRP was send to the system partition, if it was true then the Partmgr failed the IRP. Now I send the IRP to the disk class device object, and it seems work well.