NtQueryAttributesFile() and FAST I/O

NTFSD
1

Hi, guys
I see a fast i/o operation in my post callback:
ee344d54 8054164c 008cf5f4 008cf5cc 008cf620 nt!NtQueryAttributesFile+0xf1
ee344d54 7c90e514 008cf5f4 008cf5cc 008cf620 nt!KiFastCallEntry+0xfc
008cf5ac 7c90d71a 7c916ec2 008cf5f4 008cf5cc ntdll!KiFastSystemCallRet
008cf5b0 7c916ec2 008cf5f4 008cf5cc 00000012 ntdll!NtQueryAttributesFile+0xc

How can I access an issuer?s data buffers during fast i/o?
Maybe the only way is to return FLT_PREOP_DISALLOW_FASTIO from the Pre cb forcing the issuer to send an IRP instead of fast i/o?

Thanks in advance,
Dmitry.

2

In FltMgr it will be where you expect it. But bear in mind that this is the
user buffer so you will need to take the usual precautions (probe first and
access within a try/except).

Legacy it’s off the Irp somewhere. ISTR that its UserBuffer…

wrote in message news:xxxxx@ntfsd…

Hi, guys
I see a fast i/o operation in my post callback:
ee344d54 8054164c 008cf5f4 008cf5cc 008cf620 nt!NtQueryAttributesFile+0xf1
ee344d54 7c90e514 008cf5f4 008cf5cc 008cf620 nt!KiFastCallEntry+0xfc
008cf5ac 7c90d71a 7c916ec2 008cf5f4 008cf5cc ntdll!KiFastSystemCallRet
008cf5b0 7c916ec2 008cf5f4 008cf5cc 00000012 ntdll!NtQueryAttributesFile+0xc

How can I access an issuer?s data buffers during fast i/o?
Maybe the only way is to return FLT_PREOP_DISALLOW_FASTIO from the Pre cb
forcing the issuer to send an IRP instead of fast i/o?

Thanks in advance,
Dmitry.

3

Rod, as always, thanks.
Dmitry.