Paging IO extend FileSize

NTFSD
1

I know the Paging IO may extend FileSize.
A file size may be extended by PAGING_IO under the following conditions:

1 - IRP_MJ_SET_INFORMATION(FileEndOfFileInformation) w/ AdvanceOnly := TRUE.
This is what Tony refers to as the “big enough” request. In other words -
don’t truncate the file!

2 - IRP_MJ_WRITE, IRP_MN_MDL request can extend the file.

Anybody can clear it?
And in my filter,how can I know this paging IO is for extend the filesize or no.

2

In my test,the #1,IRP_MJ_SET_INFORMATION(FileEndOfFileInformation) with AdvanceOnly is TRUE,sometimes is for extending the filesize,sometimes not.
How can I distinguish it?

And the same question for #2,IRP_MJ_WRITE, IRP_MN_MDL request.

Thanks.

3

> 1 - IRP_MJ_SET_INFORMATION(FileEndOfFileInformation) w/ AdvanceOnly :=

TRUE.
This is what Tony refers to as the “big enough” request. In other words -
don’t truncate the file!
And in my filter,how can I know this paging IO is for extend the filesize
or no.

Yes, the system extends the file size inside the cache manager when the data
has been written beyond the valid data length or when a section is mapped
beyond the end of the file. In this context the PAGING_IO flag means that
the request comes from the Memory Manager or the Cache Manager. So the
question is how to get the current file size. The simplest way is to query
an FSD and then compare the sizes, but another thread might change the file
size after your request for file size has been completed and before the
request to change the file size reaches the FSD. So you can’t be sure
whether the file size will be changed.

2 - IRP_MJ_WRITE, IRP_MN_MDL request can extend the file.

What is so special about this request for you?
This is a request to map the file in the system cache( using zero pages
except the first and last pages ), to lock pages and unmap the file. FSD can
advance the end of the file and the valid data length.

–
Slava Imameyev, xxxxx@hotmail.com

wrote in message news:xxxxx@ntfsd…
>I know the Paging IO may extend FileSize.
> A file size may be extended by PAGING_IO under the following conditions:
>
> 1 - IRP_MJ_SET_INFORMATION(FileEndOfFileInformation) w/ AdvanceOnly :=
> TRUE.
> This is what Tony refers to as the “big enough” request. In other words -
> don’t truncate the file!
>
> 2 - IRP_MJ_WRITE, IRP_MN_MDL request can extend the file.
>
>
> Anybody can clear it?
> And in my filter,how can I know this paging IO is for extend the filesize
> or no.
>

4

That’s to say,If I do a encryption filter,I don’t care about #2.Right?

5

> That’s to say,If I do a encryption filter,I don’t care about #2.Right?

Yes.

–
Slava Imameyev, xxxxx@hotmail.com
wrote in message news:xxxxx@ntfsd…
> That’s to say,If I do a encryption filter,I don’t care about #2.Right?
>