PreAcquireForSectionSynchronization call back

NTFSD
1

I am in the context of the PreAcquireForSectionSynchronization call back and
would like to open the file that is being referred to by the
Data->FileObject->Filename for READ access, read the data, and then close it
before
this call is allowed to proceed.

I have enclosed a copy of the "open " that I’ve been using with most
everything else when I need to read a file, but it does not work here!

Can you advise me about a strategy that will work.

PS. I have gone through “The NT Insider:Finding File Contents in Memory”
article from OSR.
It does not cover all cases and is only about 80% complete, furthermore, it
does not deal with files larger that 256K, . The articles references
structures that have no IFS kit documentation.

InitializeObjectAttributes(&ObjAttrs,InFile,OBJ_KERNEL_HANDLE|OBJ_CASE_INSEN
SITIVE,NULL,NULL);
//

Status =
ZwCreateFile(&FileHandle,GENERIC_READ|FILE_READ_ATTRIBUTES|FILE_READ_DATA,
&ObjAttrs,&StatusBlock,0, //allocation size
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ|FILE_SHARE_DELETE, //share access
FILE_OPEN, // disposition
FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT, // CreateOptions,
0, // EaBuffer OPTIONAL,
0 ); // EaLength

}

2

You don’t say where you are getting InFile from, but in general you cannot
rely on the name in the File Object any time after you the PreCreate Call…

If this is a minifilter have a look at FltGetFileNameInformation (and avoid
ZwCreateFile). If it isn’t, you’ll might want to consider squirrelling away
the filename during CREATE.

/rod

3

Larry,

It is not safe to open a file from this callback. At times your system
will deadlock if you do this.

This is true for all of the following operations:
FS_FILTER_ACQUIRE_FOR_SECTION_SYNCHRONIZATION
FS_FILTER_RELEASE_FOR_SECTION_SYNCHRONIZATION
FS_FILTER_ACQUIRE_FOR_MOD_WRITE
FS_FILTER_RELEASE_FOR_MOD_WRITE
FS_FILTER_ACQUIRE_FOR_CC_FLUSH
FS_FILTER_RELEASE_FOR_CC_FLUSH

Neal Christiansen
Microsoft File System Filter Group Lead
This posting is provided “AS IS” with no warranties, and confers no
Rights

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Larry
Sent: Wednesday, June 22, 2005 2:21 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] PreAcquireForSectionSynchronization call back

I am in the context of the PreAcquireForSectionSynchronization call back
and
would like to open the file that is being referred to by the
Data->FileObject->Filename for READ access, read the data, and then
close it
before
this call is allowed to proceed.

I have enclosed a copy of the "open " that I’ve been using with most
everything else when I need to read a file, but it does not work here!

Can you advise me about a strategy that will work.

PS. I have gone through “The NT Insider:Finding File Contents in
Memory”
article from OSR.
It does not cover all cases and is only about 80% complete, furthermore,
it
does not deal with files larger that 256K, . The articles references
structures that have no IFS kit documentation.

InitializeObjectAttributes(&ObjAttrs,InFile,OBJ_KERNEL_HANDLE|OBJ_CASE_I
NSEN
SITIVE,NULL,NULL);
//

Status =
ZwCreateFile(&FileHandle,GENERIC_READ|FILE_READ_ATTRIBUTES|FILE_READ_DAT
A,
&ObjAttrs,&StatusBlock,0, //allocation size
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ|FILE_SHARE_DELETE, //share access
FILE_OPEN, // disposition
FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT, // CreateOptions,
0, // EaBuffer OPTIONAL,
0 ); // EaLength

}

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com