PreRead and PreWrite.

NTFSD
1

Hi.

Can anyone see a problem with the two functions below? The problem I seem to have is with the line below.

NtStatus = FltGetFileNameInformation(pFltCallbackData, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &pFltFileNameInformation);

FLT_PREOP_CALLBACK_STATUS PreRead (IN OUT PFLT_CALLBACK_DATA pFltCallbackData, IN PCFLT_RELATED_OBJECTS PcFltRelatedObjects, __deref_out_opt PVOID *pVoidCompletionContext)
{
PSTREAM_HANDLE_CONTEXT pStreamHandleContext;
PFLT_FILE_NAME_INFORMATION pFltFileNameInformation;
NTSTATUS NtStatus;
BOOLEAN bFile;
PFILE_OBJECT pFileObject;

UNREFERENCED_PARAMETER (pVoidCompletionContext);

DbgPrint(“PreRead Called.\n”);

if (IoThreadToProcess(pFltCallbackData->Thread) == gData.pEprocess) return FLT_PREOP_SUCCESS_NO_CALLBACK;
if (!NT_SUCCESS(pFltCallbackData->IoStatus.Status) || (pFltCallbackData->IoStatus.Status == STATUS_REPARSE)) return FLT_PREOP_COMPLETE;

NtStatus = FltGetFileNameInformation(pFltCallbackData, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &pFltFileNameInformation);
if (!NT_SUCCESS(NtStatus)) return FLT_PREOP_COMPLETE;

FltParseFileNameInformation (pFltFileNameInformation);
NtStatus = File(pFltCallbackData, PcFltRelatedObjects, pFltFileNameInformation, FALSE, FALSE, TRUE, FALSE, IoThreadToProcess(pFltCallbackData->Thread));

return NtStatus;
}

FLT_PREOP_CALLBACK_STATUS PreWrite (IN OUT PFLT_CALLBACK_DATA pFltCallbackData, IN PCFLT_RELATED_OBJECTS PcFltRelatedObjects, __deref_out_opt PVOID *pVoidCompletionContext)
{
PSTREAM_HANDLE_CONTEXT pStreamHandleContext;
PFLT_FILE_NAME_INFORMATION pFltFileNameInformation;
NTSTATUS NtStatus;
BOOLEAN bFile;
PFILE_OBJECT pFileObject;

UNREFERENCED_PARAMETER (pVoidCompletionContext);

DbgPrint(“PreWrite Called.\n”);

if (IoThreadToProcess(pFltCallbackData->Thread) == gData.pEprocess) return FLT_PREOP_SUCCESS_NO_CALLBACK;
if (!NT_SUCCESS(pFltCallbackData->IoStatus.Status) || (pFltCallbackData->IoStatus.Status == STATUS_REPARSE)) return FLT_PREOP_COMPLETE;

NtStatus = FltGetFileNameInformation(pFltCallbackData, FLT_FILE_NAME_NORMALIZED | FLT_FILE_NAME_QUERY_DEFAULT, &pFltFileNameInformation);
if (!NT_SUCCESS(NtStatus)) return FLT_PREOP_COMPLETE;

FltParseFileNameInformation (pFltFileNameInformation);
NtStatus = File(pFltCallbackData, PcFltRelatedObjects, pFltFileNameInformation, FALSE, FALSE, TRUE, FALSE, IoThreadToProcess(pFltCallbackData->Thread));

return NtStatus;
}

2

What is the problem?
Does the call fail? If so, what is the error no.?

You should read about the error values returned by the API and then check for the problem.
I guess you are hitting STATUS_FLT_INVALID_NAME_REQUEST
Documentation says that:
“FltGetFileNameInformation cannot get file name information in the paging I/O path.”

You can set FLTFL_OPERATION_REGISTRATION_SKIP_PAGING_IO when registering the PreRead callback?

Further, the below statement is not sufficient.

if (!NT_SUCCESS(NtStatus)) return FLT_PREOP_COMPLETE;
You should also set the error no. in Data->IoStatus.Status field.

3

Well… setting FLTFL_OPERATION_REGISTRATION_SKIP_PAGING_IO might not be the
solution since the OP might actually need a read/ write callback for paging
I/O.
He should query it in Pre/Post create and use that name via stream context
stuff. Ofcourse, he should manage the ususal rename cases.

Regards,
Ayush Gupta
AI Consulting

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@yahoo.com
Sent: Tuesday, November 17, 2009 12:46 PM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] PreRead and PreWrite.

What is the problem?
Does the call fail? If so, what is the error no.?

You should read about the error values returned by the API and then check
for the problem.
I guess you are hitting STATUS_FLT_INVALID_NAME_REQUEST
Documentation says that:
“FltGetFileNameInformation cannot get file name information in the paging
I/O path.”

You can set FLTFL_OPERATION_REGISTRATION_SKIP_PAGING_IO when registering the
PreRead callback?

Further, the below statement is not sufficient.

if (!NT_SUCCESS(NtStatus)) return FLT_PREOP_COMPLETE;
You should also set the error no. in Data->IoStatus.Status field.

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer