Suppose there is a minifilter above mine in the stack that is doing some sort of file path redirection/virtualization by changing filename in fileobject and returning STATUS_REPARSE. In this case if my minifilter creates a fileObject in the callback to the same file that is the I/O target and uses this fileObject in one of Flt APIs e.g. FltReadFile. In this case I'll not be redirected and end up eiter accessing the wrong file or a non existent one. The fact that you never know what the filter above me could be doing, when can Flt APIs with self created file object be safely used?
AFAIK, filters generally return STATUS_REPARSE in the pre-create callback. Since your filter is below, it won't see the IO until it is re-issued.
A filter above yours can also return STATUS_REPARSE in post-create, I believe. Assuming the create was successful, that filter needs to call FltCancelFileOpen before returning STATUS_REPARSE. Your filter will see the CLOSE and can clean up state at that time.
Thanks for the response Alnoor
What I meant to ask was my driver created the fileObject using FltFileCreate/Ex. This create will not be seen by the upper virtualization filter. Consquently using the fileObject for I/O will be misdirected in my understanding
I'm still bemused by this. Why do you care if a filer above you is reparsing a create? Why do you send the create to the top of the stack?
But the rule remains really simple. You need to send the requests to the same instance that you sent the create.
If you specify a NULL instance to create then you probably want to know about FltGetTopInstance (which is not the same as sending the request to the NULL instance, but close enough these days).
You also need to think long and hard about whether you want reparse points followed or not in your "to the top of the stack" create. If you do then you need to know about FltGetVolumeFromFileObject
But really you need to understand why the person who wrote the code made an explicit choice to go to the top of the stack.
1 Like
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.