If IRP_MJ_CREATE was called with FILE_DIRECTORY_FILE and
this call will success (you’ll find it out in your create dispatch routine)
then this FileObject represents a directory. If that flag was not specified,
then it’s a file.
If the FILE_DIRECTORY_FILE flag is not specified, it means
“open whatever you find under this name”. So it can be either
directory *or* a file.
L.
Thank you for your answers everyone!
I will move the determination to a later request. I am assuming that in
order for me to send IRP_MJ_QUERY_INFORMATION I need to be at PASSIVE_LEVEL
as described here.
ms-help://MS.WDK.v10.6000/IFSK_d/hh/IFSK_d/Ch4DispatchRoutines_e65c30e3-4cb6-463c-8c2f-fad4c6bd698b.xml.htm
Does that mean that I could be unlucky enough to receive a paging IO request
(lets say an in-page operation) at APC_LEVEL and not be able to find out if
the file object is a directory?
As an aside, I have read in the NTFSD archives that Read/Write dispatch
routines can be called at DISPATCH_LEVEL, yet the WDK doc I listed above
doesn’t say that. In what circumstances would Read/xxxxx@DISPATCH_LEVEL
occur other than a misbehaving upper driver?
Sorry for being a knowledge sponge, I hope to contribute to NTFSD properly
one day!
Many thanks again!
Carl
“Carl” wrote in message news:xxxxx@ntfsd…
> All,
>
> I am (for my sins) working on a legacy filter and need to work out if the
> file object is a directory or not post-create. I was just sending
> IRP_MJ_QUERY_INFORMATION with FileStandardInformation in my dispatch
> routine
> after my completion routine returned STATUS_MORE_PROCESSING_REQUIRED. But,
> I
> am getting a deadlock with ProcessMonitor when it calls
> fltmgr!FltGetFileNameInformation in its pre-callback routine for
> IRP_MJ_QUERY_INFORMATION. I am assuming this is my error.
>
> Currently, I am doing this before I call IoCompleteRequest because
> ideally,
> I would like to find out before any non-cached/paging io arrives for the
> file/directory in question. The code is new, and you wont be surprised
> (given the technique or age of code) that it didn’t take long to find
> issues.
>
> So, what is the safe way/time to determine if the file object is a
> directory
> or not?
>
> Many thanks in advance!
>
> Carl
>
> Does that mean that I could be unlucky enough to receive a paging IO
request (lets say an in-page operation) at APC_LEVEL and not be able to
find out if the file object is a directory?
Determine this flag once (when safe, e.g. synced after IRP_MJ_CREATE
succeeded) and store it into your FileObj hash table
>when safe, e.g. synced after IRP_MJ_CREATE succeeded
That’s what is not working, right? Sorry, ignore my “infinte recursion”
causing input.