That’s correct. Of course there are cases where this method won’t work
for detecting a stack based file object.
Pete
On 9/21/2013 3:48 AM, xxxxx@vmware.com wrote:
@Pete, yes, you mean calling IoGetStackLimits and checking if the PFILE_OBJECT lies in the stack limits right?
Thanks.
-Prasad
NTFSD is sponsored by OSR
OSR is hiring!! Info at http://www.osr.com/careers
For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295
What are those cases? One I can think off is someone sending a stacked based FO to work queue or a different thread and then wait for it to finish. Anything else?
Does it happen realistically in any version of Windows? I need to know this since otherwise the results of issuing I/O on stack based FOs may be disastrous.
Thanks.
-Prasad
In Windows they claim to have cleaned up the stack based fileobjects as
of Vista but this does not include any 3rd party kernel components, they
may still use them.
The other case I was thinking of is when the stack is grown for a kernel
thread. The API will not return the extents of the different stack regions.
Pete
On 9/22/2013 10:30 PM, xxxxx@vmware.com wrote:
What are those cases? One I can think off is someone sending a stacked based FO to work queue or a different thread and then wait for it to finish. Anything else?
Does it happen realistically in any version of Windows? I need to know this since otherwise the results of issuing I/O on stack based FOs may be disastrous.
Thanks.
-Prasad
NTFSD is sponsored by OSR
OSR is hiring!! Info at http://www.osr.com/careers
For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295
Hello,
I made changes to my mini-filter as per the discussion on this thread.
However, I am running into a different issue. Let’s say that my mini-filter is installed on server “server” that is exposing a share called “myshare”.
From a client machine (that is NOT running my minifilter), I try to copy a file to \S\myshare using cmd.exe. This hits into my mini-filter on the server and it uses the file object passed to PostOpCreate to read the file using FltReadFile. This call is freezing for few seconds before completing. Effectively copying a small file is taking 35-40 seconds to complete. I am pretty sure that this is something related to op-locks.
I notice that FILE_COMPLETE_IF_OPLOCKED is set in data->Iopb->Parameters.Create.Options and as per documentation mini-filter is not supposed to delay the IRP_MJ_CREATE in such cases. Does this mean, that I should not be initiating the scan (which in turn calls FltReadFile) if this flag is set?
I tried doing so, however, then it started freezing in PreCleanup path where I scan the file using FltReadFile.
Can someone advice on how to handle this?
Thanks.
-Prasad