Scanner sample and GetQueuedCompletionStatus

NTFSD
1

Hi,
I’ve been browsing the forums recently and came across one particularly interesting topic:

http://www.osronline.com/ShowThread.cfm?link=212459

I then realized there’s an error in my code however I’ve never experienced an issue with GetQueuedCompletionStatus returning error code, even under heavy load scenarios. I’d like to know what’s the proper way to handle the situation. Consider following scenario:

  1. FilterGetMessage succeeds
  2. GetQueuedCompletionStatus fails, but it successfully dequeues IO packet (overlapped != NULL)

I want to know what should be done with this overlapped ptr:

  1. Use it directly in FilterGetMessage call. I think it’s bad as FilterGetMessage will return new message id, causing FltSendMessage hang (or timeout). Or will it recognize IN parameter overlapped and handle the situation properly (what is actually expected).
  2. Use it again in GetQueuedCompletionStatus. I reversed the call in nt kernel and it seems that overlapped ptr is only an OUT value, so it’ll try to dequeue another IO packet. Leaving previous packet “unhandled”.

I’m confused. I’d fix it experimentally by myself but I was unable to replicate the issue. Please help. Thx.