SetFilePointer and SetEndOfFile

NTFSD
1

Hi,

I am reducing the size of an existing file from y bytes to y-2 bytes. I am doing this by calling the mentioned api [file is opened with read write access].

Why should write be triggered when setendoffile to truncate the file is called?

Trav

2

Hi,

This scenario occurs when I do the following:

  • Open an existing file that contains header and data.
  • Create a mapping with length as that of the data.
  • Map the view of the file.
  • Write some data less then original data into the file using the mapping.
  • Flush view of the file.
  • unmap the view.
  • close the mapping
  • set file pointer to [data length - 2]
  • SETENDOFFILE

Now flush view of file will trigger the paging write with original length. Here I increase the write byte offset by 4096.

Next set end of file will trigger an set_information irp and I increase the end of file by 4096.

Now another WRITE is triggered that unexpectedly starts with 4096 offset with my filter on. Increasing the write byte offset by 4096 here is not correct.

Even without my filter this write is triggered but in that case the write starts at offset 0.

Please help.

Trav

3

Hi,

Please help. I have tried debugging this with the help of Windbg as well but cannot find the cause.

Trav

4

Hi,

The write which my filter does not handle correctly has the FILE_STREAM_FILE flag set for the file object. Thus this is the fileobject created by NTFS.

Is special handling needed while changing offset to such writes.

Thank you,
Trav