STATUS_INVALID_HANDLE in post-setinfo when pending into system worker

NTFSD
1

Hi,
I have a couple of questions. I’ve sent this post post yesterday but I still can’t see it in anywhere so I’m sending it again. If you see it again sorry for spam.

  1. First I have problem when pending pre-SETINFORMATION callback into worker
    queue using FltQueueDeferredIoWorkItem and then synchronize it with
    post-operation using FLT_PREOP_SYNCHRONIZE.
    If FileInformationClass == FileDispositionInformation I always get
    STATUS_INVALID_HANDLE in Data->IoStatus.Status in post-operation routine. I
    use same path for FileRenameInformation and all works OK. I even try to
    remove all code from worker routine with no effect. Is this known issue or
    my bug?

  2. To workaround above problem I will try to not pend processing into worker
    routine but rather do all work directly in pre-operation callback but I need
    to assure that this routine is called at PASSIVE_LEVEL. So my question is:
    Is pre-operation for IRP_MJ_SET_INFORMATION or IRP_MJ_CLEANUP allways called
    at IRQL PASSIVE_LEVEL for non-paging IO path?

  3. When I’m checking top level IRP using IoGetTopLevelIrp in pre-operation
    do I need to do it again in post-operation even if operation is
    synchronized?

Thanks in advance

Jan Milan

2

> 2. To workaround above problem I will try to not pend processing into

worker
routine but rather do all work directly in pre-operation callback but I
need
to assure that this routine is called at PASSIVE_LEVEL. So my question is:
Is pre-operation for IRP_MJ_SET_INFORMATION or IRP_MJ_CLEANUP allways
called
at IRQL PASSIVE_LEVEL for non-paging IO path?

pre-operation for IRP_MJ_SET_INFORMATION and IRP_MJ_CLEANUP is always called
at PASSIVE_LEVEL
if you return FLT_PREOP_SYNCHRONIZE in pre-IRP_MJ_SET_INFORMATION,
post-operation will be called in the same thread context as the
pre-operation callback at <= APC_LEVEL

Petr Kurtin

3

So even if pre-operation is running at PASSIVE_LEVEL and post-operation is
synchronized it could be called at APC_LEVEL?

“Petr Kurtin” wrote in message news:xxxxx@ntfsd…
>
> > 2. To workaround above problem I will try to not pend processing into
> > worker
> > routine but rather do all work directly in pre-operation callback but I
> > need
> > to assure that this routine is called at PASSIVE_LEVEL. So my question
is:
> > Is pre-operation for IRP_MJ_SET_INFORMATION or IRP_MJ_CLEANUP allways
> > called
> > at IRQL PASSIVE_LEVEL for non-paging IO path?
>
> pre-operation for IRP_MJ_SET_INFORMATION and IRP_MJ_CLEANUP is always
called
> at PASSIVE_LEVEL
> if you return FLT_PREOP_SYNCHRONIZE in pre-IRP_MJ_SET_INFORMATION,
> post-operation will be called in the same thread context as the
> pre-operation callback at <= APC_LEVEL
>
> Petr Kurtin
>
>

4

Yes, if you return FLT_PREOP_SYNCHRONIZE your postoperation callback can be called at <= APC_LEVEL (see WDK docs) - which is ok, you can still access paged code. It’s not needed to be directly at PASSIVE_LEVEL.