> So, does this mean that FSD destroys FILE_OBJECT?
If you send IRP_MJ_CLEANUP then CLOSE, yes.
How can we send IRP_MJ_CLEANUP/CLOSE if the FSD have never seen
IRP_MJ_CREATE (we scan for viruses before pass the IRP down)?
I didn’t see a mention that you’d be using Zw routines. If you are, only
prepare yourself for reentrancy issues, and do normalZwClose cleanup - the file
object won’t be touched in your case.
If you aren’t going to use Zw routines, you’ll most certainly be using the
file object - in which case, you must send the above IRPs.
–
Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
E-mail: xxxxx@alfasp.com
ICQ#: 56570367
Alfa File Monitor - File monitoring system for Win32 developers.
Alfa File Protector - File protection and hiding system for Win32 developers.
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
Naaah…
Jamey
xxxxx@storagecraft.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Alexey Logachyov
Sent: Saturday, October 20, 2001 3:00 PM
To: File Systems Developers
Subject: [ntfsd] Re: STATUS_PENDING from FSD
That’s OK. But try to hold on your emotions next time.
----- Original Message -----
From: “Jamey Kirby”
To: “File Systems Developers”
Sent: Saturday, October 20, 2001 7:21 PM
Subject: [ntfsd] Re: STATUS_PENDING from FSD
> I was joking. I forgot the 
>
>
> Jamey
> xxxxx@storagecraft.com
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Jamey Kirby
> Sent: Saturday, October 20, 2001 8:38 AM
> To: File Systems Developers
> Subject: [ntfsd] Re: STATUS_PENDING from FSD
>
>
> Yes, it is dumb; file system filter
>
>
> Jamey
> xxxxx@storagecraft.com
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Alexey Logachyov
> Sent: Saturday, October 20, 2001 5:50 AM
> To: File Systems Developers
> Subject: [ntfsd] Re: STATUS_PENDING from FSD
>
>
> May be this is a dumb question but what is FSF?
>
> ----- Original Message -----
> From: “Dejan Maksimovic”
> To: “File Systems Developers”
> Sent: Saturday, October 20, 2001 11:02 AM
> Subject: [ntfsd] Re: STATUS_PENDING from FSD
>
>
> > > I also encountered the next unexpected behaviour on NT4 SP6. FS
> > > driver’s IRP_MJ_CLOSE dispatch routine often returns impossible
> > > status code (high order byte is set to 0xF which means that the
> > > reserved bit is 1) though
> > > Irp->IoStatus.Status is fine.
> >
> > I have found this to happen sometimes, but I think it is related
> > to
> FSF
> > corrupting some memory.
> >
> > > When can I return STATUS_PENDING from my FSFD?
> >
> > Anytime you want, virtually.
> >
> > > And why Microsoft states that FSFDs should not return
> > > STATUS_PENDING?
> >
> > For IRP_MJ_CREATE only. That’s because in IRP_MJ_CREATE many
> > filters
> or FSD
> > might need the original process context - which if any FSFD returns
> > STATUS_PENDING will not be available, due to the processing being
> > done
>
> > in
> a
> > worker thread.
> >
> > > What’s gonna happen if FSFD returns STATUS_PENDING then pass IRP
> > > to FSD
> and
> > > FSD in turn returns STATUS_PENDING too?
> >
> > If the FSFD is well written the result you want will happen.
> > I.e. if
> the
> > FSFD handles STATUS_PENDING correctly, and pends correctly no
> > problems
> will
> > occur.
> > It is quite possible for every FSFD in the chain and the FSD
> > itself to return STATUS_PENDING, and thus also get STATUS_PENDING
> > from
>
> > the device it called.
> > What should you note: since you will call IoCallDriver from
> > system
> worker
> > thread probably (you virtually said this above:-), if the
> > IoCallDriver
> returns
> > STATUS_PENDING, make sure you don’t call IoCompleteRequest before
> > your
>
> > completion routine gets called for that IRP.
> >
> > –
> > Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
> > E-mail: xxxxx@alfasp.com
> > ICQ#: 56570367
> > Alfa File Monitor - File monitoring system for Win32 developers.
> > Alfa File Protector - File protection and hiding system for Win32
> developers.
> >
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@vba.com.by To
> > unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com To
> unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com To
> unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntfsd as: xxxxx@storagecraft.com To
unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
Create calls are synchronous anyway, so returning STATUS_PENDING gains
you nothing. The caller MUST wait for the create; like I said, there is
no concept of an overlapped create, so the upper thread is going to
block regardless.
Jamey
xxxxx@storagecraft.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Alexey Logachyov
Sent: Saturday, October 20, 2001 3:00 PM
To: File Systems Developers
Subject: [ntfsd] Re: STATUS_PENDING from FSD
Sometimes virus checking takes a very long time, especialy when we have
to ask user what action to perform with infected file. Does it hurt to
hold an IRP processing for such a long time? Jamey says overlapped IO is
impossible on create calls. But does that mean that that I can just
freeze until file is checked.
----- Original Message -----
From: “Dejan Maksimovic”
To: “File Systems Developers”
Sent: Saturday, October 20, 2001 11:38 PM
Subject: [ntfsd] Re: STATUS_PENDING from FSD
>
> From your description, there’s no need to pend the IRP in the
> CREATE dispatch.
> Do the check in the dispatch itself.
>
> Regards, Dejan.
>
> Alexey Logachyov wrote:
>
> > > If I understand correctly, you want to:
> > > - return STATUS_PENDING in IRP_MJ_CREATE dispatch
> > > - return STATUS_MORE_PROCESSING_REQUIRED in completion
> > > - call IoCallDriver in a worker thread initiated by the
> > > completion
> > routine
> > > - do IoCompleteRequest in the worker thread.
> > May be we misunderstodd each other, may be not. I was planning to do
> > it
this
> > way:
> > - mark IRP pending and return STATUS_PENDING in IRP_MJ_CREATE
dispatch.
> > But I do not need completion routine as far as I don’t care about
result.
> > - start virus check.
> > - if checking is not successful return STATUS_ACCESS_DENIED and
complete
> > request (do I have to do any additional cleanup?).
> > - when checking is finished call lower device using IoCallDriver.
> > - as far as I understand lower device will complete the request.
> >
> > Am I missing something?
>
> –
> Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
> E-mail: xxxxx@alfasp.com
> ICQ#: 56570367
> Alfa File Monitor - File monitoring system for Win32 developers. Alfa
> File Protector - File protection and hiding system for Win32
> developers.
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntfsd as: xxxxx@storagecraft.com To
unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
It is better to use the defined kernel function designed for this
purpose: IoCancelFileOpen().
Jamey
xxxxx@storagecraft.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Dejan Maksimovic
Sent: Saturday, October 20, 2001 4:50 PM
To: File Systems Developers
Subject: [ntfsd] Re: STATUS_PENDING from FSD
You must do the cleanup of the file object. Send IRP_MJ_CLEANUP then
IRP_MJ_CLOSE requests to do this.
Regards, Dejan.
If virus check failed I put STATUS_ACCESS_DENIED to
Irp->IoStatus.Status and complete the request. Do I have to do any
additional cleanup? Who destroys the FILE_OBJECT?
–
Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
E-mail: xxxxx@alfasp.com
ICQ#: 56570367
Alfa File Monitor - File monitoring system for Win32 developers. Alfa
File Protector - File protection and hiding system for Win32 developers.
You are currently subscribed to ntfsd as: xxxxx@storagecraft.com To
unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
From MS-IFS / OSR-IFS docs, I see that’s it’s not defined for WinNT/2K,
but only for XP?
Regards, Dejan.
Jamey Kirby wrote:
It is better to use the defined kernel function designed for this
purpose: IoCancelFileOpen().
Jamey
xxxxx@storagecraft.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Dejan Maksimovic
Sent: Saturday, October 20, 2001 4:50 PM
To: File Systems Developers
Subject: [ntfsd] Re: STATUS_PENDING from FSD
You must do the cleanup of the file object. Send IRP_MJ_CLEANUP then
IRP_MJ_CLOSE requests to do this.
Regards, Dejan.
> If virus check failed I put STATUS_ACCESS_DENIED to
> Irp->IoStatus.Status and complete the request. Do I have to do any
> additional cleanup? Who destroys the FILE_OBJECT?
–
Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
E-mail: xxxxx@alfasp.com
ICQ#: 56570367
Alfa File Monitor - File monitoring system for Win32 developers. Alfa
File Protector - File protection and hiding system for Win32 developers.
You are currently subscribed to ntfsd as: xxxxx@storagecraft.com To
unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
You are currently subscribed to ntfsd as: xxxxx@alfasp.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
–
Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
E-mail: xxxxx@alfasp.com
ICQ#: 56570367
Alfa File Monitor - File monitoring system for Win32 developers.
Alfa File Protector - File protection and hiding system for Win32
developers.
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
It is available in w2k; I use it.
It is easy to write a function to simulate it for NT 4.0
Jamey
xxxxx@storagecraft.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Dejan Maksimovic
Sent: Sunday, October 21, 2001 3:35 PM
To: File Systems Developers
Subject: [ntfsd] Re: STATUS_PENDING from FSD
From MS-IFS / OSR-IFS docs, I see that’s it’s not defined for
WinNT/2K, but only for XP?
Regards, Dejan.
Jamey Kirby wrote:
It is better to use the defined kernel function designed for this
purpose: IoCancelFileOpen().
Jamey
xxxxx@storagecraft.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Dejan Maksimovic
Sent: Saturday, October 20, 2001 4:50 PM
To: File Systems Developers
Subject: [ntfsd] Re: STATUS_PENDING from FSD
You must do the cleanup of the file object. Send IRP_MJ_CLEANUP
then IRP_MJ_CLOSE requests to do this.
Regards, Dejan.
> If virus check failed I put STATUS_ACCESS_DENIED to
> Irp->IoStatus.Status and complete the request. Do I have to do any
> additional cleanup? Who destroys the FILE_OBJECT?
–
Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
E-mail: xxxxx@alfasp.com
ICQ#: 56570367
Alfa File Monitor - File monitoring system for Win32 developers. Alfa
File Protector - File protection and hiding system for Win32
developers.
You are currently subscribed to ntfsd as: xxxxx@storagecraft.com To
unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
You are currently subscribed to ntfsd as: xxxxx@alfasp.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
–
Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
E-mail: xxxxx@alfasp.com
ICQ#: 56570367
Alfa File Monitor - File monitoring system for Win32 developers. Alfa
File Protector - File protection and hiding system for Win32 developers.
You are currently subscribed to ntfsd as: xxxxx@storagecraft.com To
unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
Sounds nice.
BTW, my mail reader shows that your message was sent on Saturday, at 11
AM - I know about time difference, but this is over 40 hours time
difference.
Regards, Dejan.
Jamey Kirby wrote:
It is available in w2k; I use it.
It is easy to write a function to simulate it for NT 4.0
Jamey
xxxxx@storagecraft.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Dejan Maksimovic
Sent: Sunday, October 21, 2001 3:35 PM
To: File Systems Developers
Subject: [ntfsd] Re: STATUS_PENDING from FSD
From MS-IFS / OSR-IFS docs, I see that’s it’s not defined for
WinNT/2K, but only for XP?
Regards, Dejan.
Jamey Kirby wrote:
> It is better to use the defined kernel function designed for this
> purpose: IoCancelFileOpen().
>
> Jamey
> xxxxx@storagecraft.com
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Dejan Maksimovic
> Sent: Saturday, October 20, 2001 4:50 PM
> To: File Systems Developers
> Subject: [ntfsd] Re: STATUS_PENDING from FSD
>
> You must do the cleanup of the file object. Send IRP_MJ_CLEANUP
> then IRP_MJ_CLOSE requests to do this.
>
> Regards, Dejan.
>
> > If virus check failed I put STATUS_ACCESS_DENIED to
> > Irp->IoStatus.Status and complete the request. Do I have to do any
> > additional cleanup? Who destroys the FILE_OBJECT?
>
> –
> Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
> E-mail: xxxxx@alfasp.com
> ICQ#: 56570367
> Alfa File Monitor - File monitoring system for Win32 developers. Alfa
> File Protector - File protection and hiding system for Win32
> developers.
>
> —
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com To
> unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
> —
> You are currently subscribed to ntfsd as: xxxxx@alfasp.com
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
–
Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
E-mail: xxxxx@alfasp.com
ICQ#: 56570367
Alfa File Monitor - File monitoring system for Win32 developers. Alfa
File Protector - File protection and hiding system for Win32 developers.
You are currently subscribed to ntfsd as: xxxxx@storagecraft.com To
unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
You are currently subscribed to ntfsd as: xxxxx@alfasp.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
–
Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
E-mail: xxxxx@alfasp.com
ICQ#: 56570367
Alfa File Monitor - File monitoring system for Win32 developers.
Alfa File Protector - File protection and hiding system for Win32
developers.
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> From: Alexey Logachyov [mailto:xxxxx@vba.com.by]
I also encountered the next unexpected behaviour on NT4 SP6.
FS driver’s
IRP_MJ_CLOSE dispatch routine often returns impossible status
code (high
order byte is set to 0xF which means that the reserved bit is
- though
Irp->IoStatus.Status is fine.
If the FSD is FASTFAT, it used to contain a bug where it would return an
unitialized variable from dispatch of IRP_MJ_CLOSE. This usually
doesn’t cause a problem because the “IO Manager” doesn’t check the
return value of IRP_MJ_CLOSE. You might consider ignoring it too.
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> You must do the cleanup of the file object. Send IRP_MJ_CLEANUP then
IRP_MJ_CLOSE requests to do this.
This is necessary only in the completion path - after the underlying FSD have succeeded the CREATE. w2k has IoCancelFileOpen
function which does exactly this.
In the down path - before calling the FSD - you can just fail CREATE.
Max
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
The OS will destroy the file object on failed CREATE.
----- Original Message -----
From: “Alexey Logachyov”
To: “File Systems Developers”
Sent: Sunday, October 21, 2001 2:44 AM
Subject: [ntfsd] Re: STATUS_PENDING from FSD
> If virus check failed I put STATUS_ACCESS_DENIED to Irp->IoStatus.Status and
> complete the request. Do I have to do any additional cleanup? Who destroys
> the FILE_OBJECT?
>
> ----- Original Message -----
> From: “Dejan Maksimovic”
> To: “File Systems Developers”
> Sent: Saturday, October 20, 2001 11:38 PM
> Subject: [ntfsd] Re: STATUS_PENDING from FSD
>
>
> >
> > From your description, there’s no need to pend the IRP in the CREATE
> > dispatch.
> > Do the check in the dispatch itself.
> >
> > Regards, Dejan.
> >
> > Alexey Logachyov wrote:
> >
> > > > If I understand correctly, you want to:
> > > > - return STATUS_PENDING in IRP_MJ_CREATE dispatch
> > > > - return STATUS_MORE_PROCESSING_REQUIRED in completion
> > > > - call IoCallDriver in a worker thread initiated by the completion
> > > routine
> > > > - do IoCompleteRequest in the worker thread.
> > > May be we misunderstodd each other, may be not. I was planning to do it
> this
> > > way:
> > > - mark IRP pending and return STATUS_PENDING in IRP_MJ_CREATE
> dispatch.
> > > But I do not need completion routine as far as I don’t care about
> result.
> > > - start virus check.
> > > - if checking is not successful return STATUS_ACCESS_DENIED and
> complete
> > > request (do I have to do any additional cleanup?).
> > > - when checking is finished call lower device using IoCallDriver.
> > > - as far as I understand lower device will complete the request.
> > >
> > > Am I missing something?
> >
> > –
> > Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
> > E-mail: xxxxx@alfasp.com
> > ICQ#: 56570367
> > Alfa File Monitor - File monitoring system for Win32 developers.
> > Alfa File Protector - File protection and hiding system for Win32
> > developers.
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> > To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> So, does this mean that FSD destroys FILE_OBJECT?
No, IO manager will do this.
How can we send IRP_MJ_CLEANUP/CLOSE if the FSD have never seen
IRP_MJ_CREATE (we scan for viruses before pass the IRP down)?
You’re right, this must NOT be done if FSD have not seen the CREATE IRP.
Max
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
It is since w2k.
----- Original Message -----
From: “Dejan Maksimovic”
To: “File Systems Developers”
Sent: Monday, October 22, 2001 2:34 AM
Subject: [ntfsd] Re: STATUS_PENDING from FSD
>
> From MS-IFS / OSR-IFS docs, I see that’s it’s not defined for WinNT/2K,
> but only for XP?
>
> Regards, Dejan.
>
> Jamey Kirby wrote:
>
> > It is better to use the defined kernel function designed for this
> > purpose: IoCancelFileOpen().
> >
> > Jamey
> > xxxxx@storagecraft.com
> >
> >
> > -----Original Message-----
> > From: xxxxx@lists.osr.com
> > [mailto:xxxxx@lists.osr.com] On Behalf Of Dejan Maksimovic
> > Sent: Saturday, October 20, 2001 4:50 PM
> > To: File Systems Developers
> > Subject: [ntfsd] Re: STATUS_PENDING from FSD
> >
> > You must do the cleanup of the file object. Send IRP_MJ_CLEANUP then
> > IRP_MJ_CLOSE requests to do this.
> >
> > Regards, Dejan.
> >
> > > If virus check failed I put STATUS_ACCESS_DENIED to
> > > Irp->IoStatus.Status and complete the request. Do I have to do any
> > > additional cleanup? Who destroys the FILE_OBJECT?
> >
> > –
> > Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
> > E-mail: xxxxx@alfasp.com
> > ICQ#: 56570367
> > Alfa File Monitor - File monitoring system for Win32 developers. Alfa
> > File Protector - File protection and hiding system for Win32 developers.
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@storagecraft.com To
> > unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@alfasp.com
> > To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
> –
> Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
> E-mail: xxxxx@alfasp.com
> ICQ#: 56570367
> Alfa File Monitor - File monitoring system for Win32 developers.
> Alfa File Protector - File protection and hiding system for Win32
> developers.
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>doesn’t cause a problem because the “IO Manager” doesn’t check the
return value of IRP_MJ_CLOSE. You might consider ignoring it too.
Anyway the drivers are not supposed to fail either CLEANUP or CLOSE.
This is like C++ destructor which cannot fail and cannot return values.
Max
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
Thanks Max a lot. This is not the first time you help me.
I could see this behaviour from a simple test:
#include <windows.h>
int WINAPI WinMain(HINSTANCE, HINSTANCE, LPSTR, int)
{
HANDLE hFile = CreateFile(
“c:\test.file”,
GENERIC_READ | GENERIC_WRITE,
FILE_SHARE_READ,
NULL,
OPEN_EXISTING,
0,
NULL);
if (hFile == INVALID_HANDLE_VALUE)
{
return GetLastError();
}
else
{
CloseHandle(hFile);
return 0;
}
}
I then put DenyAll access to c:\test.file file and logged all IRPs. I could
see IRP_MJ_CREATE but not IRP_MJ_CLOSE.
----- Original Message -----
From: “Maxim S. Shatskih”
To: “File Systems Developers”
Sent: Monday, October 22, 2001 22:40
Subject: [ntfsd] Re: STATUS_PENDING from FSD
> > So, does this mean that FSD destroys FILE_OBJECT?
>
> No, IO manager will do this.
>
> > How can we send IRP_MJ_CLEANUP/CLOSE if the FSD have never seen
> > IRP_MJ_CREATE (we scan for viruses before pass the IRP down)?
>
> You’re right, this must NOT be done if FSD have not seen the CREATE IRP.
>
> Max
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com</windows.h>
> >doesn’t cause a problem because the “IO Manager” doesn’t check the
>return value of IRP_MJ_CLOSE. You might consider ignoring it too.
Anyway the drivers are not supposed to fail either CLEANUP or CLOSE.
Unless the input parameters are invalid!
–
Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
E-mail: xxxxx@alfasp.com
ICQ#: 56570367
Alfa File Monitor - File monitoring system for Win32 developers.
Alfa File Protector - File protection and hiding system for Win32
developers.
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> > You must do the cleanup of the file object. Send IRP_MJ_CLEANUP then
> IRP_MJ_CLOSE requests to do this.
This is necessary only in the completion path - after the underlying FSD have succeeded the CREATE.
This was the idea, IIRC.
–
Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
E-mail: xxxxx@alfasp.com
ICQ#: 56570367
Alfa File Monitor - File monitoring system for Win32 developers.
Alfa File Protector - File protection and hiding system for Win32 developers.
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> Thanks Max a lot. This is not the first time you help me.
I could see this behaviour from a simple test:
In fact, IRP_MJ_CLOSE does not destroy the file object.
CLOSE is sent by the IO manager when a decision was made (by some other code, usually reference counting) to destroy it. It is
like a destructor - must clean up all resources referenced by the file object (CCBs and such), but must not deallocate the file
object itself. It will be deallocated later by the IO manager just after the CLOSE processing will finish.
Rolling your own CLOSE IRP is extremely dangerous and is OK only in IoCancelFileOpen.
In this case, the FSD below you have succeeded CREATE and waits CLEANUP/CLOSE for this file object after successful CREATE.
But your filter will fail CREATE and report CREATE failure to the IO manager. In this case, IO manager will not send CLEANUP/CLOSE.
So, in this case, it is your filter’s job to send CLEANUP/CLOSE, which is done by IoCancelFileOpen.
Note that IoCancelFileOpen must be called only after successful CREATE processing by the FSD and not the failed one.
Max
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> > >doesn’t cause a problem because the “IO Manager” doesn’t check the
> >return value of IRP_MJ_CLOSE. You might consider ignoring it too.
>
> Anyway the drivers are not supposed to fail either CLEANUP or CLOSE.
Unless the input parameters are invalid!
Can you fail a destructor in C++? No. The same is true in CLEANUP and CLOSE.
The only parameter to them is file object. IO manager does not check completion status in CLEANUP and CLOSE.
Max
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
You say FSD does not destroy the FILE_OBJECT but clean up some resource
associated with it. Is the file name one of those resources. If I try to
construct a the file name from FILE_OBJECT if IRP_MJ_CLOSE completion
routine I got only empty strings (I know that the onlymoment when I can
construct the name is before IRP_MJ_CREATE but I still wonder).
----- Original Message -----
From: “Maxim S. Shatskih”
To: “File Systems Developers”
Sent: Thursday, October 25, 2001 5:38 PM
Subject: [ntfsd] Re: STATUS_PENDING from FSD
> > Thanks Max a lot. This is not the first time you help me.
> >
> > I could see this behaviour from a simple test:
>
> In fact, IRP_MJ_CLOSE does not destroy the file object.
>
> CLOSE is sent by the IO manager when a decision was made (by some other
code, usually reference counting) to destroy it. It is
> like a destructor - must clean up all resources referenced by the file
object (CCBs and such), but must not deallocate the file
> object itself. It will be deallocated later by the IO manager just after
the CLOSE processing will finish.
>
> Rolling your own CLOSE IRP is extremely dangerous and is OK only in
IoCancelFileOpen.
> In this case, the FSD below you have succeeded CREATE and waits
CLEANUP/CLOSE for this file object after successful CREATE.
> But your filter will fail CREATE and report CREATE failure to the IO
manager. In this case, IO manager will not send CLEANUP/CLOSE.
> So, in this case, it is your filter’s job to send CLEANUP/CLOSE, which is
done by IoCancelFileOpen.
> Note that IoCancelFileOpen must be called only after successful CREATE
processing by the FSD and not the failed one.
>
> Max
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
The filename can and will be deleted by anyone after create call
completes.
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Alexey Logachyov
Sent: Thursday, October 25, 2001 3:20 PM
To: File Systems Developers
Subject: [ntfsd] Re: STATUS_PENDING from FSD
You say FSD does not destroy the FILE_OBJECT but clean up some resource
associated with it. Is the file name one of those resources. If I try to
construct a the file name from FILE_OBJECT if IRP_MJ_CLOSE completion
routine I got only empty strings (I know that the onlymoment when I can
construct the name is before IRP_MJ_CREATE but I still wonder).
----- Original Message -----
From: “Maxim S. Shatskih”
To: “File Systems Developers”
Sent: Thursday, October 25, 2001 5:38 PM
Subject: [ntfsd] Re: STATUS_PENDING from FSD
> > Thanks Max a lot. This is not the first time you help me.
> >
> > I could see this behaviour from a simple test:
>
> In fact, IRP_MJ_CLOSE does not destroy the file object.
>
> CLOSE is sent by the IO manager when a decision was made (by some
> other
code, usually reference counting) to destroy it. It is
> like a destructor - must clean up all resources referenced by the file
object (CCBs and such), but must not deallocate the file
> object itself. It will be deallocated later by the IO manager just
> after
the CLOSE processing will finish.
>
> Rolling your own CLOSE IRP is extremely dangerous and is OK only in
IoCancelFileOpen.
> In this case, the FSD below you have succeeded CREATE and waits
CLEANUP/CLOSE for this file object after successful CREATE.
> But your filter will fail CREATE and report CREATE failure to the IO
manager. In this case, IO manager will not send CLEANUP/CLOSE.
> So, in this case, it is your filter’s job to send CLEANUP/CLOSE, which
> is
done by IoCancelFileOpen.
> Note that IoCancelFileOpen must be called only after successful
> CREATE
processing by the FSD and not the failed one.
>
> Max
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntfsd as: xxxxx@storagecraft.com To
unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com