Tracking files with open section objects

NTFSD
1

I need to keep track of files that have open section objects on them so
that our HSM code can avoid releasing them. Releasing is accomplished
by sparsing the file and setting a reparse point, setting the offline
bit, etc.

Yesterday, I tracked down an interop problem with Symantec AV where
Symantec was trying to scan files the second time they were being
restored, I was seeing the read, and blocking it, deadlocking the
process that was trying to read the file in the first place. Symantec
is sending reads with IRP_NOCACHE and IRP_PAGING_IO set, so to prevent
this deadlock, I’m ignoring paging reads in my read routine and letting
them pass through.

This opens up another problem, however. I can open the file with
exclusive access when I go to set the RP to ensure nobody else has the
file open, but I also need to ensure that there aren’t any open sections
on the file either. If I release the file while it’s mapped, and some
pages need to be faulted in, they’ll get invalid data. And that would
be bad

So after half a day of sifting through the mailing list archives and
MSDN, here’s what I’ve got:

  1. Mapped stuff for all sections is all held together via the
    FILE_OBJECT’s SectionObjectPointers
  2. Which filters must treat as opaque. Makes sense

I googled up STATUS_USER_MAPPED_FILE, which I saw once several months
ago and seemed like it might be applicable to this situation, which
turned up this thread:

http://www.osronline.com/showThread.cfm?link=92730

Slava mentions MmCanFileBeTruncated (message 3) which returns errors if
the size of the user mapped file can’t be decreased. MSDN seems to
indicate that I can pass it the FILE_OBJECT’s SectionObjectPointers, and
a new file size. If I pass it
cbd->Iopb->TargetFileObject->SectionObjectPointers and 0, that should
indicate whether or not there’s an open section (or some other reason I
shouldn’t release the file).

http://msdn.microsoft.com/en-us/library/ms796375.aspx

The MSDN docs don’t mention that I should own any locks before calling
this, and I’m not doing any reading of the opaque SOP’s myself. I’m
sure this isn’t exactly what the function is intended to be used for,
but if it works, is it safe to do?

Or if there’s some better way of finding out if there are existing
sections on a file, please let me know.

Thanks,

~Eric

2

Okay guys, MmCanFileBeTruncated seems to work for what I need it to do.
Any objections or subtle problems this could introduce that anybody
would like to point out?

~Eric

3

You are on the right track - I have written HSM drivers before and this is the way to do what you want to do.