what is the matter when I try to filter file rename operation?

NTFSD
1

I write the following code in the IRP_MJ_SET_INFORMATION dispatch function
to prevent renaming a specified file.

if ( irpSp->Parameters.SetFile.FileInformationClass ==
FileRenameInformation )
{
IoCompleteRequest(Irp,IO_NO_INCREMENT);
return STATUS_SUCCESS;
}

but sometimes page fault occurs, why?

2

Don’t return STATUS_SUCCESS, return ACCESS_DENIED.

if ( irpSp->Parameters.SetFile.FileInformationClass ==
FileRenameInformation )
{
IoCompleteRequest(Irp,IO_NO_INCREMENT);
return STATUS_SUCCESS;
}

but sometimes page fault occurs, why?

–
Kind regards, Dejan M. MVP for DDK
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32 developers.
Alfa File Monitor - File monitoring library for Win32 developers.

3

And don’t forget to set the same status in Irp->IoStatus.Status,
otherwise Driver Verifier will surely complain to difference between
returned status and this field’s value.

Don’t return STATUS_SUCCESS, return ACCESS_DENIED.

> if ( irpSp->Parameters.SetFile.FileInformationClass ==
> FileRenameInformation )
> {
> IoCompleteRequest(Irp,IO_NO_INCREMENT);
> return STATUS_SUCCESS;
> }