Where is IRP_MJ_FILE_SYSTEM_CONTROL buffer

NTFSD
1

I have a mini-filter driver using WDK 8.1.

I have an application sending
FILE_ZERO_DATA_INFORMATION zData;
zData.FileOffset.QuadPart = 5;
zData.BeyondFinalZero.QuadPart = BUFSIZE;
DeviceIoControl(file, FSCTL_SET_ZERO_DATA, &zData, sizeof(FILE_ZERO_DATA_INFORMATION), NULL, 0, &lpBytesReturned, NULL) == 0)

2

I have a mini-filter driver using WDK 8.1.

I have an application setting zero-data to a sparse file:
FILE_ZERO_DATA_INFORMATION zData;
zData.FileOffset.QuadPart = 5;
zData.BeyondFinalZero.QuadPart = BUFSIZE;
DeviceIoControl(file, FSCTL_SET_ZERO_DATA, &zData, sizeof(FILE_ZERO_DATA_INFORMATION), NULL, 0, &lpBytesReturned, NULL);

In the mini-filter driver, I catch the IRP_MJ_FILE_SYSTEM_CONTROL, and I’m able to see the control code:
Data->Iopb->Parameters.FileSystemControl.Buffered.FsControlCode == FSCTL_SET_ZERO_DATA

But I’m not able to find the FILE_ZERO_DATA_INFORMATION parameter.
I would expect it to be here:
Data->Iopb->Parameters.FileSystemControl.Buffered.SystemBuffer

but this value is NULL.

I know the call is correct because it works properly without my mini-filter driver.

I have also tried looking into all the other parameters that are unioned here, e.g.,
Data->Iopb->Parameters.FileSystemControl.Neither, etc.

3

That’s where it should be located. What is the length of the buffer supposed to be?

Tony
OSR

4

The size of FILE_ZERO_DATA_INFORMATION is 16.

The size of the input buffer (Data->Iopb->Parameters.FileSystemControl.Buffered.InputBufferLength) is 0.

5

There you go: if the input buffer size is zero, the I/O Manager sets Irp->AssociatedIrp.SystemBuffer to zero as well (assuming that there’s no output buffer size since this is a METHOD_BUFFERED FSCTL).

Tony
OSR

6

I don’t understand how the size of the input buffer is getting set to 0.

When I make the call from the application, it is 16 (see above).