Re[2]: Retrive file size in post-create

NTFSD
1

What’s wrong with FltQueryInformationFile() in post-create? This should
always be safe unless some other filter is breaking the rules.

Pete

–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295

------ Original Message ------
From: “xxxxx@gmail.com”
To: “Windows File Systems Devs Interest List”
Sent: 1/19/2018 7:18:04 AM
Subject: RE:[ntfsd] Retrive file size in post-create

>FsRtlGetFileSize() - it’s a right and safety solution?
>
>—
>NTFSD is sponsored by OSR
>
>
>MONTHLY seminars on crash dump analysis, WDF, Windows internals and
>software drivers!
>Details at http:
>
>To unsubscribe, visit the List Server section of OSR Online at
>http:</http:></http:>

2

> This should always be safe unless some other filter is breaking the rules.

I have seen the top level IRP set in precreate under certain circumstances
which escape me right now. All I can remember was that it was obviously
buggy behavior by a Windows Subsystem. This means that
FltGetInformationFile may return an error. But in no cases will it
deadlock.