ZwQueryDirectoryFile returning STATUS_PENDING?!

NTFSD
1

Gentlefolk

I have run into a bit of sand in my filter driver here with
ZwQueryDirectoryFile() – for FileBothDirInformation – returning
STATUS_PENDING. I was hoping someone could help me to understand what is
going on, why I see STATUS_PENDING.

So I am in dispatch of IRP_MJ_CREATE for say some file C:\SOMEDIR\A~1.TXT,
I have ZwCreateFile() opened the parent directory C:\SOMEDIR, and I call
ZwQueryDirectoryFile(…, FileBothDirInformation, …) with “A~1.TXT” in
the FileName parameter. You can guess I am trying to get the regular name
of “A~1.TXT” because I figure it might be a short (aka 8.3) name.

It doesnt seem to matter a hoot if “A~1.TXT” exists or not, or whether
that is the short name or the regular name, or whether the IRP_MJ_CREATE
is FILE_CREATE or FILE_OPEN etc. It just seems to always return
STATUS_PENDING in this scenario.

Thanks in advance
Confused

p.s. Where has search gone in the list here? I’d have done a quick search
before posting as a rule.

2

Just for point of information, I am seeing the exact same behaviour in
completion of IRP_MJ_CREATE.

So, as a tentative, conclusion, it looks like STATUS_PENDING is returned
by ZwQueryDirectoryFile(DirHandle FileBothDirInformation, …, FileName,
…) whenever you are in IRP_MJ_CREATE for DirName\FileName (oh, and I
guess, your call is otherwise correct).

If anyone could help me understand if (i) this is correct, (ii) if so,
why, I sure would be grateful. Oh well, I still need to be able to fix up
short names in dispatch of (ie before I pass to fsd) or completion of (ie
after fsd passed to me) IRP_MJ_CREATE. Does anyone have any suggestions
for an alternative method?

Thanks in advance
Baffled

3

Did you open the directory with one of the FILE_SYNCHRONOUS_IO_NONALERT
flags to force ZwQueryDirectoryFile to wait on your behalf? Certainly
FastFat cannot return STATUS_PENDING from a query directory, this must
be NTFS.

Lyndon J. Clarke wrote:

Gentlefolk

I have run into a bit of sand in my filter driver here with
ZwQueryDirectoryFile() – for FileBothDirInformation – returning
STATUS_PENDING. I was hoping someone could help me to understand what is
going on, why I see STATUS_PENDING.

So I am in dispatch of IRP_MJ_CREATE for say some file C:\SOMEDIR\A~1.TXT,
I have ZwCreateFile() opened the parent directory C:\SOMEDIR, and I call
ZwQueryDirectoryFile(…, FileBothDirInformation, …) with “A~1.TXT” in
the FileName parameter. You can guess I am trying to get the regular name
of “A~1.TXT” because I figure it might be a short (aka 8.3) name.

It doesnt seem to matter a hoot if “A~1.TXT” exists or not, or whether
that is the short name or the regular name, or whether the IRP_MJ_CREATE
is FILE_CREATE or FILE_OPEN etc. It just seems to always return
STATUS_PENDING in this scenario.

Thanks in advance
Confused

p.s. Where has search gone in the list here? I’d have done a quick search
before posting as a rule.

–
Nick Ryan (MVP for DDK)

4

Hi Nick

You are right this is NTFS. The FILE_SYNCHRONOUS_IO_NONALERT flag seems to
have done the trick.

Many thanks
Lyndon

5

> p.s. Where has search gone in the list here? I’d have done a quick search

before posting as a rule.

You can search the list archives from the OSR Online homepage,
http://www.osronline.com. Use the drop-down box on the homepage to select
NTFSD, enter a search term, and click the “GO!” button (FYI - the archive is
updated on Fridays, so the current week’s posts aren’t available).

-scott

–
Scott Noone
Software Engineer
OSR Open Systems Resources, Inc.
http://www.osronline.com