error STATUS_NOT_SUPPORTED on FltSetXXXContext

Hi,

This piece of code is always giving me 0xc00000bb no matter if I change the context type to stream handle context or file context.
First I thought it is related to the underlaying FS being a FAT32. but testing on NTFS gives the same result. Any comment?

This code is run in processing of a reparsed IRP_MJ_CREATE. reparsedFileObject contains a File object extrated from the ECP set before reparsing.

PFILE_OBJECT streamContext = NULL;

status = FltAllocateContext(FltObjects->Filter,
FLT_STREAMHANDLE_CONTEXT,
sizeof(FILE_OBJECT),
NonPagedPool,
&streamContext);

if (NT_SUCCESS(status))
{
RtlCopyMemory(streamContext, reparsedFileObject, sizeof(FILE_OBJECT));

status = FltSetStreamHandleContext(FltObjects->Instance,
FltObjects->FileObject,
FLT_SET_CONTEXT_REPLACE_IF_EXISTS,
streamContext,
NULL);

if (NT_SUCCESS(status))
{
status = FLT_PREOP_SUCCESS_NO_CALLBACK;
leave;
}
}

You can’t set contexts on unopened File Objects. If the create was reparsed
(i.e. STATUS_REPARSE returned), then the File Object is not yet open. Check
the FsContext and FsContext2 values to confirm that this is the case.

-scott
OSR
@OSRDrivers

wrote in message news:xxxxx@ntfsd…

Hi,

This piece of code is always giving me 0xc00000bb no matter if I change the
context type to stream handle context or file context.
First I thought it is related to the underlaying FS being a FAT32. but
testing on NTFS gives the same result. Any comment?

This code is run in processing of a reparsed IRP_MJ_CREATE.
reparsedFileObject contains a File object extrated from the ECP set before
reparsing.

PFILE_OBJECT streamContext = NULL;

status = FltAllocateContext(FltObjects->Filter,
FLT_STREAMHANDLE_CONTEXT,
sizeof(FILE_OBJECT),
NonPagedPool,
&streamContext);

if (NT_SUCCESS(status))
{
RtlCopyMemory(streamContext, reparsedFileObject, sizeof(FILE_OBJECT));

status = FltSetStreamHandleContext(FltObjects->Instance,
FltObjects->FileObject,
FLT_SET_CONTEXT_REPLACE_IF_EXISTS,
streamContext,
NULL);

if (NT_SUCCESS(status))
{
status = FLT_PREOP_SUCCESS_NO_CALLBACK;
leave;
}
}

Thanks for help. Yes That was the case.

But

If the create was reparsed (i.e. STATUS_REPARSE returned), then the File Object is not yet open.

Does it matter if the create is reparsed or not? I think it can just be a matter of preCreate vs postCreate when we need the fileObject to be opened. Am I wrong?

I will try obtaining ECP in post create and setting context there. In case ECP was not available in postCreate I think using a completion context to pass data to post create will help me to set stream in post create.

Also I think I’ve read somewhere that some context types(specifically stream contexts) are not available for some FS(specifically FAT). But I can’t find any reference that sum up the context support on different FS. May someone provide me with some information or links if any?

Correct, the file object is not open in PreCreate. It is also not open in
PostCreate if the operation fails or the operation completes with
STATUS_REPARSE.

Also, I just looked at your code…Why are you copying the file object
structure? That is wrong, you should never be doing sizeof(FILE_OBJECT).

See here for context support:

https://msdn.microsoft.com/windows/hardware/drivers/ifs/file-system-support-for-contexts

-scott
OSR
@OSRDrivers

wrote in message news:xxxxx@ntfsd…

Thanks for help. Yes That was the case.

But

If the create was reparsed (i.e. STATUS_REPARSE returned), then the File
Object is not yet open.

Does it matter if the create is reparsed or not? I think it can just be a
matter of preCreate vs postCreate when we need the fileObject to be opened.
Am I wrong?

I will try obtaining ECP in post create and setting context there. In case
ECP was not available in postCreate I think using a completion context to
pass data to post create will help me to set stream in post create.

Also I think I’ve read somewhere that some context types(specifically stream
contexts) are not available for some FS(specifically FAT). But I can’t find
any reference that sum up the context support on different FS. May someone
provide me with some information or links if any?

>It is also not open in PostCreate if the operation fails or the operation completes with STATUS_REPARSE.

I understand now.

Why are you copying the file object structure? That is wrong, you should never be doing sizeof(FILE_OBJECT).

Thanks for the info