FltGetVolumeGuidName return STATUS_INVALID_PARAMETER

NTFSD
1

Hi,
I am developing a mini-filter and want to query volume GUID name at first pre-create events. But FltGetVolumeGuidName always return STATUS_INVALID_PARAMETER… in order to test, I call FltGetVolumeName just in front of FltGetVolumeGuidName with the same PFLT_VOLUME, which was saved from InstanceSetup. FltGetVolumeName was success, but FltGetVolumeGuidName still reply STATUS_INVALID_PARAMETER to me.
Here is the code :

NTSTATUS status;
ULONG LenNeeded = 0;
context->UniqueVolumeName = IveNewEmptyString((USHORT) DEFAULT_LENG,
PagedPool);
status = FltGetVolumeName(VolObj,VolumeDeviceName,&LenNeeded);
status = FltGetVolumeGuidName(VolObj,UniqueVolumeName,&LenNeeded);

It is very simple, I don’t know why always fail. Could anyone give me an idea about the root cause? Thanks in advance.

PS: here is the content of the _FLT_VOLUME, looks valid to me.
kd> dt 0x823864f8 _FLT_VOLUME
fltmgr!_FLT_VOLUME
+0x000 Base : _FLT_OBJECT
+0x014 Flags : 0x24 (No matching name)
+0x018 FileSystemType : 2 ( FLT_FSTYPE_NTFS )
+0x01c DeviceObject : 0x8239da20 _DEVICE_OBJECT
+0x020 DiskDeviceObject : 0x823ca900 _DEVICE_OBJECT
+0x024 VolumeInNextFrame : (null)
+0x028 Frame : 0x823a0000 _FLTP_FRAME
+0x02c DeviceName : _UNICODE_STRING “\Device\HarddiskVolume1”
+0x034 GuidName : _UNICODE_STRING “”
+0x03c CDODeviceName : _UNICODE_STRING “\Ntfs”
+0x044 CDODriverName : _UNICODE_STRING “\FileSystem\Ntfs”
+0x04c InstanceList : _FLT_RESOURCE_LIST_HEAD
+0x090 Callbacks : _CALLBACK_CTRL
+0x220 ContextLock : _ERESOURCE
+0x258 VolumeContexts : _CONTEXT_LIST_CTRL
+0x25c StreamListCtrls : _FLT_RESOURCE_LIST_HEAD
+0x2a0 NameCacheCtrl : _NAME_CACHE_VOLUME_CTRL
+0x2d0 MountNotifyLock : _ERESOURCE
+0x308 HiddenOperationState : [4] _FLTP_TRACK_WHEN_TO_HIDE

2

Well, FltGetVolumeGuidName can return STATUS_INVALID_PARAMETER when issued on a Raw filesystem. According to your volume structure below the volume has been mounted by NTFS so that doesn’t look like the case, but are you sure the FLT_VOLUME structure below is for the right volume ?

Could you please attach a procmon below your minifilter and see what IO (if any) it sees ? Maybe that will shed some light on the issue (though FltMgr doesn’t usually swallow error codes so most likely the STATUS_INVALID_PARAMETER is the actual status coming from the file system below).

Regards,
Alex.
This posting is provided “AS IS” with no warranties, and confers no rights.

3

Hi,
I found if I call FltGetVolumeGuidName in a system worker thread, result was success. I will try procmon to see if I can find out the root cause.
Thank you for the suggestion, Alex.

Royce