I seem to be having a problem filtering IRP_MJ_NETWORK_QUERY_OPEN in my mini-filter on W2K8 and Win7. This same code has worked fine for months on W2K3 and XP.
From the pre callback I call FltCreateFileEx for FILE_READ_ATTRIBUTES to see if the file exists and to determine if it is a file or folder. If it does not exist I want to do something about it.
The problem I am having is that the second call to FltCreateFileEx below tends to lead to a stack overflow due to infinite recursion. I have not seen it BSOD for a file yet.
Am I doing something silly?
Why is this happening only on W2K8 and Win7?
How do I prevent the recursive calls?
I call FltCreateFileEx as shown below and I have verified that Instance is valid. I do not see any legecy filters on the stack. Only my minifilter, Filter Manager, nt, and ntdll.
InitializeObjectAttributes(&oa, pFileName, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);
status = FltCreateFileEx(g_FilterHandle,
Instance,
&hFileHandle,
NULL,
SYNCHRONIZE, //FILE_READ_ATTRIBUTES,
&oa,
&Iosb,
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
FILE_OPEN,
FILE_NON_DIRECTORY_FILE,
NULL,
0,
0);
if(status == STATUS_FILE_IS_A_DIRECTORY){
//
// This is a folder
//
if(pbIsFolder != NULL){
*pbIsFolder = TRUE;
}
status = FltCreateFileEx(g_FilterHandle,
Instance,
&hFileHandle,
NULL,
FILE_READ_ATTRIBUTES,
&oa,
&Iosb,
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
FILE_OPEN,
FILE_DIRECTORY_FILE,
NULL,
0,
0);
}
Thanks in advance for any help anyone can offer.
Erik