FltGetFileNameInformation fails in pre-create for transacted miniversion

NTFSD
1

Hi all,

In pre-create FltGetFileNameInformation returns
STATUS_STREAM_MINIVERSION_NOT_FOUND although the following is a
succesful create request for a miniversion:

TransactedFile = CreateFileTransacted(
IO_TRANSACTION_FILENAME,
FILE_READ_DATA,
FILE_SHARE_READ | FILE_SHARE_WRITE,
NULL,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL,
NULL,
Transaction,
&TxTransactedVersion.LatestMiniVersion, // ‘1’
NULL);

Despite FltGetFileNameInformation failure, I am able to open the
miniversion with FltCreateFileEx2 using a known fixed file name.

This occurs in Windows 7. Is this a bug?.

Thanks,
Ramon

2

Could you please clarify the sequence of operations ?

Do you:

  1. Create transaction

  2. Call CreateFileTransacted

  3. Call CreateFileTransacted again and for this Create you call
    FltGetFileNameInformation and fail ?

When you say “Despite FltGetFileNameInformation failure, I am able to open
the miniversion with FltCreateFileEx2 using a known fixed file name.”, when
do you do this ? In which context ?

Thanks,

Alex.

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ramon Royo
Sent: Thursday, August 26, 2010 9:37 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] FltGetFileNameInformation fails in pre-create for
transacted miniversion

Hi all,

In pre-create FltGetFileNameInformation returns
STATUS_STREAM_MINIVERSION_NOT_FOUND although the following is a succesful
create request for a miniversion:

TransactedFile = CreateFileTransacted(
IO_TRANSACTION_FILENAME,
FILE_READ_DATA,
FILE_SHARE_READ | FILE_SHARE_WRITE,
NULL,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL,
NULL,
Transaction,
&TxTransactedVersion.LatestMiniVersion, // ‘1’
NULL);

Despite FltGetFileNameInformation failure, I am able to open the miniversion
with FltCreateFileEx2 using a known fixed file name.

This occurs in Windows 7. Is this a bug?.

Thanks,
Ramon

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

3

In addition to Alex’s questions, are there other non MS minifilters around?
Does you minifilter have nameprovider callbacks?

“Ramon Royo” wrote in message news:xxxxx@ntfsd…
Hi all,

In pre-create FltGetFileNameInformation returns
STATUS_STREAM_MINIVERSION_NOT_FOUND although the following is a succesful
create request for a miniversion:

TransactedFile = CreateFileTransacted(
IO_TRANSACTION_FILENAME,
FILE_READ_DATA,
FILE_SHARE_READ | FILE_SHARE_WRITE,
NULL,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL,
NULL,
Transaction,
&TxTransactedVersion.LatestMiniVersion, // ‘1’
NULL);

Despite FltGetFileNameInformation failure, I am able to open the miniversion
with FltCreateFileEx2 using a known fixed file name.

This occurs in Windows 7. Is this a bug?.

Thanks,
Ramon

4

My code is pretty simple. The sequence is:

  1. Create Transaction
  2. CreateFileTransacted (new file is created in the scope of the transaction)
  3. Create Miniversion ‘1’ for the file (FSCTL_TXFS_CREATE_MINIVERSION)
  4. CreateFileTransacted for existing miniversion 1.

For I/O #4, the minifilter is not able to query the name using FltGetFileNameInformation (with options FLT_FILE_NAME_NORMALIZED and FLT_FILE_NAME_QUERY_ALWAYS_ALLOW_CACHE_LOOKUP) during pre-create. Just in the same callback, as I know the name of my test file, I call FltCreateFileEx2 and it succeeds. The point of this is that the minifilter and the user mode can open a file whose name cannot be queried, and this seems a bug.

This problem only occurs for miniversions. Also it does not matter if the transacter writer handle opened in step #2 is closed or not before querying the file name in the minifilter.

Thanks,
Ramon

5

Rod,

This is a clean Windows 7 32-bits system without third party drivers. My minifilter has not nameprovider callbacks.

Thanks,
Ramon

6

Hmm, I’m sorry I don’t have an answer for you. However, I have a couple of
ideas on how to investigate this :slight_smile:

In general querying the name of the file during preCreate is a pretty
complicated proposition. FltMgr tries to figure out what the name would look
like by doing a bunch of directory enumerations and such (it doesn’t try to
open the file though except in very rare cases). It figures out the context
of the request (most importantly in this case the transaction) by looking at
the FLT_CALLBACK_DATA structure that is passed in.

Could you try raising the altitude of your minifilter (for testing purposes
of course) so that it is higher than procmon’s and then look in procmon at
what the requests look like and what fails ? This would be where I would
start investigating. Then assuming your find an operation that fails and it
shouldn’t (where “fails” might mean that a directory enumeration returns
nothing even though the file should be there and not necessarily an error
status from the operation), I would put a breakpoint on NTFS’s dispatch
function and I would look at the IRP and make sure it has the proper
transaction information…

Thanks,
Alex.