Expand Minimize

FltGetFileNameInformationUnsafe routine

The FltGetFileNameInformationUnsafe routine returns name information for an open file or directory.

Syntax


NTSTATUS FltGetFileNameInformationUnsafe(
  _In_      PFILE_OBJECT               FileObject,
  _In_opt_  PFLT_INSTANCE              Instance,
  _In_      FLT_FILE_NAME_OPTIONS      NameOptions,
  _Out_     PFLT_FILE_NAME_INFORMATION *FileNameInformation
);

Parameters

FileObject [in]

Pointer to a file object for the file or directory. The file object must be currently open. This parameter is required and cannot be set to NULL.

Instance [in, optional]

Instance pointer for the caller. This parameter can be set to NULL.

NameOptions [in]

FLT_FILE_NAME_OPTIONS value containing flags that specify the format of the name information to be returned, as well as the query method to be used by the Filter Manager. This parameter is required and cannot be set to NULL.

The following table describes the name format flag values. Only one of the flags can be specified. For more information about these formats, see FLT_FILE_NAME_INFORMATION.

ValueMeaning

FLT_FILE_NAME_NORMALIZED

The FileNameInformation parameter receives the address of a structure containing the normalized name for the file.

FLT_FILE_NAME_OPENED

The FileNameInformation parameter receives the address of a structure containing the name that was used when the file was opened.

FLT_FILE_NAME_SHORT

The FileNameInformation parameter receives the address of a structure containing the short (8.3) name for the file. The short name consists of up to 8 characters, followed immediately by a period and up to 3 more characters. The short name for a file does not include the volume name, directory path, or stream name.

 

The following table describes the query method flag values. Only one of the flags can be specified.

ValueMeaning

FLT_FILE_NAME_QUERY_DEFAULT

FltGetFileNameInformationUnsafe queries the Filter Manager's name cache for the file name information. If the name is not found in the cache, FltGetFileNameInformationUnsafe queries the file system and caches the result.

FLT_FILE_NAME_QUERY_CACHE_ONLY

FltGetFileNameInformationUnsafe queries the Filter Manager's name cache for the file name information. FltGetFileNameInformationUnsafe does not query the file system.

FLT_FILE_NAME_QUERY_FILESYSTEM_ONLY

FltGetFileNameInformationUnsafe queries the file system for the file name information. FltGetFileNameInformationUnsafe does not query the Filter Manager's name cache, and does not cache the result of the file system query.

 

FileNameInformation [out]

Pointer to a caller-allocated variable that receives the address of a system-allocated FLT_FILE_NAME_INFORMATION structure. FltGetFileNameInformationUnsafe allocates this structure from paged pool. When this information is no longer needed, the caller must release the structure by calling FltReleaseFileNameInformation. This parameter is required and cannot be set to NULL.

Return value

FltGetFileNameInformationUnsafe returns STATUS_SUCCESS or an appropriate NTSTATUS value such as one of the following:

Return codeDescription
STATUS_FLT_INVALID_NAME_REQUEST

The file object that the FileObject parameter points to is not currently open. This is an error code.

STATUS_INVALID_PARAMETER

An invalid value was passed for the FileNameInformation parameter. This is an error code.

 

Remarks

The FltGetFileNameInformationUnsafe routine is provided so that you can query the name of a file object outside of the context of an I/O operation on that file object. In these cases, you must call FltGetFileNameInformation.

Unlike the FltGetFileNameInformation routine, FltGetFileNameInformationUnsafe does not protect the caller against the following types of circumstances, where querying the file system for name information can cause deadlocks:

  • When the TopLevelIrp field of the current thread is not NULL. For more information, see IoGetTopLevelIrp.

  • In the paging I/O path.

  • After an IRP_MJ_CLEANUP operation is completed.

  • In a preoperation callback routine (PFLT_PRE_OPERATION_CALLBACK) or a postoperation callback routine (PFLT_POST_OPERATION_CALLBACK) for any of the following operations:
    IRP_MJ_ACQUIRE_FOR_CC_FLUSH
    IRP_MJ_ACQUIRE_FOR_MOD_WRITE
    IRP_MJ_RELEASE_FOR_CC_FLUSH
    IRP_MJ_RELEASE_FOR_MOD_WRITE
    IRP_MJ_RELEASE_FOR_SECTION_SYNCHRONIZATION
  • In a postoperation callback routine for IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION.

If a minifilter does not yet have a filter instance, such as in its DriverEntry routine, it can use NULL for the Instance parameter. This allows DriverEntry routines to access file name information. Except for this case, a NULL value for the instance parameter is reserved for system use.

In create, hard-link, and rename operations, file name tunneling can invalidate the final component in normalized file name information that a minifilter driver retrieves in a preoperation callback routine. If a minifilter driver retrieves normalized file name information in a preoperation callback (PFLT_PRE_OPERATION_CALLBACK) routine by calling a routine such as FltGetFileNameInformationUnsafe, it must call FltGetTunneledName from its postoperation callback (PFLT_POST_OPERATION_CALLBACK) routine to retrieve the correct file name information for the file.

For more information about normalized file name information, see FLT_FILE_NAME_INFORMATION.

Requirements

Target platform

Universal

Header

Fltkernel.h (include Fltkernel.h)

Library

FltMgr.lib

IRQL

<= APC_LEVEL

See also

FLT_FILE_NAME_INFORMATION
FLT_FILE_NAME_OPTIONS
FltGetDestinationFileNameInformation
FltGetFileNameInformation
FltGetTunneledName
FltReferenceFileNameInformation
FltReleaseFileNameInformation
IoGetTopLevelIrp
IRP_MJ_CLEANUP
PFLT_POST_OPERATION_CALLBACK
PFLT_PRE_OPERATION_CALLBACK

 

 

Send comments about this topic to Microsoft

Show:
© 2015 Microsoft