FltGetFileNameInformationUnsafe function

The FltGetFileNameInformationUnsafe routine returns name information for an open file or directory.

Syntax

NTSTATUS FLTAPI FltGetFileNameInformationUnsafe(
  PFILE_OBJECT               FileObject,
  PFLT_INSTANCE              Instance,
  FLT_FILE_NAME_OPTIONS      NameOptions,
  PFLT_FILE_NAME_INFORMATION *FileNameInformation
);

Parameters

FileObject

Pointer to a file object for the file or directory. The file object must be currently open. This parameter is required and cannot be set to NULL.

Instance

Instance pointer for the caller. This parameter can be set to NULL.

NameOptions

FLT_FILE_NAME_OPTIONS value containing flags that specify the format of the name information to be returned, as well as the query method to be used by the Filter Manager. This parameter is required and cannot be set to NULL.

The following table describes the name format flag values. Only one of the flags can be specified. For more information about these formats, see FLT_FILE_NAME_INFORMATION.

Value Meaning
FLT_FILE_NAME_NORMALIZED The FileNameInformation parameter receives the address of a structure containing the normalized name for the file.
FLT_FILE_NAME_OPENED The FileNameInformation parameter receives the address of a structure containing the name that was used when the file was opened.
FLT_FILE_NAME_SHORT The FileNameInformation parameter receives the address of a structure containing the short (8.3) name for the file. The short name consists of up to 8 characters, followed immediately by a period and up to 3 more characters. The short name for a file does not include the volume name, directory path, or stream name.

The following table describes the query method flag values. Only one of the flags can be specified.

Value Meaning
FLT_FILE_NAME_QUERY_DEFAULT FltGetFileNameInformationUnsafe queries the Filter Manager's name cache for the file name information. If the name is not found in the cache, FltGetFileNameInformationUnsafe queries the file system and caches the result.
FLT_FILE_NAME_QUERY_CACHE_ONLY FltGetFileNameInformationUnsafe queries the Filter Manager's name cache for the file name information. FltGetFileNameInformationUnsafe does not query the file system.
FLT_FILE_NAME_QUERY_FILESYSTEM_ONLY FltGetFileNameInformationUnsafe queries the file system for the file name information. FltGetFileNameInformationUnsafe does not query the Filter Manager's name cache, and does not cache the result of the file system query.

FileNameInformation

Pointer to a caller-allocated variable that receives the address of a system-allocated FLT_FILE_NAME_INFORMATION structure. FltGetFileNameInformationUnsafe allocates this structure from paged pool. When this information is no longer needed, the caller must release the structure by calling FltReleaseFileNameInformation. This parameter is required and cannot be set to NULL.

Return Value

FltGetFileNameInformationUnsafe returns STATUS_SUCCESS or an appropriate NTSTATUS value such as one of the following:

Return code Description
STATUS_FLT_INVALID_NAME_REQUEST
The file object that the FileObject parameter points to is not currently open. This is an error code.
STATUS_INVALID_PARAMETER
An invalid value was passed for the FileNameInformation parameter. This is an error code.

Remarks

The FltGetFileNameInformationUnsafe routine is provided so that you can query the name of a file object outside of the context of an I/O operation on that file object. In these cases, you must call FltGetFileNameInformation.

Unlike the FltGetFileNameInformation routine, FltGetFileNameInformationUnsafe does not protect the caller against the following types of circumstances, where querying the file system for name information can cause deadlocks:

  • When the TopLevelIrp field of the current thread is not NULL. For more information, see IoGetTopLevelIrp.

  • In the paging I/O path.

  • After an IRP_MJ_CLEANUP operation is completed.

  • In a preoperation callback routine (PFLT_PRE_OPERATION_CALLBACK) or a postoperation callback routine (PFLT_POST_OPERATION_CALLBACK) for any of the following operations:
    IRP_MJ_ACQUIRE_FOR_CC_FLUSH
    IRP_MJ_ACQUIRE_FOR_MOD_WRITE
    IRP_MJ_RELEASE_FOR_CC_FLUSH
    IRP_MJ_RELEASE_FOR_MOD_WRITE
    IRP_MJ_RELEASE_FOR_SECTION_SYNCHRONIZATION
  • In a postoperation callback routine for IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION.

If a minifilter does not yet have a filter instance, such as in its DriverEntry routine, it can use NULL for the Instance parameter. This allows DriverEntry routines to access file name information. Except for this case, a NULL value for the instance parameter is reserved for system use.

In create, hard-link, and rename operations, file name tunneling can invalidate the final component in normalized file name information that a minifilter driver retrieves in a preoperation callback routine. If a minifilter driver retrieves normalized file name information in a preoperation callback (PFLT_PRE_OPERATION_CALLBACK) routine by calling a routine such as FltGetFileNameInformationUnsafe, it must call FltGetTunneledName from its postoperation callback (PFLT_POST_OPERATION_CALLBACK) routine to retrieve the correct file name information for the file.

For more information about normalized file name information, see FLT_FILE_NAME_INFORMATION.

Requirements

   
Target Platform Universal
Header fltkernel.h (include Fltkernel.h)
Library FltMgr.lib
DLL Fltmgr.sys
IRQL "<= APC_LEVEL"

See Also

FLT_FILE_NAME_INFORMATION

FLT_FILE_NAME_OPTIONS

FltGetDestinationFileNameInformation

FltGetFileNameInformation

FltGetTunneledName

FltReferenceFileNameInformation

FltReleaseFileNameInformation

IRP_MJ_CLEANUP

IoGetTopLevelIrp

PFLT_POST_OPERATION_CALLBACK

PFLT_PRE_OPERATION_CALLBACK