FltVetoBypassIo function (fltkernel.h)

Article
02/22/2024

FltVetoBypassIo retrieves information needed to veto a BypassIO request.

Syntax

NTSTATUS FLTAPI FltVetoBypassIo(
  [in] PFLT_CALLBACK_DATA    CallbackData,
  [in] PCFLT_RELATED_OBJECTS FltObjects,
  [in] NTSTATUS              OperationStatus,
  [in] PCUNICODE_STRING      FailureReason
);

Parameters

[in] CallbackData

Pointer to the FLT_CALLBACK_DATA for FSCTL_MANAGE_BYPASS_IO.

[in] FltObjects

Pointer to the FLT_RELATED_OBJECTS structure for the BypassIO operation.

[in] OperationStatus

The NTSTATUS error code provided by the filter for the veto.

[in] FailureReason

A unique, descriptive string that provides details about why the filter is vetoing the BypassIO enable request.

Return value

FltVetoBypassIo returns STATUS_SUCCESS upon successful completion; otherwise, it returns an NTSTATUS value such as one of the following.

Value	Meaning
STATUS_BUFFER_TOO_SMALL	The FSCTL's output buffer is too small.
STATUS_INVALID_BUFFER_SIZE	The FSCTL's input buffer is too small.
STATUS_INVALID_PARAMETER_3	An appropriate error code was not provided.
STATUS_INVALID_PARAMETER_4	An appropriate failure reason was not provided.
STATUS_NOT_SUPPORTED	The requested operation isn't supported or wasn't requested from a pre-op callback.

Remarks

A minifilter calls FltVetoBypassIo when it intends to veto a FS_BPIO_OP_ENABLE or FS_BPIO_OP_QUERY request on a file. A minifilter should only call this routine from its pre-operation callback.

FltVetoBypassIo fills in the caller-allocated FS_BPIO_OUTPUT structure associated with CallbackData with the information needed to veto the BypassIO request. The caller must provide a buffer that is large enough to hold the structure.

FltVetoBypassIo logs an ETW event with the status, filter-provided reason, and filter's name.

See BypassIO for filter drivers and Supporting BypassIO operations for more information.

Requirements

Requirement	Value
Minimum supported client	Windows 11
Header	fltkernel.h
IRQL	<= APC_LEVEL