file filter driver intereres page file

Question

I have a file filter driver that is supposed to disallow file/directory access under specific circumstances. I'm using IoRegisterFsRegistrationChange to get notifications about file system change, and attach to the appropriate volume device objects.

It's generally a pass-through filter. The only thing it handles is IRP_MJ_CREATE (to actually disallow some types of file/directory access). All other IRPs and fast-I/O requests are just passed to the underlying device.

It works ok except one thing. If the driver is loaded during system startup (SERVICE_SYSTEM_START) - for the reason I don't quite understand the system paging file is disabled. After the user login there's a "Performance Options" popup dialog displayed. The virtual memory paging file is disabled (and this is what triggers this dialog popup IMHO).

If the driver is loaded dynamically at a later stage - there's no visible problem, everything works as usual.

I tried to disable the handling of IRP_MJ_CREATE (just pass-through it like all other requests), but nothing changes.

I understand that it's usually hard to say where the problem is without seeing the code. But anyway, is this a known problem? What should I check? Is this a symptom of not passing-through some requests in a proper way, or the even fact of attaching a device object to a volume device object may cause such a problem?

All possible ideas are welcome. Thanks in advance.

Answer 1

Found the cause of the problem. The problem was neither in handling Fast-I/O requests nor in how my device was attached to the target one.

As discovered, eventually I didn't include one I/O dispatch handler in the driver dispatch table. That is, my code was:

for (UINT i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++)
    pDriverObject->MajorFunction[i] = Dispatch;

Whereas it should has been:

for (UINT i = 0; i <= IRP_MJ_MAXIMUM_FUNCTION; i++)
    pDriverObject->MajorFunction[i] = Dispatch;

The function I missed was IRP_MJ_PNP - the Plug-and-Play manager request handler. Which is required by file system drivers. After fixing the code the problem has disappeared.

Thanks to all who worried :)