How to cancel a rename operation in minifilter driver

Question

I would like to cancel a rename operation in my minifilter. I've written the code that detects when a file is being rename, but I'm unclear on how to actually cancel the operation. Can anyone help me out with this?

Here is my callback routine that detects for file rename.

FLT_PREOP_CALLBACK_STATUS
PreSetInformation(
    _Inout_ PFLT_CALLBACK_DATA Cbd,
    _In_ PCFLT_RELATED_OBJECTS FltObjects,
    _Flt_CompletionContext_Outptr_ PVOID *CompletionContext
)
{   
    if (Cbd->Iopb->Parameters.SetFileInformation.FileInformationClass == FileRenameInformation)
    {
        WCHAR buf[MAX_PATH] = { 0 };
        PFILE_RENAME_INFORMATION renameInfo = Cbd->Iopb->Parameters.SetFileInformation.InfoBuffer;
        memcpy(buf, renameInfo->FileName, renameInfo->FileNameLength);
        DbgPrint("renameInfo %ws\n", buf);

        if (anCondition(buf))
        {
            // TO DO: cancel a rename
        }
    }

    return FLT_PREOP_SUCCESS_NO_CALLBACK;
}

Answer 1

you need fill Cbd->IoStatus and return FLT_PREOP_COMPLETE so in your code:

if (anCondition(buf))
{
    // TO DO: cancel a rename
    Cbd->IoStatus.Status = <some_status>;
    Cbd->IoStatus.Information = <some_information>;//usually 0
    return FLT_PREOP_COMPLETE;
}