pastebin - collaborative debugging tool
rovema.kpaste.net RSS


msnfs41client: Patches for kernel upcall size verification, returning read delegations on SETATTR only for unsafe attributes+misc, 2025-10-22
Posted by Anonymous on Wed 22nd Oct 2025 21:38
raw | new post

  1. From 10d6ab01b7a430e850d8ee2598a0c89951475847 Mon Sep 17 00:00:00 2001
  2. From: Roland Mainz <roland.mainz@nrubsig.org>
  3. Date: Tue, 21 Oct 2025 21:27:53 +0200
  4. Subject: [PATCH 1/9] sys: |nfs41_downcall()| should unlock kernel pages if an
  5.  updowncall entry gets orphaned
  6.  
  7. |nfs41_downcall()| should unlock kernel pages if an updowncall entry gets
  8. orphaned.
  9.  
  10. Signed-off-by: Cedric Blancher <cedric.blancher@gmail.com>
  11. ---
  12. sys/nfs41sys_dir.c        | 10 ++++++----
  13.  sys/nfs41sys_openclose.c  | 16 ++++++++++------
  14.  sys/nfs41sys_updowncall.c |  4 ++++
  15.  3 files changed, 20 insertions(+), 10 deletions(-)
  16.  
  17. diff --git a/sys/nfs41sys_dir.c b/sys/nfs41sys_dir.c
  18. index 6cdcbfc..3dd40a8 100644
  19. --- a/sys/nfs41sys_dir.c
  20. +++ b/sys/nfs41sys_dir.c
  21. @@ -286,8 +286,6 @@ NTSTATUS nfs41_QueryDirectory(
  22.  
  23.      status = nfs41_UpcallWaitForReply(entry, pVNetRootContext->timeout);
  24.  
  25. -    (void)nfs41_UnlockKernelPages(entry->u.QueryFile.mdl);
  26. -
  27.      if (status) {
  28.          /* Timeout - |nfs41_downcall()| will free |entry|+contents */
  29.          entry = NULL;
  30. @@ -315,10 +313,14 @@ NTSTATUS nfs41_QueryDirectory(
  31.          /* map windows ERRORs to NTSTATUS */
  32.          status = map_querydir_errors(entry->status);
  33.      }
  34. -    IoFreeMdl(entry->u.QueryFile.mdl);
  35. -    entry->u.QueryFile.mdl = NULL;
  36. +
  37.  out:
  38.      if (entry) {
  39. +        if (entry->u.QueryFile.mdl) {
  40. +            (void)nfs41_UnlockKernelPages(entry->u.QueryFile.mdl);
  41. +            IoFreeMdl(entry->u.QueryFile.mdl);
  42. +            entry->u.QueryFile.mdl = NULL;
  43. +        }
  44.          nfs41_UpcallDestroy(entry);
  45.      }
  46.  #ifdef ENABLE_TIMINGS
  47. diff --git a/sys/nfs41sys_openclose.c b/sys/nfs41sys_openclose.c
  48. index 4f71146..16090a2 100644
  49. --- a/sys/nfs41sys_openclose.c
  50. +++ b/sys/nfs41sys_openclose.c
  51. @@ -746,18 +746,22 @@ retry_on_link:
  52.  
  53.      status = nfs41_UpcallWaitForReply(entry, pVNetRootContext->timeout);
  54.  
  55. -    if (entry->u.Open.EaMdl) {
  56. -        (void)nfs41_UnlockKernelPages(entry->u.Open.EaMdl);
  57. -        IoFreeMdl(entry->u.Open.EaMdl);
  58. -        entry->u.Open.EaMdl = NULL;
  59. -    }
  60. -
  61.      if (status) {
  62.          /* Timeout - |nfs41_downcall()| will free |entry|+contents */
  63.          entry = NULL;
  64.          goto out;
  65.      }
  66.  
  67. +    /*
  68. +     * Unlock |entry->u.Open.EaMdl| here because symlink reparse can cause
  69. +     * more upcalls (which need |u.Open.EaMdl|)
  70. +     */
  71. +    if (entry->u.Open.EaMdl) {
  72. +        (void)nfs41_UnlockKernelPages(entry->u.Open.EaMdl);
  73. +        IoFreeMdl(entry->u.Open.EaMdl);
  74. +        entry->u.Open.EaMdl = NULL;
  75. +    }
  76. +
  77.      if (entry->status == NO_ERROR && entry->errno == ERROR_REPARSE) {
  78.          /* symbolic link handling. when attempting to open a symlink when the
  79.           * FILE_OPEN_REPARSE_POINT flag is not set, replace the filename with
  80. diff --git a/sys/nfs41sys_updowncall.c b/sys/nfs41sys_updowncall.c
  81. index aba635b..5315ba4 100644
  82. --- a/sys/nfs41sys_updowncall.c
  83. +++ b/sys/nfs41sys_updowncall.c
  84. @@ -692,6 +692,7 @@ NTSTATUS nfs41_downcall(
  85.                  (void)nfs41_UnmapLockedKernelPagesInNfsDaemonAddressSpace(
  86.                      cur->u.QueryFile.mdl_buf,
  87.                      cur->u.QueryFile.mdl);
  88. +                (void)nfs41_UnlockKernelPages(cur->u.QueryFile.mdl);
  89.                  IoFreeMdl(cur->u.QueryFile.mdl);
  90.                  cur->u.QueryFile.mdl_buf = NULL;
  91.                  cur->u.QueryFile.mdl = NULL;
  92. @@ -702,6 +703,7 @@ NTSTATUS nfs41_downcall(
  93.                  (void)nfs41_UnmapLockedKernelPagesInNfsDaemonAddressSpace(
  94.                      cur->u.Open.EaBuffer,
  95.                      cur->u.Open.EaMdl);
  96. +                (void)nfs41_UnlockKernelPages(cur->u.Open.EaMdl);
  97.                  IoFreeMdl(cur->u.Open.EaMdl);
  98.                  cur->u.Open.EaBuffer = NULL;
  99.                  cur->u.Open.EaMdl = NULL;
  100. @@ -712,6 +714,8 @@ NTSTATUS nfs41_downcall(
  101.                  (void)nfs41_UnmapLockedKernelPagesInNfsDaemonAddressSpace(
  102.                      cur->u.QueryAllocatedRanges.Buffer,
  103.                      cur->u.QueryAllocatedRanges.BufferMdl);
  104. +                (void)nfs41_UnlockKernelPages(
  105. +                    cur->u.QueryAllocatedRanges.BufferMdl);
  106.                  IoFreeMdl(cur->u.QueryAllocatedRanges.BufferMdl);
  107.                  cur->u.QueryAllocatedRanges.Buffer = NULL;
  108.                  cur->u.QueryAllocatedRanges.BufferMdl = NULL;
  109. --
  110. 2.51.0
  111.  
  112. From 084fe69b816c259032e99f711e9f73b9c546da28 Mon Sep 17 00:00:00 2001
  113. From: Roland Mainz <roland.mainz@nrubsig.org>
  114. Date: Tue, 21 Oct 2025 21:40:12 +0200
  115. Subject: [PATCH 2/9] build.vc19: Fix XML layout for <SignFile> to match Visual
  116.  Studio 2019 default
  117.  
  118. Fix XML layout for <SignFile> to match Visual Studio 2019 default.
  119.  
  120. Signed-off-by: Cedric Blancher <cedric.blancher@gmail.com>
  121. ---
  122. build.vc19/nfs_install/nfs_install.vcxproj | 5 +----
  123.  build.vc19/nfs_mount/nfs_mount.vcxproj     | 5 +----
  124.  build.vc19/nfsd/nfsd.vcxproj               | 5 +----
  125.  3 files changed, 3 insertions(+), 12 deletions(-)
  126.  
  127. diff --git a/build.vc19/nfs_install/nfs_install.vcxproj b/build.vc19/nfs_install/nfs_install.vcxproj
  128. index 7e313e7..9335136 100644
  129. --- a/build.vc19/nfs_install/nfs_install.vcxproj
  130. +++ b/build.vc19/nfs_install/nfs_install.vcxproj
  131. @@ -1,10 +1,7 @@
  132. <?xml version="1.0" encoding="utf-8"?>
  133.  <Project DefaultTargets="Build" ToolsVersion="14.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  134.    <Target Name="Sign" AfterTargets="Build">
  135. -    <SignFile
  136. -      CertificateThumbprint="$(CERTIFICATE_THUMBPRINT)"
  137. -      SigningTarget="$(OutputPath)\nfs_install.exe"
  138. -      TargetFrameworkVersion="v4.5" />
  139. +    <SignFile CertificateThumbprint="$(CERTIFICATE_THUMBPRINT)" SigningTarget="$(OutputPath)\nfs_install.exe" TargetFrameworkVersion="v4.5" />
  140.    </Target>
  141.    <ItemGroup Label="ProjectConfigurations">
  142.      <ProjectConfiguration Include="Debug|Win32">
  143. diff --git a/build.vc19/nfs_mount/nfs_mount.vcxproj b/build.vc19/nfs_mount/nfs_mount.vcxproj
  144. index 2b25d55..fc906db 100644
  145. --- a/build.vc19/nfs_mount/nfs_mount.vcxproj
  146. +++ b/build.vc19/nfs_mount/nfs_mount.vcxproj
  147. @@ -1,10 +1,7 @@
  148. <?xml version="1.0" encoding="utf-8"?>
  149.  <Project DefaultTargets="Build" ToolsVersion="14.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  150.    <Target Name="Sign" AfterTargets="Build">
  151. -    <SignFile
  152. -      CertificateThumbprint="$(CERTIFICATE_THUMBPRINT)"
  153. -      SigningTarget="$(OutputPath)\nfs_mount.exe"
  154. -      TargetFrameworkVersion="v4.5" />
  155. +    <SignFile CertificateThumbprint="$(CERTIFICATE_THUMBPRINT)" SigningTarget="$(OutputPath)\nfs_mount.exe" TargetFrameworkVersion="v4.5" />
  156.    </Target>
  157.    <Target Name="generate_git_version_header" BeforeTargets="ClCompile">
  158.      <Exec Command="git describe --long --always --dirty --exclude=* --abbrev=8" ConsoleToMSBuild="True" IgnoreExitCode="False">
  159. diff --git a/build.vc19/nfsd/nfsd.vcxproj b/build.vc19/nfsd/nfsd.vcxproj
  160. index fc5f5d4..97c2c2f 100644
  161. --- a/build.vc19/nfsd/nfsd.vcxproj
  162. +++ b/build.vc19/nfsd/nfsd.vcxproj
  163. @@ -1,10 +1,7 @@
  164. <?xml version="1.0" encoding="utf-8"?>
  165.  <Project DefaultTargets="Build" ToolsVersion="14.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  166.    <Target Name="Sign" AfterTargets="Build">
  167. -    <SignFile
  168. -      CertificateThumbprint="$(CERTIFICATE_THUMBPRINT)"
  169. -      SigningTarget="$(OutputPath)\nfsd.exe"
  170. -      TargetFrameworkVersion="v4.5" />
  171. +    <SignFile CertificateThumbprint="$(CERTIFICATE_THUMBPRINT)" SigningTarget="$(OutputPath)\nfsd.exe" TargetFrameworkVersion="v4.5" />
  172.    </Target>
  173.    <Target Name="generate_git_version_header" BeforeTargets="ClCompile">
  174.      <Exec Command="git describe --long --always --dirty --exclude=* --abbrev=8" ConsoleToMSBuild="True" IgnoreExitCode="False">
  175. --
  176. 2.51.0
  177.  
  178. From a71c239392e5d3f33589191675233796505b2e2a Mon Sep 17 00:00:00 2001
  179. From: Roland Mainz <roland.mainz@nrubsig.org>
  180. Date: Tue, 21 Oct 2025 22:32:46 +0200
  181. Subject: [PATCH 3/9] build.vc19: Build VS 32bit binaries with
  182.  /LARGEADDRESSAWARE
  183.  
  184. Build 32bit binaries build with Visual Studio with /LARGEADDRESSAWARE
  185. linker option.
  186.  
  187. Reported-by: Cedric Blancher <cedric.blancher@gmail.com>
  188. Signed-off-by: Cedric Blancher <cedric.blancher@gmail.com>
  189. ---
  190. build.vc19/nfs_install/nfs_install.vcxproj     | 2 ++
  191.  build.vc19/nfs_mount/nfs_mount.vcxproj         | 2 ++
  192.  build.vc19/nfsclientdctl/nfsclientdctl.vcxproj | 2 ++
  193.  build.vc19/nfsd/nfsd.vcxproj                   | 2 ++
  194.  4 files changed, 8 insertions(+)
  195.  
  196. diff --git a/build.vc19/nfs_install/nfs_install.vcxproj b/build.vc19/nfs_install/nfs_install.vcxproj
  197. index 9335136..d15ebb2 100644
  198. --- a/build.vc19/nfs_install/nfs_install.vcxproj
  199. +++ b/build.vc19/nfs_install/nfs_install.vcxproj
  200. @@ -133,6 +133,7 @@
  201.      <Link>
  202.        <SubSystem>Console</SubSystem>
  203.        <GenerateDebugInformation>true</GenerateDebugInformation>
  204. +      <LargeAddressAware>true</LargeAddressAware>
  205.      </Link>
  206.    </ItemDefinitionGroup>
  207.    <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
  208. @@ -190,6 +191,7 @@
  209.        <GenerateDebugInformation>true</GenerateDebugInformation>
  210.        <EnableCOMDATFolding>true</EnableCOMDATFolding>
  211.        <OptimizeReferences>true</OptimizeReferences>
  212. +      <LargeAddressAware>true</LargeAddressAware>
  213.      </Link>
  214.    </ItemDefinitionGroup>
  215.    <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
  216. diff --git a/build.vc19/nfs_mount/nfs_mount.vcxproj b/build.vc19/nfs_mount/nfs_mount.vcxproj
  217. index fc906db..3b4bab2 100644
  218. --- a/build.vc19/nfs_mount/nfs_mount.vcxproj
  219. +++ b/build.vc19/nfs_mount/nfs_mount.vcxproj
  220. @@ -140,6 +140,7 @@
  221.        <SubSystem>Console</SubSystem>
  222.        <GenerateDebugInformation>true</GenerateDebugInformation>
  223.        <AdditionalDependencies>mpr.lib;%(AdditionalDependencies)</AdditionalDependencies>
  224. +      <LargeAddressAware>true</LargeAddressAware>
  225.      </Link>
  226.    </ItemDefinitionGroup>
  227.    <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
  228. @@ -200,6 +201,7 @@
  229.        <EnableCOMDATFolding>true</EnableCOMDATFolding>
  230.        <OptimizeReferences>true</OptimizeReferences>
  231.        <AdditionalDependencies>mpr.lib;%(AdditionalDependencies)</AdditionalDependencies>
  232. +      <LargeAddressAware>true</LargeAddressAware>
  233.      </Link>
  234.    </ItemDefinitionGroup>
  235.    <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
  236. diff --git a/build.vc19/nfsclientdctl/nfsclientdctl.vcxproj b/build.vc19/nfsclientdctl/nfsclientdctl.vcxproj
  237. index afe031e..1656b9c 100755
  238. --- a/build.vc19/nfsclientdctl/nfsclientdctl.vcxproj
  239. +++ b/build.vc19/nfsclientdctl/nfsclientdctl.vcxproj
  240. @@ -133,6 +133,7 @@
  241.      <Link>
  242.        <SubSystem>Console</SubSystem>
  243.        <GenerateDebugInformation>true</GenerateDebugInformation>
  244. +      <LargeAddressAware>true</LargeAddressAware>
  245.      </Link>
  246.    </ItemDefinitionGroup>
  247.    <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
  248. @@ -190,6 +191,7 @@
  249.        <GenerateDebugInformation>true</GenerateDebugInformation>
  250.        <EnableCOMDATFolding>true</EnableCOMDATFolding>
  251.        <OptimizeReferences>true</OptimizeReferences>
  252. +      <LargeAddressAware>true</LargeAddressAware>
  253.      </Link>
  254.    </ItemDefinitionGroup>
  255.    <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
  256. diff --git a/build.vc19/nfsd/nfsd.vcxproj b/build.vc19/nfsd/nfsd.vcxproj
  257. index 97c2c2f..dfff050 100644
  258. --- a/build.vc19/nfsd/nfsd.vcxproj
  259. +++ b/build.vc19/nfsd/nfsd.vcxproj
  260. @@ -146,6 +146,7 @@
  261.        <SubSystem>Console</SubSystem>
  262.        <GenerateDebugInformation>true</GenerateDebugInformation>
  263.        <AdditionalDependencies>iphlpapi.lib;ws2_32.lib;wldap32.lib;icu.lib;ntdll.lib;..\$(Configuration)\libtirpc.lib;%(AdditionalDependencies)</AdditionalDependencies>
  264. +      <LargeAddressAware>true</LargeAddressAware>
  265.      </Link>
  266.    </ItemDefinitionGroup>
  267.    <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
  268. @@ -225,6 +226,7 @@
  269.        <OptimizeReferences>true</OptimizeReferences>
  270.        <AdditionalDependencies>iphlpapi.lib;ws2_32.lib;wldap32.lib;icu.lib;ntdll.lib;..\$(Configuration)\libtirpc.lib;%(AdditionalDependencies)</AdditionalDependencies>
  271.        <LinkTimeCodeGeneration>UseLinkTimeCodeGeneration</LinkTimeCodeGeneration>
  272. +      <LargeAddressAware>true</LargeAddressAware>
  273.      </Link>
  274.    </ItemDefinitionGroup>
  275.    <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
  276. --
  277. 2.51.0
  278.  
  279. From 82be91b0b1354f76127bbded95bca2ff0876e6a2 Mon Sep 17 00:00:00 2001
  280. From: Lionel Cons <lionelcons1972@gmail.com>
  281. Date: Wed, 22 Oct 2025 13:35:03 +0200
  282. Subject: [PATCH 4/9] tests: nfs_ea.exe should be able to handle EAs with
  283.  values up to 8kb
  284.  
  285. nfs_ea.exe should be able to handle EAs with values up to 8kb.
  286.  
  287. Signed-off-by: Cedric Blancher <cedric.blancher@gmail.com>
  288. ---
  289. tests/ea/main.c | 4 ++--
  290.  1 file changed, 2 insertions(+), 2 deletions(-)
  291.  
  292. diff --git a/tests/ea/main.c b/tests/ea/main.c
  293. index d8fa00b..e05cc13 100644
  294. --- a/tests/ea/main.c
  295. +++ b/tests/ea/main.c
  296. @@ -39,8 +39,8 @@ typedef unsigned long DWORD, *PDWORD, *LPDWORD;
  297.  
  298.  #include "nfs_ea.h"
  299.  
  300. -#define MAX_LIST_LEN 4096
  301. -#define MAX_EA_VALUE 256
  302. +#define MAX_LIST_LEN 16384
  303. +#define MAX_EA_VALUE 8192
  304.  
  305.  #define MAX_GETEA (sizeof(FILE_GET_EA_INFORMATION) + MAX_EA_VALUE)
  306.  #define MAX_FULLEA (sizeof(FILE_FULL_EA_INFORMATION) + 2 * MAX_EA_VALUE)
  307. --
  308. 2.51.0
  309.  
  310. From 73c8f8d8f45090f48b4dc06430d8ce4bf4e97217 Mon Sep 17 00:00:00 2001
  311. From: Roland Mainz <roland.mainz@nrubsig.org>
  312. Date: Wed, 22 Oct 2025 13:41:12 +0200
  313. Subject: [PATCH 5/9] sys: Move |nfs41_updowncall_entry.buf| into per op union
  314.  structs
  315.  
  316. Move |nfs41_updowncall_entry.buf| into per op union structs.
  317. That avoids usage of |buf|/|buf_len| which are unused for that
  318. specific op.
  319.  
  320. Reported-by: Dan Shelton <dan.f.shelton@gmail.com>
  321. Signed-off-by: Cedric Blancher <cedric.blancher@gmail.com>
  322. ---
  323. sys/nfs41sys_acl.c        | 46 +++++++++++++++++++--------------------
  324.  sys/nfs41sys_dir.c        | 17 +++++++--------
  325.  sys/nfs41sys_driver.c     |  4 ++--
  326.  sys/nfs41sys_driver.h     | 16 ++++++++++++--
  327.  sys/nfs41sys_ea.c         | 26 +++++++++++-----------
  328.  sys/nfs41sys_fileinfo.c   | 27 ++++++++++++-----------
  329.  sys/nfs41sys_readwrite.c  | 39 ++++++++++++++++++---------------
  330.  sys/nfs41sys_updowncall.c | 10 ++++-----
  331.  sys/nfs41sys_volinfo.c    |  9 ++++----
  332.  9 files changed, 105 insertions(+), 89 deletions(-)
  333.  
  334. diff --git a/sys/nfs41sys_acl.c b/sys/nfs41sys_acl.c
  335. index e077b26..1846260 100644
  336. --- a/sys/nfs41sys_acl.c
  337. +++ b/sys/nfs41sys_acl.c
  338. @@ -114,7 +114,7 @@ NTSTATUS marshal_nfs41_setacl(
  339.      else tmp += *len;
  340.  
  341.      header_len = *len + sizeof(SECURITY_INFORMATION) +
  342. -        sizeof(ULONG) + entry->buf_len;
  343. +        sizeof(ULONG) + entry->u.Acl.buf_len;
  344.      if (header_len > buf_len) {
  345.          status = STATUS_INSUFFICIENT_RESOURCES;
  346.          goto out;
  347. @@ -122,14 +122,14 @@ NTSTATUS marshal_nfs41_setacl(
  348.  
  349.      RtlCopyMemory(tmp, &entry->u.Acl.query, sizeof(SECURITY_INFORMATION));
  350.      tmp += sizeof(SECURITY_INFORMATION);
  351. -    RtlCopyMemory(tmp, &entry->buf_len, sizeof(ULONG));
  352. +    RtlCopyMemory(tmp, &entry->u.Acl.buf_len, sizeof(ULONG));
  353.      tmp += sizeof(ULONG);
  354. -    RtlCopyMemory(tmp, entry->buf, entry->buf_len);
  355. +    RtlCopyMemory(tmp, entry->u.Acl.buf, entry->u.Acl.buf_len);
  356.      *len = header_len;
  357.  
  358.  #ifdef DEBUG_MARSHAL_DETAIL
  359.      DbgP("marshal_nfs41_setacl: class=0x%x sec_desc_len=%lu\n",
  360. -         (int)entry->u.Acl.query, (long)entry->buf_len);
  361. +         (int)entry->u.Acl.query, (long)entry->u.Acl.buf_len);
  362.  #endif
  363.  out:
  364.      return status;
  365. @@ -144,17 +144,17 @@ NTSTATUS unmarshal_nfs41_getacl(
  366.  
  367.      RtlCopyMemory(&buf_len, *buf, sizeof(DWORD));
  368.      *buf += sizeof(DWORD);
  369. -    cur->buf = RxAllocatePoolWithTag(NonPagedPoolNx,
  370. +    cur->u.Acl.buf = RxAllocatePoolWithTag(NonPagedPoolNx,
  371.          buf_len, NFS41_MM_POOLTAG_ACL);
  372. -    if (cur->buf == NULL) {
  373. +    if (cur->u.Acl.buf == NULL) {
  374.          cur->status = status = STATUS_INSUFFICIENT_RESOURCES;
  375.          goto out;
  376.      }
  377. -    RtlCopyMemory(cur->buf, *buf, buf_len);
  378. +    RtlCopyMemory(cur->u.Acl.buf, *buf, buf_len);
  379.      *buf += buf_len;
  380. -    if (buf_len > cur->buf_len)
  381. +    if (buf_len > cur->u.Acl.buf_len)
  382.          cur->status = STATUS_BUFFER_TOO_SMALL;
  383. -    cur->buf_len = buf_len;
  384. +    cur->u.Acl.buf_len = buf_len;
  385.  
  386.  out:
  387.      return status;
  388. @@ -284,7 +284,7 @@ NTSTATUS nfs41_QuerySecurityInformation(
  389.      /* we can't provide RxContext->CurrentIrp->UserBuffer to the upcall thread
  390.       * because it becomes an invalid pointer with that execution context
  391.       */
  392. -    entry->buf_len = querysecuritylength;
  393. +    entry->u.Acl.buf_len = querysecuritylength;
  394.  
  395.      status = nfs41_UpcallWaitForReply(entry, pVNetRootContext->timeout);
  396.      if (status) {
  397. @@ -298,13 +298,13 @@ NTSTATUS nfs41_QuerySecurityInformation(
  398.              "STATUS_BUFFER_OVERFLOW for entry, "
  399.              "got %lu, need %lu\n",
  400.              (unsigned long)querysecuritylength,
  401. -            (unsigned long)entry->buf_len);
  402. +            (unsigned long)entry->u.Acl.buf_len);
  403.          status = STATUS_BUFFER_OVERFLOW;
  404. -        RxContext->InformationToReturn = entry->buf_len;
  405. +        RxContext->InformationToReturn = entry->u.Acl.buf_len;
  406.  
  407. -        if (entry->buf) {
  408. -            RxFreePool(entry->buf);
  409. -            entry->buf = NULL;
  410. +        if (entry->u.Acl.buf) {
  411. +            RxFreePool(entry->u.Acl.buf);
  412. +            entry->u.Acl.buf = NULL;
  413.          }
  414.      } else if (entry->status == STATUS_SUCCESS) {
  415.          /*
  416. @@ -317,9 +317,9 @@ NTSTATUS nfs41_QuerySecurityInformation(
  417.              nfs41_fobx->acl_len = 0;
  418.          }
  419.  
  420. -        nfs41_fobx->acl = entry->buf;
  421. -        nfs41_fobx->acl_len = entry->buf_len;
  422. -        entry->buf = NULL;
  423. +        nfs41_fobx->acl = entry->u.Acl.buf;
  424. +        nfs41_fobx->acl_len = entry->u.Acl.buf_len;
  425. +        entry->u.Acl.buf = NULL;
  426.          KeQuerySystemTime(&nfs41_fobx->time);
  427.  
  428.          PSECURITY_DESCRIPTOR sec_desc = (PSECURITY_DESCRIPTOR)
  429. @@ -336,9 +336,9 @@ NTSTATUS nfs41_QuerySecurityInformation(
  430.      } else {
  431.          status = map_query_acl_error(entry->status);
  432.  
  433. -        if (entry->buf) {
  434. -            RxFreePool(entry->buf);
  435. -            entry->buf = NULL;
  436. +        if (entry->u.Acl.buf) {
  437. +            RxFreePool(entry->u.Acl.buf);
  438. +            entry->u.Acl.buf = NULL;
  439.          }
  440.      }
  441.  out:
  442. @@ -443,8 +443,8 @@ NTSTATUS nfs41_SetSecurityInformation(
  443.      if (status) goto out;
  444.  
  445.      entry->u.Acl.query = info_class;
  446. -    entry->buf = sec_desc;
  447. -    entry->buf_len = RtlLengthSecurityDescriptor(sec_desc);
  448. +    entry->u.Acl.buf = sec_desc;
  449. +    entry->u.Acl.buf_len = RtlLengthSecurityDescriptor(sec_desc);
  450.  #ifdef ENABLE_TIMINGS
  451.      InterlockedIncrement(&setacl.sops);
  452.      InterlockedAdd64(&setacl.size, entry->u.Acl.buf_len);
  453. diff --git a/sys/nfs41sys_dir.c b/sys/nfs41sys_dir.c
  454. index 3dd40a8..64f16c5 100644
  455. --- a/sys/nfs41sys_dir.c
  456. +++ b/sys/nfs41sys_dir.c
  457. @@ -91,7 +91,7 @@ NTSTATUS marshal_nfs41_dirquery(
  458.  
  459.      RtlCopyMemory(tmp, &entry->u.QueryFile.InfoClass, sizeof(ULONG));
  460.      tmp += sizeof(ULONG);
  461. -    RtlCopyMemory(tmp, &entry->buf_len, sizeof(ULONG));
  462. +    RtlCopyMemory(tmp, &entry->u.QueryFile.buf_len, sizeof(ULONG));
  463.      tmp += sizeof(ULONG);
  464.      status = marshall_unicode_as_utf8(&tmp, entry->u.QueryFile.filter);
  465.      if (status) goto out;
  466. @@ -121,7 +121,7 @@ NTSTATUS marshal_nfs41_dirquery(
  467.  #ifdef DEBUG_MARSHAL_DETAIL
  468.      DbgP("marshal_nfs41_dirquery: filter='%wZ' class=%d len=%d "
  469.           "1st\\restart\\single=%d\\%d\\%d\n", entry->u.QueryFile.filter,
  470. -         entry->u.QueryFile.InfoClass, entry->buf_len,
  471. +         entry->u.QueryFile.InfoClass, entry->u.QueryFile.buf_len,
  472.           entry->u.QueryFile.initial_query, entry->u.QueryFile.restart_scan,
  473.           entry->u.QueryFile.return_single);
  474.  #endif
  475. @@ -144,9 +144,9 @@ NTSTATUS unmarshal_nfs41_dirquery(
  476.      (void)nfs41_UnmapLockedKernelPagesInNfsDaemonAddressSpace(
  477.          cur->u.QueryFile.mdl_buf,
  478.          cur->u.QueryFile.mdl);
  479. -    if (buf_len > cur->buf_len)
  480. +    if (buf_len > cur->u.QueryFile.buf_len)
  481.          cur->status = STATUS_BUFFER_TOO_SMALL;
  482. -    cur->buf_len = buf_len;
  483. +    cur->u.QueryFile.buf_len = buf_len;
  484.  
  485.      return status;
  486.  }
  487. @@ -253,8 +253,7 @@ NTSTATUS nfs41_QueryDirectory(
  488.      if (status) goto out;
  489.  
  490.      entry->u.QueryFile.InfoClass = InfoClass;
  491. -    entry->buf_len = RxContext->Info.LengthRemaining;
  492. -    entry->buf = RxContext->Info.Buffer;
  493. +    entry->u.QueryFile.buf_len = RxContext->Info.LengthRemaining;
  494.      entry->u.QueryFile.mdl = IoAllocateMdl(RxContext->Info.Buffer,
  495.          RxContext->Info.LengthRemaining, FALSE, FALSE, NULL);
  496.      if (entry->u.QueryFile.mdl == NULL) {
  497. @@ -294,15 +293,15 @@ NTSTATUS nfs41_QueryDirectory(
  498.  
  499.      if (entry->status == STATUS_BUFFER_TOO_SMALL) {
  500.          DbgP("nfs41_QueryDirectory: buffer too small provided %d need %lu\n",
  501. -            RxContext->Info.LengthRemaining, entry->buf_len);
  502. -        RxContext->InformationToReturn = entry->buf_len;
  503. +            RxContext->Info.LengthRemaining, entry->u.QueryFile.buf_len);
  504. +        RxContext->InformationToReturn = entry->u.QueryFile.buf_len;
  505.          status = STATUS_BUFFER_TOO_SMALL;
  506.      } else if (entry->status == STATUS_SUCCESS) {
  507.  #ifdef ENABLE_TIMINGS
  508.          InterlockedIncrement(&readdir.sops);
  509.          InterlockedAdd64(&readdir.size, entry->u.QueryFile.buf_len);
  510.  #endif
  511. -        RxContext->Info.LengthRemaining -= entry->buf_len;
  512. +        RxContext->Info.LengthRemaining -= entry->u.QueryFile.buf_len;
  513.          status = STATUS_SUCCESS;
  514.      } else if ((entry->status == STATUS_ACCESS_VIOLATION) ||
  515.          (entry->status == STATUS_INSUFFICIENT_RESOURCES)) {
  516. diff --git a/sys/nfs41sys_driver.c b/sys/nfs41sys_driver.c
  517. index c5c2a99..0cff2bd 100644
  518. --- a/sys/nfs41sys_driver.c
  519. +++ b/sys/nfs41sys_driver.c
  520. @@ -1358,8 +1358,8 @@ VOID fcbopen_main(PVOID ctx)
  521.              if (status) goto out;
  522.  
  523.              entry->u.QueryFile.InfoClass = FileBasicInformation;
  524. -            entry->buf = &binfo;
  525. -            entry->buf_len = sizeof(binfo);
  526. +            entry->u.QueryFile.buf = &binfo;
  527. +            entry->u.QueryFile.buf_len = sizeof(binfo);
  528.  
  529.              status = nfs41_UpcallWaitForReply(entry, UPCALL_TIMEOUT_DEFAULT);
  530.              if (status) goto out;
  531. diff --git a/sys/nfs41sys_driver.h b/sys/nfs41sys_driver.h
  532. index 3f50257..ff9b82e 100644
  533. --- a/sys/nfs41sys_driver.h
  534. +++ b/sys/nfs41sys_driver.h
  535. @@ -186,8 +186,6 @@ typedef struct _updowncall_entry {
  536.      HANDLE open_state;
  537.      HANDLE session;
  538.      PUNICODE_STRING filename;
  539. -    PVOID buf;
  540. -    ULONG buf_len;
  541.      ULONGLONG ChangeTime;
  542.      union {
  543.          struct {
  544. @@ -211,6 +209,8 @@ typedef struct _updowncall_entry {
  545.          struct {
  546.              PMDL MdlAddress;
  547.              ULONGLONG offset;
  548. +            PVOID buf;
  549. +            ULONG buf_len;
  550.              PRX_CONTEXT rxcontext;
  551.          } ReadWrite;
  552.          struct {
  553. @@ -263,12 +263,18 @@ typedef struct _updowncall_entry {
  554.              BOOLEAN initial_query;
  555.              PMDL mdl;
  556.              PVOID mdl_buf;
  557. +            PVOID buf;
  558. +            ULONG buf_len;
  559.          } QueryFile;
  560.          struct {
  561.              FILE_INFORMATION_CLASS InfoClass;
  562. +            PVOID buf;
  563. +            ULONG buf_len;
  564.          } SetFile;
  565.          struct {
  566.              DWORD mode;
  567. +            PVOID buf;
  568. +            ULONG buf_len;
  569.          } SetEa;
  570.          struct {
  571.              PVOID EaList;
  572. @@ -277,15 +283,21 @@ typedef struct _updowncall_entry {
  573.              ULONG EaIndex;
  574.              BOOLEAN ReturnSingleEntry;
  575.              BOOLEAN RestartScan;
  576. +            PVOID buf;
  577. +            ULONG buf_len;
  578.          } QueryEa;
  579.          struct {
  580.              PUNICODE_STRING target;
  581.          } Symlink;
  582.          struct {
  583.              FS_INFORMATION_CLASS query;
  584. +            PVOID buf;
  585. +            ULONG buf_len;
  586.          } Volume;
  587.          struct {
  588.              SECURITY_INFORMATION query;
  589. +            PVOID buf;
  590. +            ULONG buf_len;
  591.          } Acl;
  592.          struct {
  593.              FILE_ALLOCATED_RANGE_BUFFER inrange;
  594. diff --git a/sys/nfs41sys_ea.c b/sys/nfs41sys_ea.c
  595. index 53b0790..c479555 100644
  596. --- a/sys/nfs41sys_ea.c
  597. +++ b/sys/nfs41sys_ea.c
  598. @@ -83,7 +83,7 @@ NTSTATUS marshal_nfs41_easet(
  599.      else tmp += *len;
  600.  
  601.      header_len = *len + length_as_utf8(entry->filename) +
  602. -        sizeof(ULONG) + entry->buf_len  + sizeof(DWORD);
  603. +        sizeof(ULONG) + entry->u.SetEa.buf_len  + sizeof(DWORD);
  604.      if (header_len > buf_len) {
  605.          status = STATUS_INSUFFICIENT_RESOURCES;
  606.          goto out;
  607. @@ -93,15 +93,15 @@ NTSTATUS marshal_nfs41_easet(
  608.      if (status) goto out;
  609.      RtlCopyMemory(tmp, &entry->u.SetEa.mode, sizeof(DWORD));
  610.      tmp += sizeof(DWORD);
  611. -    RtlCopyMemory(tmp, &entry->buf_len, sizeof(ULONG));
  612. +    RtlCopyMemory(tmp, &entry->u.SetEa.buf_len, sizeof(ULONG));
  613.      tmp += sizeof(ULONG);
  614. -    RtlCopyMemory(tmp, entry->buf, entry->buf_len);
  615. +    RtlCopyMemory(tmp, entry->u.SetEa.buf, entry->u.SetEa.buf_len);
  616.      *len = header_len;
  617.  
  618.  #ifdef DEBUG_MARSHAL_DETAIL
  619.      DbgP("marshal_nfs41_easet: filename='%wZ', buflen=%d mode=0x%x\n",
  620.          entry->filename,
  621. -        (int)entry->buf_len,
  622. +        (int)entry->u.SetEa.buf_len,
  623.          (int)entry->u.SetEa.mode);
  624.  #endif
  625.  out:
  626. @@ -138,7 +138,7 @@ NTSTATUS marshal_nfs41_eaget(
  627.      tmp += sizeof(BOOLEAN);
  628.      RtlCopyMemory(tmp, &entry->u.QueryEa.ReturnSingleEntry, sizeof(BOOLEAN));
  629.      tmp += sizeof(BOOLEAN);
  630. -    RtlCopyMemory(tmp, &entry->buf_len, sizeof(ULONG));
  631. +    RtlCopyMemory(tmp, &entry->u.QueryEa.buf_len, sizeof(ULONG));
  632.      tmp += sizeof(ULONG);
  633.      RtlCopyMemory(tmp, &entry->u.QueryEa.EaListLength, sizeof(ULONG));
  634.      tmp += sizeof(ULONG);
  635. @@ -163,11 +163,11 @@ void unmarshal_nfs41_eaget(
  636.  {
  637.      RtlCopyMemory(&cur->u.QueryEa.Overflow, *buf, sizeof(ULONG));
  638.      *buf += sizeof(ULONG);
  639. -    RtlCopyMemory(&cur->buf_len, *buf, sizeof(ULONG));
  640. +    RtlCopyMemory(&cur->u.QueryEa.buf_len, *buf, sizeof(ULONG));
  641.      *buf += sizeof(ULONG);
  642.      if (cur->u.QueryEa.Overflow != ERROR_INSUFFICIENT_BUFFER) {
  643. -        RtlCopyMemory(cur->buf, *buf, cur->buf_len);
  644. -        *buf += cur->buf_len;
  645. +        RtlCopyMemory(cur->u.QueryEa.buf, *buf, cur->u.QueryEa.buf_len);
  646. +        *buf += cur->u.QueryEa.buf_len;
  647.      }
  648.  }
  649.  
  650. @@ -375,8 +375,8 @@ NTSTATUS nfs41_SetEaInformation(
  651.              goto out;
  652.          }
  653.      }
  654. -    entry->buf = eainfo;
  655. -    entry->buf_len = buflen;
  656. +    entry->u.SetEa.buf = eainfo;
  657. +    entry->u.SetEa.buf_len = buflen;
  658.  
  659.      status = nfs41_UpcallWaitForReply(entry, pVNetRootContext->timeout);
  660.      if (status) {
  661. @@ -642,8 +642,8 @@ NTSTATUS nfs41_QueryEaInformation(
  662.          pNetRootContext->nfs41d_version, SrvOpen->pAlreadyPrefixedName, &entry);
  663.      if (status) goto out;
  664.  
  665. -    entry->buf_len = buflen;
  666. -    entry->buf = RxContext->Info.Buffer;
  667. +    entry->u.QueryEa.buf_len = buflen;
  668. +    entry->u.QueryEa.buf = RxContext->Info.Buffer;
  669.      entry->u.QueryEa.EaList = query;
  670.      entry->u.QueryEa.EaListLength = query == NULL ? 0 :
  671.          RxContext->QueryEa.UserEaListLength;
  672. @@ -671,7 +671,7 @@ NTSTATUS nfs41_QueryEaInformation(
  673.              RxContext->IoStatusBlock.Status = STATUS_SUCCESS;
  674.              break;
  675.          }
  676. -        RxContext->InformationToReturn = entry->buf_len;
  677. +        RxContext->InformationToReturn = entry->u.QueryEa.buf_len;
  678.  #ifdef ENABLE_TIMINGS
  679.          InterlockedIncrement(&getexattr.sops);
  680.          InterlockedAdd64(&getexattr.size, entry->u.QueryEa.buf_len);
  681. diff --git a/sys/nfs41sys_fileinfo.c b/sys/nfs41sys_fileinfo.c
  682. index a2cc9c1..651405a 100644
  683. --- a/sys/nfs41sys_fileinfo.c
  684. +++ b/sys/nfs41sys_fileinfo.c
  685. @@ -90,7 +90,7 @@ NTSTATUS marshal_nfs41_filequery(
  686.      }
  687.      RtlCopyMemory(tmp, &entry->u.QueryFile.InfoClass, sizeof(ULONG));
  688.      tmp += sizeof(ULONG);
  689. -    RtlCopyMemory(tmp, &entry->buf_len, sizeof(ULONG));
  690. +    RtlCopyMemory(tmp, &entry->u.QueryFile.buf_len, sizeof(ULONG));
  691.      /* tmp += sizeof(ULONG); */
  692.      *len = header_len;
  693.  
  694. @@ -116,7 +116,7 @@ NTSTATUS marshal_nfs41_fileset(
  695.      else tmp += *len;
  696.  
  697.      header_len = *len + length_as_utf8(entry->filename) +
  698. -        2 * sizeof(ULONG) + entry->buf_len;
  699. +        2 * sizeof(ULONG) + entry->u.SetFile.buf_len;
  700.      if (header_len > buf_len) {
  701.          status = STATUS_INSUFFICIENT_RESOURCES;
  702.          goto out;
  703. @@ -125,9 +125,9 @@ NTSTATUS marshal_nfs41_fileset(
  704.      if (status) goto out;
  705.      RtlCopyMemory(tmp, &entry->u.SetFile.InfoClass, sizeof(ULONG));
  706.      tmp += sizeof(ULONG);
  707. -    RtlCopyMemory(tmp, &entry->buf_len, sizeof(ULONG));
  708. +    RtlCopyMemory(tmp, &entry->u.SetFile.buf_len, sizeof(ULONG));
  709.      tmp += sizeof(ULONG);
  710. -    RtlCopyMemory(tmp, entry->buf, entry->buf_len);
  711. +    RtlCopyMemory(tmp, entry->u.SetFile.buf, entry->u.SetFile.buf_len);
  712.      *len = header_len;
  713.  
  714.  #ifdef DEBUG_MARSHAL_DETAIL
  715. @@ -154,7 +154,8 @@ void unmarshal_nfs41_getattr(
  716.      nfs41_updowncall_entry *cur,
  717.      const unsigned char *restrict *restrict buf)
  718.  {
  719. -    unmarshal_nfs41_attrget(cur, cur->buf, &cur->buf_len, buf, FALSE);
  720. +    unmarshal_nfs41_attrget(cur,
  721. +        cur->u.QueryFile.buf, &cur->u.QueryFile.buf_len, buf, FALSE);
  722.      RtlCopyMemory(&cur->ChangeTime, *buf, sizeof(cur->ChangeTime));
  723.      *buf += sizeof(cur->ChangeTime);
  724.  #ifdef DEBUG_MARSHAL_DETAIL
  725. @@ -396,8 +397,8 @@ NTSTATUS nfs41_QueryFileInformation(
  726.      }
  727.  
  728.      entry->u.QueryFile.InfoClass = InfoClass;
  729. -    entry->buf = RxContext->Info.Buffer;
  730. -    entry->buf_len = RxContext->Info.LengthRemaining;
  731. +    entry->u.QueryFile.buf = RxContext->Info.Buffer;
  732. +    entry->u.QueryFile.buf_len = RxContext->Info.LengthRemaining;
  733.  
  734.      status = nfs41_UpcallWaitForReply(entry, pVNetRootContext->timeout);
  735.      if (status) {
  736. @@ -407,7 +408,7 @@ NTSTATUS nfs41_QueryFileInformation(
  737.      }
  738.  
  739.      if (entry->status == STATUS_BUFFER_TOO_SMALL) {
  740. -        RxContext->InformationToReturn = entry->buf_len;
  741. +        RxContext->InformationToReturn = entry->u.QueryFile.buf_len;
  742.          print_error("entry->status == STATUS_BUFFER_TOO_SMALL\n");
  743.          status = STATUS_BUFFER_TOO_SMALL;
  744.      } else if (entry->status == STATUS_SUCCESS) {
  745. @@ -419,7 +420,7 @@ NTSTATUS nfs41_QueryFileInformation(
  746.          InterlockedIncrement(&getattr.sops);
  747.          InterlockedAdd64(&getattr.size, entry->u.QueryFile.buf_len);
  748.  #endif
  749. -        RxContext->Info.LengthRemaining -= entry->buf_len;
  750. +        RxContext->Info.LengthRemaining -= entry->u.QueryFile.buf_len;
  751.          status = STATUS_SUCCESS;
  752.  
  753.          switch (InfoClass) {
  754. @@ -768,14 +769,14 @@ NTSTATUS nfs41_SetFileInformation(
  755.       * thus we changed the local variable infoclass */
  756.      if (RxContext->Info.FileInformationClass == FileDispositionInformation &&
  757.              InfoClass == FileRenameInformation) {
  758. -        entry->buf = &rinfo;
  759. -        entry->buf_len = sizeof(rinfo);
  760. +        entry->u.SetFile.buf = &rinfo;
  761. +        entry->u.SetFile.buf_len = sizeof(rinfo);
  762.      }
  763.      else
  764.  #endif /* FORCE_POSIX_SEMANTICS_DELETE */
  765.      {
  766. -        entry->buf = RxContext->Info.Buffer;
  767. -        entry->buf_len = RxContext->Info.Length;
  768. +        entry->u.SetFile.buf = RxContext->Info.Buffer;
  769. +        entry->u.SetFile.buf_len = RxContext->Info.Length;
  770.      }
  771.  #ifdef ENABLE_TIMINGS
  772.      InterlockedIncrement(&setattr.sops);
  773. diff --git a/sys/nfs41sys_readwrite.c b/sys/nfs41sys_readwrite.c
  774. index f0c8beb..35aeaf4 100644
  775. --- a/sys/nfs41sys_readwrite.c
  776. +++ b/sys/nfs41sys_readwrite.c
  777. @@ -97,15 +97,16 @@ NTSTATUS marshal_nfs41_rw(
  778.      if (status) goto out;
  779.      else tmp += *len;
  780.  
  781. -    header_len = *len + sizeof(entry->buf_len) +
  782. +    header_len = *len + sizeof(entry->u.ReadWrite.buf_len) +
  783.          sizeof(entry->u.ReadWrite.offset) + sizeof(HANDLE);
  784.      if (header_len > buf_len) {
  785.          status = STATUS_INSUFFICIENT_RESOURCES;
  786.          goto out;
  787.      }
  788.  
  789. -    RtlCopyMemory(tmp, &entry->buf_len, sizeof(entry->buf_len));
  790. -    tmp += sizeof(entry->buf_len);
  791. +    RtlCopyMemory(tmp, &entry->u.ReadWrite.buf_len,
  792. +        sizeof(entry->u.ReadWrite.buf_len));
  793. +    tmp += sizeof(entry->u.ReadWrite.buf_len);
  794.      RtlCopyMemory(tmp, &entry->u.ReadWrite.offset,
  795.          sizeof(entry->u.ReadWrite.offset));
  796.      tmp += sizeof(entry->u.ReadWrite.offset);
  797. @@ -128,7 +129,7 @@ NTSTATUS marshal_nfs41_rw(
  798.          prio_writeflags |= MdlMappingNoWrite;
  799.  
  800.      status = nfs41_MapLockedPagesInNfsDaemonAddressSpace(
  801. -        &entry->buf,
  802. +        &entry->u.ReadWrite.buf,
  803.          entry->u.ReadWrite.MdlAddress,
  804.          MmCached,
  805.          (NormalPagePriority|prio_writeflags));
  806. @@ -140,14 +141,14 @@ NTSTATUS marshal_nfs41_rw(
  807.          goto out;
  808.      }
  809.  
  810. -    RtlCopyMemory(tmp, &entry->buf, sizeof(HANDLE));
  811. +    RtlCopyMemory(tmp, &entry->u.ReadWrite.buf, sizeof(HANDLE));
  812.      *len = header_len;
  813.  
  814.  #ifdef DEBUG_MARSHAL_DETAIL_RW
  815.      DbgP("marshal_nfs41_rw: len=%lu offset=%llu "
  816.          "MdlAddress=0x%p Userspace=0x%p\n",
  817. -        entry->buf_len, entry->u.ReadWrite.offset,
  818. -        entry->u.ReadWrite.MdlAddress, entry->buf);
  819. +        entry->u.ReadWrite.buf_len, entry->u.ReadWrite.offset,
  820. +        entry->u.ReadWrite.MdlAddress, entry->u.ReadWrite.buf);
  821.  #endif
  822.  out:
  823.      return status;
  824. @@ -159,13 +160,14 @@ NTSTATUS unmarshal_nfs41_rw(
  825.  {
  826.      NTSTATUS status = STATUS_SUCCESS;
  827.  
  828. -    RtlCopyMemory(&cur->buf_len, *buf, sizeof(cur->buf_len));
  829. -    *buf += sizeof(cur->buf_len);
  830. +    RtlCopyMemory(&cur->u.ReadWrite.buf_len, *buf,
  831. +        sizeof(cur->u.ReadWrite.buf_len));
  832. +    *buf += sizeof(cur->u.ReadWrite.buf_len);
  833.      RtlCopyMemory(&cur->ChangeTime, *buf, sizeof(cur->ChangeTime));
  834.      *buf += sizeof(cur->ChangeTime);
  835.  #ifdef DEBUG_MARSHAL_DETAIL_RW
  836.      DbgP("unmarshal_nfs41_rw: returned len %lu ChangeTime %llu\n",
  837. -        cur->buf_len, cur->ChangeTime);
  838. +        cur->u.ReadWrite.buf_len, cur->ChangeTime);
  839.  #endif
  840.  #if 1
  841.      /*
  842. @@ -174,9 +176,10 @@ NTSTATUS unmarshal_nfs41_rw(
  843.       * MmMapLockedPagesSpecifyCache() as the MDL passed to us
  844.       * is already locked.
  845.       */
  846. -    (void)nfs41_UnmapLockedKernelPagesInNfsDaemonAddressSpace(cur->buf,
  847. +    (void)nfs41_UnmapLockedKernelPagesInNfsDaemonAddressSpace(
  848. +        cur->u.ReadWrite.buf,
  849.          cur->u.ReadWrite.MdlAddress);
  850. -    cur->buf = NULL;
  851. +    cur->u.ReadWrite.buf = NULL;
  852.  #endif
  853.      return status;
  854.  }
  855. @@ -248,7 +251,7 @@ NTSTATUS nfs41_Read(
  856.      if (status) goto out;
  857.  
  858.      entry->u.ReadWrite.MdlAddress = LowIoContext->ParamsFor.ReadWrite.Buffer;
  859. -    entry->buf_len = LowIoContext->ParamsFor.ReadWrite.ByteCount;
  860. +    entry->u.ReadWrite.buf_len = LowIoContext->ParamsFor.ReadWrite.ByteCount;
  861.      entry->u.ReadWrite.offset = LowIoContext->ParamsFor.ReadWrite.ByteOffset;
  862.      if (FlagOn(RxContext->CurrentIrpSp->FileObject->Flags,
  863.              FO_SYNCHRONOUS_IO) == FALSE) {
  864. @@ -258,7 +261,7 @@ NTSTATUS nfs41_Read(
  865.  
  866.      /* Add extra timeout depending on buffer size */
  867.      io_delay = pVNetRootContext->timeout +
  868. -        EXTRA_TIMEOUT_PER_BYTE(entry->buf_len);
  869. +        EXTRA_TIMEOUT_PER_BYTE(entry->u.ReadWrite.buf_len);
  870.      status = nfs41_UpcallWaitForReply(entry, io_delay);
  871.      if (status) {
  872.          /* Timeout - |nfs41_downcall()| will free |entry|+contents */
  873. @@ -281,7 +284,7 @@ NTSTATUS nfs41_Read(
  874.          InterlockedAdd64(&read.size, entry->u.ReadWrite.len);
  875.  #endif
  876.          status = RxContext->CurrentIrp->IoStatus.Status = STATUS_SUCCESS;
  877. -        RxContext->IoStatusBlock.Information = entry->buf_len;
  878. +        RxContext->IoStatusBlock.Information = entry->u.ReadWrite.buf_len;
  879.  
  880.          if ((!BooleanFlagOn(LowIoContext->ParamsFor.ReadWrite.Flags,
  881.                  LOWIO_READWRITEFLAG_PAGING_IO) &&
  882. @@ -374,7 +377,7 @@ NTSTATUS nfs41_Write(
  883.      if (status) goto out;
  884.  
  885.      entry->u.ReadWrite.MdlAddress = LowIoContext->ParamsFor.ReadWrite.Buffer;
  886. -    entry->buf_len = LowIoContext->ParamsFor.ReadWrite.ByteCount;
  887. +    entry->u.ReadWrite.buf_len = LowIoContext->ParamsFor.ReadWrite.ByteCount;
  888.      entry->u.ReadWrite.offset = LowIoContext->ParamsFor.ReadWrite.ByteOffset;
  889.  
  890.      if (FlagOn(RxContext->CurrentIrpSp->FileObject->Flags,
  891. @@ -385,7 +388,7 @@ NTSTATUS nfs41_Write(
  892.  
  893.      /* Add extra timeout depending on buffer size */
  894.      io_delay = pVNetRootContext->timeout +
  895. -        EXTRA_TIMEOUT_PER_BYTE(entry->buf_len);
  896. +        EXTRA_TIMEOUT_PER_BYTE(entry->u.ReadWrite.buf_len);
  897.      status = nfs41_UpcallWaitForReply(entry, io_delay);
  898.      if (status) {
  899.          /* Timeout - |nfs41_downcall()| will free |entry|+contents */
  900. @@ -409,7 +412,7 @@ NTSTATUS nfs41_Write(
  901.          InterlockedAdd64(&write.size, entry->u.ReadWrite.len);
  902.  #endif
  903.          status = RxContext->CurrentIrp->IoStatus.Status = STATUS_SUCCESS;
  904. -        RxContext->IoStatusBlock.Information = entry->buf_len;
  905. +        RxContext->IoStatusBlock.Information = entry->u.ReadWrite.buf_len;
  906.          nfs41_fcb->changeattr = entry->ChangeTime;
  907.  
  908.          //re-enable write buffering
  909. diff --git a/sys/nfs41sys_updowncall.c b/sys/nfs41sys_updowncall.c
  910. index 5315ba4..64b0432 100644
  911. --- a/sys/nfs41sys_updowncall.c
  912. +++ b/sys/nfs41sys_updowncall.c
  913. @@ -426,7 +426,7 @@ NTSTATUS nfs41_UpcallCreate(
  914.          switch(entry->opcode) {
  915.              case NFS41_SYSOP_WRITE:
  916.              case NFS41_SYSOP_READ:
  917. -                entry->buf = NULL;
  918. +                entry->u.ReadWrite.buf = NULL;
  919.                  break;
  920.              case NFS41_SYSOP_DIR_QUERY:
  921.                  entry->u.QueryFile.mdl_buf = NULL;
  922. @@ -680,11 +680,11 @@ NTSTATUS nfs41_downcall(
  923.          switch(cur->opcode) {
  924.          case NFS41_SYSOP_WRITE:
  925.          case NFS41_SYSOP_READ:
  926. -            if (cur->buf) {
  927. +            if (cur->u.ReadWrite.buf) {
  928.                  (void)nfs41_UnmapLockedKernelPagesInNfsDaemonAddressSpace(
  929. -                    cur->buf,
  930. +                    cur->u.ReadWrite.buf,
  931.                      cur->u.ReadWrite.MdlAddress);
  932. -                cur->buf = NULL;
  933. +                cur->u.ReadWrite.buf = NULL;
  934.              }
  935.              break;
  936.          case NFS41_SYSOP_DIR_QUERY:
  937. @@ -821,7 +821,7 @@ NTSTATUS nfs41_downcall(
  938.                      cur->u.ReadWrite.rxcontext->StoredStatus =
  939.                          STATUS_SUCCESS;
  940.                      cur->u.ReadWrite.rxcontext->InformationToReturn =
  941. -                        cur->buf_len;
  942. +                        cur->u.ReadWrite.buf_len;
  943.                  } else {
  944.                      cur->u.ReadWrite.rxcontext->StoredStatus =
  945.                          map_readwrite_errors(cur->status);
  946. diff --git a/sys/nfs41sys_volinfo.c b/sys/nfs41sys_volinfo.c
  947. index 2caad54..8250775 100644
  948. --- a/sys/nfs41sys_volinfo.c
  949. +++ b/sys/nfs41sys_volinfo.c
  950. @@ -103,7 +103,8 @@ void unmarshal_nfs41_volume(
  951.      nfs41_updowncall_entry *cur,
  952.      const unsigned char *restrict *restrict buf)
  953.  {
  954. -    unmarshal_nfs41_attrget(cur, cur->buf, &cur->buf_len, buf, TRUE);
  955. +    unmarshal_nfs41_attrget(cur,
  956. +        cur->u.Volume.buf, &cur->u.Volume.buf_len, buf, TRUE);
  957.  }
  958.  
  959.  static void print_queryvolume_args(
  960. @@ -201,8 +202,8 @@ NTSTATUS nfs41_QueryVolumeInformation(
  961.      if (status) goto out;
  962.  
  963.      entry->u.Volume.query = InfoClass;
  964. -    entry->buf = RxContext->Info.Buffer;
  965. -    entry->buf_len = RxContext->Info.LengthRemaining;
  966. +    entry->u.Volume.buf = RxContext->Info.Buffer;
  967. +    entry->u.Volume.buf_len = RxContext->Info.LengthRemaining;
  968.  
  969.      status = nfs41_UpcallWaitForReply(entry, pVNetRootContext->timeout);
  970.      if (status) {
  971. @@ -223,7 +224,7 @@ NTSTATUS nfs41_QueryVolumeInformation(
  972.          InterlockedIncrement(&volume.sops);
  973.          InterlockedAdd64(&volume.size, entry->u.Volume.buf_len);
  974.  #endif
  975. -        RxContext->Info.LengthRemaining -= entry->buf_len;
  976. +        RxContext->Info.LengthRemaining -= entry->u.Volume.buf_len;
  977.          status = STATUS_SUCCESS;
  978.      } else {
  979.          status = map_volume_errors(entry->status);
  980. --
  981. 2.51.0
  982.  
  983. From 8615c8ea8631bfbcff1cc38ad8d9a2e01269aeec Mon Sep 17 00:00:00 2001
  984. From: Roland Mainz <roland.mainz@nrubsig.org>
  985. Date: Wed, 22 Oct 2025 17:23:20 +0200
  986. Subject: [PATCH 6/9] sys: |marshal_nfs41_*()| functions should verify how many
  987.  bytes they write into upcall buffer
  988.  
  989. |marshal_nfs41_*()| functions should verify how many bytes they
  990. write into the upcall buffer.
  991.  
  992. Signed-off-by: Cedric Blancher <cedric.blancher@gmail.com>
  993. ---
  994. sys/nfs41sys_acl.c       | 30 +++++++++++++++++++++------
  995.  sys/nfs41sys_dir.c       | 15 +++++++++++---
  996.  sys/nfs41sys_driver.c    | 28 ++++++++++++++++++++-----
  997.  sys/nfs41sys_ea.c        | 33 ++++++++++++++++++++++-------
  998.  sys/nfs41sys_fileinfo.c  | 31 ++++++++++++++++++++-------
  999.  sys/nfs41sys_fsctl.c     | 45 +++++++++++++++++++++++++++++++---------
  1000.  sys/nfs41sys_lock.c      | 31 ++++++++++++++++++++-------
  1001.  sys/nfs41sys_mount.c     | 17 ++++++++++-----
  1002.  sys/nfs41sys_openclose.c | 32 +++++++++++++++++++++-------
  1003.  sys/nfs41sys_readwrite.c | 15 +++++++++++---
  1004.  sys/nfs41sys_symlink.c   | 14 ++++++++++---
  1005.  sys/nfs41sys_volinfo.c   | 15 +++++++++++---
  1006.  12 files changed, 240 insertions(+), 66 deletions(-)
  1007.  
  1008. diff --git a/sys/nfs41sys_acl.c b/sys/nfs41sys_acl.c
  1009. index 1846260..d9647b9 100644
  1010. --- a/sys/nfs41sys_acl.c
  1011. +++ b/sys/nfs41sys_acl.c
  1012. @@ -80,8 +80,9 @@ NTSTATUS marshal_nfs41_getacl(
  1013.      unsigned char *tmp = buf;
  1014.  
  1015.      status = marshal_nfs41_header(entry, tmp, buf_len, len);
  1016. -    if (status) goto out;
  1017. -    else tmp += *len;
  1018. +    if (status)
  1019. +        goto out;
  1020. +    tmp += *len;
  1021.  
  1022.      header_len = *len + sizeof(SECURITY_INFORMATION);
  1023.      if (header_len > buf_len) {
  1024. @@ -90,7 +91,15 @@ NTSTATUS marshal_nfs41_getacl(
  1025.      }
  1026.  
  1027.      RtlCopyMemory(tmp, &entry->u.Acl.query, sizeof(SECURITY_INFORMATION));
  1028. -    *len = header_len;
  1029. +    tmp += sizeof(SECURITY_INFORMATION);
  1030. +
  1031. +    *len = (ULONG)(tmp - buf);
  1032. +    if (*len != header_len) {
  1033. +        DbgP("marshal_nfs41_getacl: *len(=%ld) != header_len(=%ld)\n",
  1034. +            (long)*len, (long)header_len);
  1035. +        status = STATUS_INSUFFICIENT_RESOURCES;
  1036. +        goto out;
  1037. +    }
  1038.  
  1039.  #ifdef DEBUG_MARSHAL_DETAIL
  1040.      DbgP("marshal_nfs41_getacl: class=0x%x\n", (int)entry->u.Acl.query);
  1041. @@ -110,8 +119,9 @@ NTSTATUS marshal_nfs41_setacl(
  1042.      unsigned char *tmp = buf;
  1043.  
  1044.      status = marshal_nfs41_header(entry, tmp, buf_len, len);
  1045. -    if (status) goto out;
  1046. -    else tmp += *len;
  1047. +    if (status)
  1048. +        goto out;
  1049. +    tmp += *len;
  1050.  
  1051.      header_len = *len + sizeof(SECURITY_INFORMATION) +
  1052.          sizeof(ULONG) + entry->u.Acl.buf_len;
  1053. @@ -125,7 +135,15 @@ NTSTATUS marshal_nfs41_setacl(
  1054.      RtlCopyMemory(tmp, &entry->u.Acl.buf_len, sizeof(ULONG));
  1055.      tmp += sizeof(ULONG);
  1056.      RtlCopyMemory(tmp, entry->u.Acl.buf, entry->u.Acl.buf_len);
  1057. -    *len = header_len;
  1058. +    tmp += entry->u.Acl.buf_len;
  1059. +
  1060. +    *len = (ULONG)(tmp - buf);
  1061. +    if (*len != header_len) {
  1062. +        DbgP("marshal_nfs41_setacl: *len(=%ld) != header_len(=%ld)\n",
  1063. +            (long)*len, (long)header_len);
  1064. +        status = STATUS_INSUFFICIENT_RESOURCES;
  1065. +        goto out;
  1066. +    }
  1067.  
  1068.  #ifdef DEBUG_MARSHAL_DETAIL
  1069.      DbgP("marshal_nfs41_setacl: class=0x%x sec_desc_len=%lu\n",
  1070. diff --git a/sys/nfs41sys_dir.c b/sys/nfs41sys_dir.c
  1071. index 64f16c5..608f83a 100644
  1072. --- a/sys/nfs41sys_dir.c
  1073. +++ b/sys/nfs41sys_dir.c
  1074. @@ -79,8 +79,9 @@ NTSTATUS marshal_nfs41_dirquery(
  1075.      unsigned char *tmp = buf;
  1076.  
  1077.      status = marshal_nfs41_header(entry, tmp, buf_len, len);
  1078. -    if (status) goto out;
  1079. -    else tmp += *len;
  1080. +    if (status)
  1081. +        goto out;
  1082. +    tmp += *len;
  1083.  
  1084.      header_len = *len + 2 * sizeof(ULONG) + sizeof(HANDLE) +
  1085.          length_as_utf8(entry->u.QueryFile.filter) + 3 * sizeof(BOOLEAN);
  1086. @@ -116,7 +117,15 @@ NTSTATUS marshal_nfs41_dirquery(
  1087.      }
  1088.  
  1089.      RtlCopyMemory(tmp, &entry->u.QueryFile.mdl_buf, sizeof(HANDLE));
  1090. -    *len = header_len;
  1091. +    tmp += sizeof(HANDLE);
  1092. +
  1093. +    *len = (ULONG)(tmp - buf);
  1094. +    if (*len != header_len) {
  1095. +        DbgP("marshal_nfs41_dirquery: *len(=%ld) != header_len(=%ld)\n",
  1096. +            (long)*len, (long)header_len);
  1097. +        status = STATUS_INSUFFICIENT_RESOURCES;
  1098. +        goto out;
  1099. +    }
  1100.  
  1101.  #ifdef DEBUG_MARSHAL_DETAIL
  1102.      DbgP("marshal_nfs41_dirquery: filter='%wZ' class=%d len=%d "
  1103. diff --git a/sys/nfs41sys_driver.c b/sys/nfs41sys_driver.c
  1104. index 0cff2bd..53ab74a 100644
  1105. --- a/sys/nfs41sys_driver.c
  1106. +++ b/sys/nfs41sys_driver.c
  1107. @@ -239,8 +239,9 @@ NTSTATUS marshal_nfs41_header(
  1108.          status = STATUS_INSUFFICIENT_RESOURCES;
  1109.          goto out;
  1110.      }
  1111. -    else
  1112. -        *len = header_len;
  1113. +
  1114. +    *len = header_len;
  1115. +
  1116.      RtlCopyMemory(tmp, &entry->version, sizeof(entry->version));
  1117.      tmp += sizeof(entry->version);
  1118.      RtlCopyMemory(tmp, &entry->xid, sizeof(entry->xid));
  1119. @@ -252,6 +253,14 @@ NTSTATUS marshal_nfs41_header(
  1120.      RtlCopyMemory(tmp, &entry->open_state, sizeof(HANDLE));
  1121.      tmp += sizeof(HANDLE);
  1122.  
  1123. +    *len = (ULONG)(tmp - buf);
  1124. +    if (*len != header_len) {
  1125. +        DbgP("marshal_nfs41_header: *len(=%ld) != header_len(=%ld)\n",
  1126. +            (long)*len, (long)header_len);
  1127. +        status = STATUS_INSUFFICIENT_RESOURCES;
  1128. +        goto out;
  1129. +    }
  1130. +
  1131.  #ifdef DEBUG_MARSHAL_HEADER
  1132.      DbgP("[upcall hdr] xid=%lld op='%s'%s filename='%wZ' vers=%d "
  1133.          "sess=0x%p open_state=0x%x\n",
  1134. @@ -321,8 +330,9 @@ NTSTATUS marshal_nfs41_set_daemon_debuglevel(
  1135.      unsigned char *tmp = buf;
  1136.  
  1137.      status = marshal_nfs41_header(entry, tmp, buf_len, len);
  1138. -    if (status) goto out;
  1139. -    else tmp += *len;
  1140. +    if (status)
  1141. +        goto out;
  1142. +    tmp += *len;
  1143.  
  1144.      header_len = *len + sizeof(LONG);
  1145.      if (header_len > buf_len) {
  1146. @@ -333,7 +343,15 @@ NTSTATUS marshal_nfs41_set_daemon_debuglevel(
  1147.      RtlCopyMemory(tmp, &entry->u.SetDaemonDebugLevel.debuglevel,
  1148.          sizeof(entry->u.SetDaemonDebugLevel.debuglevel));
  1149.      tmp += sizeof(entry->u.SetDaemonDebugLevel.debuglevel);
  1150. -    *len = header_len;
  1151. +
  1152. +    *len = (ULONG)(tmp - buf);
  1153. +    if (*len != header_len) {
  1154. +        DbgP("marshal_nfs41_set_daemon_debuglevel: "
  1155. +            "*len(=%ld) != header_len(=%ld)\n",
  1156. +            (long)*len, (long)header_len);
  1157. +        status = STATUS_INSUFFICIENT_RESOURCES;
  1158. +        goto out;
  1159. +    }
  1160.  
  1161.  out:
  1162.      return status;
  1163. diff --git a/sys/nfs41sys_ea.c b/sys/nfs41sys_ea.c
  1164. index c479555..1d415da 100644
  1165. --- a/sys/nfs41sys_ea.c
  1166. +++ b/sys/nfs41sys_ea.c
  1167. @@ -79,8 +79,9 @@ NTSTATUS marshal_nfs41_easet(
  1168.      unsigned char *tmp = buf;
  1169.  
  1170.      status = marshal_nfs41_header(entry, tmp, buf_len, len);
  1171. -    if (status) goto out;
  1172. -    else tmp += *len;
  1173. +    if (status)
  1174. +        goto out;
  1175. +    tmp += *len;
  1176.  
  1177.      header_len = *len + length_as_utf8(entry->filename) +
  1178.          sizeof(ULONG) + entry->u.SetEa.buf_len  + sizeof(DWORD);
  1179. @@ -96,7 +97,15 @@ NTSTATUS marshal_nfs41_easet(
  1180.      RtlCopyMemory(tmp, &entry->u.SetEa.buf_len, sizeof(ULONG));
  1181.      tmp += sizeof(ULONG);
  1182.      RtlCopyMemory(tmp, entry->u.SetEa.buf, entry->u.SetEa.buf_len);
  1183. -    *len = header_len;
  1184. +    tmp += entry->u.SetEa.buf_len;
  1185. +
  1186. +    *len = (ULONG)(tmp - buf);
  1187. +    if (*len != header_len) {
  1188. +        DbgP("marshal_nfs41_easet: *len(=%ld) != header_len(=%ld)\n",
  1189. +            (long)*len, (long)header_len);
  1190. +        status = STATUS_INSUFFICIENT_RESOURCES;
  1191. +        goto out;
  1192. +    }
  1193.  
  1194.  #ifdef DEBUG_MARSHAL_DETAIL
  1195.      DbgP("marshal_nfs41_easet: filename='%wZ', buflen=%d mode=0x%x\n",
  1196. @@ -119,8 +128,9 @@ NTSTATUS marshal_nfs41_eaget(
  1197.      unsigned char *tmp = buf;
  1198.  
  1199.      status = marshal_nfs41_header(entry, tmp, buf_len, len);
  1200. -    if (status) goto out;
  1201. -    else tmp += *len;
  1202. +    if (status)
  1203. +        goto out;
  1204. +    tmp += *len;
  1205.  
  1206.      header_len = *len + length_as_utf8(entry->filename) +
  1207.          3 * sizeof(ULONG) + entry->u.QueryEa.EaListLength + 2 * sizeof(BOOLEAN);
  1208. @@ -142,10 +152,19 @@ NTSTATUS marshal_nfs41_eaget(
  1209.      tmp += sizeof(ULONG);
  1210.      RtlCopyMemory(tmp, &entry->u.QueryEa.EaListLength, sizeof(ULONG));
  1211.      tmp += sizeof(ULONG);
  1212. -    if (entry->u.QueryEa.EaList && entry->u.QueryEa.EaListLength)
  1213. +    if (entry->u.QueryEa.EaList && entry->u.QueryEa.EaListLength) {
  1214.          RtlCopyMemory(tmp, entry->u.QueryEa.EaList,
  1215.              entry->u.QueryEa.EaListLength);
  1216. -    *len = header_len;
  1217. +        tmp += entry->u.QueryEa.EaListLength;
  1218. +    }
  1219. +
  1220. +    *len = (ULONG)(tmp - buf);
  1221. +    if (*len != header_len) {
  1222. +        DbgP("marshal_nfs41_eaget: *len(=%ld) != header_len(=%ld)\n",
  1223. +            (long)*len, (long)header_len);
  1224. +        status = STATUS_INSUFFICIENT_RESOURCES;
  1225. +        goto out;
  1226. +    }
  1227.  
  1228.  #ifdef DEBUG_MARSHAL_DETAIL
  1229.      DbgP("marshal_nfs41_eaget: filename='%wZ', index=%d list_len=%d "
  1230. diff --git a/sys/nfs41sys_fileinfo.c b/sys/nfs41sys_fileinfo.c
  1231. index 651405a..8d26824 100644
  1232. --- a/sys/nfs41sys_fileinfo.c
  1233. +++ b/sys/nfs41sys_fileinfo.c
  1234. @@ -80,8 +80,9 @@ NTSTATUS marshal_nfs41_filequery(
  1235.      unsigned char *tmp = buf;
  1236.  
  1237.      status = marshal_nfs41_header(entry, tmp, buf_len, len);
  1238. -    if (status) goto out;
  1239. -    else tmp += *len;
  1240. +    if (status)
  1241. +        goto out;
  1242. +    tmp += *len;
  1243.  
  1244.      header_len = *len + 2 * sizeof(ULONG);
  1245.      if (header_len > buf_len) {
  1246. @@ -91,8 +92,15 @@ NTSTATUS marshal_nfs41_filequery(
  1247.      RtlCopyMemory(tmp, &entry->u.QueryFile.InfoClass, sizeof(ULONG));
  1248.      tmp += sizeof(ULONG);
  1249.      RtlCopyMemory(tmp, &entry->u.QueryFile.buf_len, sizeof(ULONG));
  1250. -    /* tmp += sizeof(ULONG); */
  1251. -    *len = header_len;
  1252. +    tmp += sizeof(ULONG);
  1253. +
  1254. +    *len = (ULONG)(tmp - buf);
  1255. +    if (*len != header_len) {
  1256. +        DbgP("marshal_nfs41_filequery: *len(=%ld) != header_len(=%ld)\n",
  1257. +            (long)*len, (long)header_len);
  1258. +        status = STATUS_INSUFFICIENT_RESOURCES;
  1259. +        goto out;
  1260. +    }
  1261.  
  1262.  #ifdef DEBUG_MARSHAL_DETAIL
  1263.      DbgP("marshal_nfs41_filequery: class=%d\n", entry->u.QueryFile.InfoClass);
  1264. @@ -112,8 +120,9 @@ NTSTATUS marshal_nfs41_fileset(
  1265.      unsigned char *tmp = buf;
  1266.  
  1267.      status = marshal_nfs41_header(entry, tmp, buf_len, len);
  1268. -    if (status) goto out;
  1269. -    else tmp += *len;
  1270. +    if (status)
  1271. +        goto out;
  1272. +    tmp += *len;
  1273.  
  1274.      header_len = *len + length_as_utf8(entry->filename) +
  1275.          2 * sizeof(ULONG) + entry->u.SetFile.buf_len;
  1276. @@ -128,7 +137,15 @@ NTSTATUS marshal_nfs41_fileset(
  1277.      RtlCopyMemory(tmp, &entry->u.SetFile.buf_len, sizeof(ULONG));
  1278.      tmp += sizeof(ULONG);
  1279.      RtlCopyMemory(tmp, entry->u.SetFile.buf, entry->u.SetFile.buf_len);
  1280. -    *len = header_len;
  1281. +    tmp += entry->u.SetFile.buf_len;
  1282. +
  1283. +    *len = (ULONG)(tmp - buf);
  1284. +    if (*len != header_len) {
  1285. +        DbgP("marshal_nfs41_fileset: *len(=%ld) != header_len(=%ld)\n",
  1286. +            (long)*len, (long)header_len);
  1287. +        status = STATUS_INSUFFICIENT_RESOURCES;
  1288. +        goto out;
  1289. +    }
  1290.  
  1291.  #ifdef DEBUG_MARSHAL_DETAIL
  1292.      DbgP("marshal_nfs41_fileset: filename='%wZ' class=%d\n",
  1293. diff --git a/sys/nfs41sys_fsctl.c b/sys/nfs41sys_fsctl.c
  1294. index de9eb2d..adc322e 100644
  1295. --- a/sys/nfs41sys_fsctl.c
  1296. +++ b/sys/nfs41sys_fsctl.c
  1297. @@ -259,8 +259,9 @@ NTSTATUS marshal_nfs41_queryallocatedranges(
  1298.      unsigned char *tmp = buf;
  1299.  
  1300.      status = marshal_nfs41_header(entry, tmp, buf_len, len);
  1301. -    if (status) goto out;
  1302. -    else tmp += *len;
  1303. +    if (status)
  1304. +        goto out;
  1305. +    tmp += *len;
  1306.  
  1307.      header_len = *len + sizeof(FILE_ALLOCATED_RANGE_BUFFER) +
  1308.          sizeof(ULONG) +
  1309. @@ -292,8 +293,17 @@ NTSTATUS marshal_nfs41_queryallocatedranges(
  1310.          }
  1311.      }
  1312.      RtlCopyMemory(tmp, &entry->u.QueryAllocatedRanges.Buffer,
  1313. -        sizeof(HANDLE));
  1314. -    *len = header_len;
  1315. +        sizeof(entry->u.QueryAllocatedRanges.Buffer));
  1316. +    tmp += sizeof(sizeof(entry->u.QueryAllocatedRanges.Buffer));
  1317. +
  1318. +    *len = (ULONG)(tmp - buf);
  1319. +    if (*len != header_len) {
  1320. +        DbgP("marshal_nfs41_queryallocatedranges: "
  1321. +            "*len(=%ld) != header_len(=%ld)\n",
  1322. +            (long)*len, (long)header_len);
  1323. +        status = STATUS_INSUFFICIENT_RESOURCES;
  1324. +        goto out;
  1325. +    }
  1326.  
  1327.      DbgP("marshal_nfs41_queryallocatedranges: name='%wZ' "
  1328.          "buffersize=0x%ld, buffer=0x%p\n",
  1329. @@ -534,8 +544,9 @@ NTSTATUS marshal_nfs41_setzerodata(
  1330.      unsigned char *tmp = buf;
  1331.  
  1332.      status = marshal_nfs41_header(entry, tmp, buf_len, len);
  1333. -    if (status) goto out;
  1334. -    else tmp += *len;
  1335. +    if (status)
  1336. +        goto out;
  1337. +    tmp += *len;
  1338.  
  1339.      header_len = *len + sizeof(FILE_ZERO_DATA_INFORMATION);
  1340.      if (header_len > buf_len) {
  1341. @@ -547,7 +558,13 @@ NTSTATUS marshal_nfs41_setzerodata(
  1342.          sizeof(entry->u.SetZeroData.setzerodata));
  1343.      tmp += sizeof(entry->u.SetZeroData.setzerodata);
  1344.  
  1345. -    *len = header_len;
  1346. +    *len = (ULONG)(tmp - buf);
  1347. +    if (*len != header_len) {
  1348. +        DbgP("marshal_nfs41_setzerodata: *len(=%ld) != header_len(=%ld)\n",
  1349. +            (long)*len, (long)header_len);
  1350. +        status = STATUS_INSUFFICIENT_RESOURCES;
  1351. +        goto out;
  1352. +    }
  1353.  
  1354.      DbgP("marshal_nfs41_setzerodata: name='%wZ'\n",
  1355.           entry->filename);
  1356. @@ -842,8 +859,9 @@ NTSTATUS marshal_nfs41_duplicatedata(
  1357.      unsigned char *tmp = buf;
  1358.  
  1359.      status = marshal_nfs41_header(entry, tmp, buf_len, len);
  1360. -    if (status) goto out;
  1361. -    else tmp += *len;
  1362. +    if (status)
  1363. +        goto out;
  1364. +    tmp += *len;
  1365.  
  1366.      header_len = *len +
  1367.          sizeof(void *) +
  1368. @@ -865,7 +883,14 @@ NTSTATUS marshal_nfs41_duplicatedata(
  1369.      RtlCopyMemory(tmp, &entry->u.DuplicateData.bytecount,
  1370.          sizeof(entry->u.DuplicateData.bytecount));
  1371.      tmp += sizeof(entry->u.DuplicateData.bytecount);
  1372. -    *len = header_len;
  1373. +
  1374. +    *len = (ULONG)(tmp - buf);
  1375. +    if (*len != header_len) {
  1376. +        DbgP("marshal_nfs41_duplicatedata: *len(=%ld) != header_len(=%ld)\n",
  1377. +            (long)*len, (long)header_len);
  1378. +        status = STATUS_INSUFFICIENT_RESOURCES;
  1379. +        goto out;
  1380. +    }
  1381.  
  1382.      DbgP("marshal_nfs41_duplicatedata: name='%wZ'\n",
  1383.           entry->filename);
  1384. diff --git a/sys/nfs41sys_lock.c b/sys/nfs41sys_lock.c
  1385. index b73821d..31ed0ec 100644
  1386. --- a/sys/nfs41sys_lock.c
  1387. +++ b/sys/nfs41sys_lock.c
  1388. @@ -81,8 +81,9 @@ NTSTATUS marshal_nfs41_lock(
  1389.      unsigned char *tmp = buf;
  1390.  
  1391.      status = marshal_nfs41_header(entry, tmp, buf_len, len);
  1392. -    if (status) goto out;
  1393. -    else tmp += *len;
  1394. +    if (status)
  1395. +        goto out;
  1396. +    tmp += *len;
  1397.  
  1398.      header_len = *len + 2 * sizeof(LONGLONG) + 2 * sizeof(BOOLEAN);
  1399.      if (header_len > buf_len) {
  1400. @@ -96,7 +97,15 @@ NTSTATUS marshal_nfs41_lock(
  1401.      RtlCopyMemory(tmp, &entry->u.Lock.exclusive, sizeof(BOOLEAN));
  1402.      tmp += sizeof(BOOLEAN);
  1403.      RtlCopyMemory(tmp, &entry->u.Lock.blocking, sizeof(BOOLEAN));
  1404. -    *len = header_len;
  1405. +    tmp += sizeof(BOOLEAN);
  1406. +
  1407. +    *len = (ULONG)(tmp - buf);
  1408. +    if (*len != header_len) {
  1409. +        DbgP("marshal_nfs41_lock: *len(=%ld) != header_len(=%ld)\n",
  1410. +            (long)*len, (long)header_len);
  1411. +        status = STATUS_INSUFFICIENT_RESOURCES;
  1412. +        goto out;
  1413. +    }
  1414.  
  1415.  #ifdef DEBUG_MARSHAL_DETAIL
  1416.      DbgP("marshal_nfs41_lock: "
  1417. @@ -122,11 +131,12 @@ NTSTATUS marshal_nfs41_unlock(
  1418.      PLOWIO_LOCK_LIST lock;
  1419.  
  1420.      status = marshal_nfs41_header(entry, tmp, buf_len, len);
  1421. -    if (status) goto out;
  1422. -    else tmp += *len;
  1423. +    if (status)
  1424. +        goto out;
  1425. +    tmp += *len;
  1426.  
  1427.      header_len = *len + sizeof(ULONG) +
  1428. -        (size_t)entry->u.Unlock.count * 2 * sizeof(LONGLONG);
  1429. +        ((size_t)entry->u.Unlock.count * 2) * sizeof(LONGLONG);
  1430.      if (header_len > buf_len) {
  1431.          status = STATUS_INSUFFICIENT_RESOURCES;
  1432.          goto out;
  1433. @@ -142,7 +152,14 @@ NTSTATUS marshal_nfs41_unlock(
  1434.          tmp += sizeof(LONGLONG);
  1435.          lock = lock->Next;
  1436.      }
  1437. -    *len = header_len;
  1438. +
  1439. +    *len = (ULONG)(tmp - buf);
  1440. +    if (*len != header_len) {
  1441. +        DbgP("marshal_nfs41_unlock: *len(=%ld) != header_len(=%ld)\n",
  1442. +            (long)*len, (long)header_len);
  1443. +        status = STATUS_INSUFFICIENT_RESOURCES;
  1444. +        goto out;
  1445. +    }
  1446.  
  1447.  #ifdef DEBUG_MARSHAL_DETAIL
  1448.      DbgP("marshal_nfs41_unlock: count=%u\n", entry->u.Unlock.count);
  1449. diff --git a/sys/nfs41sys_mount.c b/sys/nfs41sys_mount.c
  1450. index 062b076..80c4c3b 100644
  1451. --- a/sys/nfs41sys_mount.c
  1452. +++ b/sys/nfs41sys_mount.c
  1453. @@ -104,8 +104,9 @@ NTSTATUS marshal_nfs41_mount(
  1454.      unsigned char *tmp = buf;
  1455.  
  1456.      status = marshal_nfs41_header(entry, tmp, buf_len, len);
  1457. -    if (status) goto out;
  1458. -    else tmp += *len;
  1459. +    if (status)
  1460. +        goto out;
  1461. +    tmp += *len;
  1462.  
  1463.      header_len = *len + length_as_utf8(entry->u.Mount.srv_name) +
  1464.          length_as_utf8(entry->u.Mount.root) + 5 * sizeof(DWORD)
  1465. @@ -130,17 +131,23 @@ NTSTATUS marshal_nfs41_mount(
  1466.      RtlCopyMemory(tmp, &entry->u.Mount.use_nfspubfh, sizeof(DWORD));
  1467.      tmp += sizeof(DWORD);
  1468.      RtlCopyMemory(tmp, &entry->u.Mount.nfsvers, sizeof(DWORD));
  1469. -#ifdef NFS41_DRIVER_HACK_FORCE_FILENAME_CASE_MOUNTOPTIONS
  1470.      tmp += sizeof(DWORD);
  1471. +#ifdef NFS41_DRIVER_HACK_FORCE_FILENAME_CASE_MOUNTOPTIONS
  1472.      RtlCopyMemory(tmp, &entry->u.Mount.force_case_preserving,
  1473.          sizeof(tristate_bool));
  1474.      tmp += sizeof(tristate_bool);
  1475.      RtlCopyMemory(tmp, &entry->u.Mount.force_case_insensitive,
  1476.          sizeof(tristate_bool));
  1477. -    /* tmp += sizeof(tristate_bool); */
  1478. +    tmp += sizeof(tristate_bool);
  1479.  #endif /* NFS41_DRIVER_HACK_FORCE_FILENAME_CASE_MOUNTOPTIONS */
  1480.  
  1481. -    *len = header_len;
  1482. +    *len = (ULONG)(tmp - buf);
  1483. +    if (*len != header_len) {
  1484. +        DbgP("marshal_nfs41_mount: *len(=%ld) != header_len(=%ld)\n",
  1485. +            (long)*len, (long)header_len);
  1486. +        status = STATUS_INSUFFICIENT_RESOURCES;
  1487. +        goto out;
  1488. +    }
  1489.  
  1490.  #ifdef DEBUG_MARSHAL_DETAIL
  1491.      DbgP("marshal_nfs41_mount: server name='%wZ' mount point='%wZ' "
  1492. diff --git a/sys/nfs41sys_openclose.c b/sys/nfs41sys_openclose.c
  1493. index 16090a2..2d9ae41 100644
  1494. --- a/sys/nfs41sys_openclose.c
  1495. +++ b/sys/nfs41sys_openclose.c
  1496. @@ -115,8 +115,9 @@ NTSTATUS marshal_nfs41_open(
  1497.      unsigned char *tmp = buf;
  1498.  
  1499.      status = marshal_nfs41_header(entry, tmp, buf_len, len);
  1500. -    if (status) goto out;
  1501. -    else tmp += *len;
  1502. +    if (status)
  1503. +        goto out;
  1504. +    tmp += *len;
  1505.  
  1506.      header_len = *len + length_as_utf8(entry->filename) +
  1507.          1 * sizeof(tristate_bool) +
  1508. @@ -176,7 +177,15 @@ NTSTATUS marshal_nfs41_open(
  1509.          entry->u.Open.EaBuffer = NULL;
  1510.      }
  1511.      RtlCopyMemory(tmp, &entry->u.Open.EaBuffer, sizeof(HANDLE));
  1512. -    *len = header_len;
  1513. +    tmp += sizeof(HANDLE);
  1514. +
  1515. +    *len = (ULONG)(tmp - buf);
  1516. +    if (*len != header_len) {
  1517. +        DbgP("marshal_nfs41_open: *len(=%ld) != header_len(=%ld)\n",
  1518. +            (long)*len, (long)header_len);
  1519. +        status = STATUS_INSUFFICIENT_RESOURCES;
  1520. +        goto out;
  1521. +    }
  1522.  
  1523.  #ifdef DEBUG_MARSHAL_DETAIL
  1524.      DbgP("marshal_nfs41_open: name='%wZ' mask=0x%x access=0x%x attrs=0x%x "
  1525. @@ -202,8 +211,9 @@ NTSTATUS marshal_nfs41_close(
  1526.      unsigned char *tmp = buf;
  1527.  
  1528.      status = marshal_nfs41_header(entry, tmp, buf_len, len);
  1529. -    if (status) goto out;
  1530. -    else tmp += *len;
  1531. +    if (status)
  1532. +        goto out;
  1533. +        tmp += *len;
  1534.  
  1535.      header_len = *len + sizeof(BOOLEAN) + sizeof(HANDLE);
  1536.      if (entry->u.Close.remove)
  1537. @@ -217,13 +227,21 @@ NTSTATUS marshal_nfs41_close(
  1538.      RtlCopyMemory(tmp, &entry->u.Close.remove, sizeof(BOOLEAN));
  1539.      tmp += sizeof(BOOLEAN);
  1540.      RtlCopyMemory(tmp, &entry->u.Close.srv_open, sizeof(HANDLE));
  1541. +    tmp += sizeof(HANDLE);
  1542.      if (entry->u.Close.remove) {
  1543. -        tmp += sizeof(HANDLE);
  1544.          status = marshall_unicode_as_utf8(&tmp, entry->filename);
  1545.          if (status) goto out;
  1546.          RtlCopyMemory(tmp, &entry->u.Close.renamed, sizeof(BOOLEAN));
  1547. +        tmp += sizeof(BOOLEAN);
  1548. +    }
  1549. +
  1550. +    *len = (ULONG)(tmp - buf);
  1551. +    if (*len != header_len) {
  1552. +        DbgP("marshal_nfs41_close: *len(=%ld) != header_len(=%ld)\n",
  1553. +            (long)*len, (long)header_len);
  1554. +        status = STATUS_INSUFFICIENT_RESOURCES;
  1555. +        goto out;
  1556.      }
  1557. -    *len = header_len;
  1558.  
  1559.  #ifdef DEBUG_MARSHAL_DETAIL
  1560.      DbgP("marshal_nfs41_close: name='%wZ' remove=%d srv_open=0x%p renamed=%d\n",
  1561. diff --git a/sys/nfs41sys_readwrite.c b/sys/nfs41sys_readwrite.c
  1562. index 35aeaf4..a2c023a 100644
  1563. --- a/sys/nfs41sys_readwrite.c
  1564. +++ b/sys/nfs41sys_readwrite.c
  1565. @@ -94,8 +94,9 @@ NTSTATUS marshal_nfs41_rw(
  1566.      unsigned char *tmp = buf;
  1567.  
  1568.      status = marshal_nfs41_header(entry, tmp, buf_len, len);
  1569. -    if (status) goto out;
  1570. -    else tmp += *len;
  1571. +    if (status)
  1572. +        goto out;
  1573. +    tmp += *len;
  1574.  
  1575.      header_len = *len + sizeof(entry->u.ReadWrite.buf_len) +
  1576.          sizeof(entry->u.ReadWrite.offset) + sizeof(HANDLE);
  1577. @@ -142,7 +143,15 @@ NTSTATUS marshal_nfs41_rw(
  1578.      }
  1579.  
  1580.      RtlCopyMemory(tmp, &entry->u.ReadWrite.buf, sizeof(HANDLE));
  1581. -    *len = header_len;
  1582. +    tmp += sizeof(HANDLE);
  1583. +
  1584. +    *len = (ULONG)(tmp - buf);
  1585. +    if (*len != header_len) {
  1586. +        DbgP("marshal_nfs41_rw: *len(=%ld) != header_len(=%ld)\n",
  1587. +            (long)*len, (long)header_len);
  1588. +        status = STATUS_INSUFFICIENT_RESOURCES;
  1589. +        goto out;
  1590. +    }
  1591.  
  1592.  #ifdef DEBUG_MARSHAL_DETAIL_RW
  1593.      DbgP("marshal_nfs41_rw: len=%lu offset=%llu "
  1594. diff --git a/sys/nfs41sys_symlink.c b/sys/nfs41sys_symlink.c
  1595. index 2e85f48..2c81f9a 100644
  1596. --- a/sys/nfs41sys_symlink.c
  1597. +++ b/sys/nfs41sys_symlink.c
  1598. @@ -83,8 +83,9 @@ NTSTATUS marshal_nfs41_symlink(
  1599.      unsigned char *tmp = buf;
  1600.  
  1601.      status = marshal_nfs41_header(entry, tmp, buf_len, len);
  1602. -    if (status) goto out;
  1603. -    else tmp += *len;
  1604. +    if (status)
  1605. +        goto out;
  1606. +    tmp += *len;
  1607.  
  1608.      header_len = *len + length_as_utf8(entry->filename);
  1609.      if (entry->opcode == NFS41_SYSOP_SYMLINK_SET)
  1610. @@ -100,7 +101,14 @@ NTSTATUS marshal_nfs41_symlink(
  1611.          status = marshall_unicode_as_utf8(&tmp, entry->u.Symlink.target);
  1612.          if (status) goto out;
  1613.      }
  1614. -    *len = header_len;
  1615. +
  1616. +    *len = (ULONG)(tmp - buf);
  1617. +    if (*len != header_len) {
  1618. +        DbgP("marshal_nfs41_symlink: *len(=%ld) != header_len(=%ld)\n",
  1619. +            (long)*len, (long)header_len);
  1620. +        status = STATUS_INSUFFICIENT_RESOURCES;
  1621. +        goto out;
  1622. +    }
  1623.  
  1624.  #ifdef DEBUG_MARSHAL_DETAIL
  1625.      if (entry->opcode == NFS41_SYSOP_SYMLINK_SET) {
  1626. diff --git a/sys/nfs41sys_volinfo.c b/sys/nfs41sys_volinfo.c
  1627. index 8250775..017dcb6 100644
  1628. --- a/sys/nfs41sys_volinfo.c
  1629. +++ b/sys/nfs41sys_volinfo.c
  1630. @@ -80,8 +80,9 @@ NTSTATUS marshal_nfs41_volume(
  1631.      unsigned char *tmp = buf;
  1632.  
  1633.      status = marshal_nfs41_header(entry, tmp, buf_len, len);
  1634. -    if (status) goto out;
  1635. -    else tmp += *len;
  1636. +    if (status)
  1637. +        goto out;
  1638. +    tmp += *len;
  1639.  
  1640.      header_len = *len + sizeof(FS_INFORMATION_CLASS);
  1641.      if (header_len > buf_len) {
  1642. @@ -90,7 +91,15 @@ NTSTATUS marshal_nfs41_volume(
  1643.      }
  1644.  
  1645.      RtlCopyMemory(tmp, &entry->u.Volume.query, sizeof(FS_INFORMATION_CLASS));
  1646. -    *len = header_len;
  1647. +    tmp += sizeof(FS_INFORMATION_CLASS);
  1648. +
  1649. +    *len = (ULONG)(tmp - buf);
  1650. +    if (*len != header_len) {
  1651. +        DbgP("marshal_nfs41_volume: *len(=%ld) != header_len(=%ld)\n",
  1652. +            (long)*len, (long)header_len);
  1653. +        status = STATUS_INSUFFICIENT_RESOURCES;
  1654. +        goto out;
  1655. +    }
  1656.  
  1657.  #ifdef DEBUG_MARSHAL_DETAIL
  1658.      DbgP("marshal_nfs41_volume: class=%d\n", entry->u.Volume.query);
  1659. --
  1660. 2.51.0
  1661.  
  1662. From ec3c7cf4b231ef2701a1fa694c686ef36c4bdb6b Mon Sep 17 00:00:00 2001
  1663. From: Roland Mainz <roland.mainz@nrubsig.org>
  1664. Date: Wed, 22 Oct 2025 18:15:03 +0200
  1665. Subject: [PATCH 7/9] sys: Add function names to |print_error()| users
  1666.  
  1667. Add function names to |print_error()| users.
  1668.  
  1669. Signed-off-by: Cedric Blancher <cedric.blancher@gmail.com>
  1670. ---
  1671. sys/nfs41sys_dir.c        |  5 +++--
  1672.  sys/nfs41sys_driver.c     | 45 ++++++++++++++++++++++++++-------------
  1673.  sys/nfs41sys_fileinfo.c   | 20 +++++++++++------
  1674.  sys/nfs41sys_updowncall.c |  4 +++-
  1675.  sys/nfs41sys_util.c       |  6 +++---
  1676.  5 files changed, 52 insertions(+), 28 deletions(-)
  1677.  
  1678. diff --git a/sys/nfs41sys_dir.c b/sys/nfs41sys_dir.c
  1679. index 608f83a..7e6e4a0 100644
  1680. --- a/sys/nfs41sys_dir.c
  1681. +++ b/sys/nfs41sys_dir.c
  1682. @@ -251,8 +251,9 @@ NTSTATUS nfs41_QueryDirectory(
  1683.      case FileIdExtdBothDirectoryInformation:
  1684.          break;
  1685.      default:
  1686. -        print_error("nfs41_QueryDirectory: unhandled dir query class %d\n",
  1687. -            InfoClass);
  1688. +        print_error("nfs41_QueryDirectory: "
  1689. +            "unhandled dir query class %d\n",
  1690. +            (int)InfoClass);
  1691.          status = STATUS_NOT_SUPPORTED;
  1692.          goto out;
  1693.      }
  1694. diff --git a/sys/nfs41sys_driver.c b/sys/nfs41sys_driver.c
  1695. index 53ab74a..39689ab 100644
  1696. --- a/sys/nfs41sys_driver.c
  1697. +++ b/sys/nfs41sys_driver.c
  1698. @@ -426,12 +426,16 @@ NTSTATUS SharedMemoryInit(
  1699.      status = RtlCreateSecurityDescriptor(&SecurityDesc,
  1700.          SECURITY_DESCRIPTOR_REVISION);
  1701.      if (status) {
  1702. -        print_error("RtlCreateSecurityDescriptor() failed with %08X\n", status);
  1703. +        print_error("SharedMemoryInit: "
  1704. +            "RtlCreateSecurityDescriptor() failed with status=0x%lx\n",
  1705. +            (long)status);
  1706.          goto out;
  1707.      }
  1708.      status = RtlSetDaclSecurityDescriptor(&SecurityDesc, TRUE, NULL, FALSE);
  1709.      if (status) {
  1710. -        print_error("RtlSetDaclSecurityDescriptor() failed with %08X\n", status);
  1711. +        print_error("SharedMemoryInit: "
  1712. +            "RtlSetDaclSecurityDescriptor() failed with status=0x%lx\n",
  1713. +            (long)status);
  1714.          goto out;
  1715.      }
  1716.  
  1717. @@ -480,7 +484,9 @@ NTSTATUS nfs41_Start(
  1718.  
  1719.      status = SharedMemoryInit(&DevExt->SharedMemorySection);
  1720.      if (status) {
  1721. -        print_error("InitSharedMemory failed with %08X\n", status);
  1722. +        print_error("nfs41_Start: "
  1723. +            "InitSharedMemory failed with status=0x%lx\n",
  1724. +            (long)status);
  1725.          status = STATUS_INSUFFICIENT_RESOURCES;
  1726.          goto out;
  1727.      }
  1728. @@ -698,7 +704,8 @@ NTSTATUS _nfs41_CreateSrvCall(
  1729.  #endif
  1730.  
  1731.      if (pSrvCall->pSrvCallName->Length > SERVER_NAME_BUFFER_SIZE) {
  1732. -        print_error("Server name '%wZ' too long for server entry (max %u)\n",
  1733. +        print_error("_nfs41_CreateSrvCall: "
  1734. +            "Server name '%wZ' too long for server entry (max %u)\n",
  1735.              pSrvCall->pSrvCallName, SERVER_NAME_BUFFER_SIZE);
  1736.          status = STATUS_NAME_TOO_LONG;
  1737.          goto out;
  1738. @@ -748,8 +755,9 @@ NTSTATUS nfs41_CreateSrvCall(
  1739.          status = RxDispatchToWorkerThread(nfs41_dev, DelayedWorkQueue,
  1740.             (PRX_WORKERTHREAD_ROUTINE)_nfs41_CreateSrvCall, pCallbackContext);
  1741.          if (status != STATUS_SUCCESS) {
  1742. -            print_error("RxDispatchToWorkerThread returned status 0x%08lx\n",
  1743. -                status);
  1744. +            print_error("nfs41_CreateSrvCall: "
  1745. +                "RxDispatchToWorkerThread returned status 0x%lx\n",
  1746. +                (long)status);
  1747.              pCallbackContext->Status = status;
  1748.              pCallbackContext->SrvCalldownStructure->CallBack(pCallbackContext);
  1749.              status = STATUS_PENDING;
  1750. @@ -1075,7 +1083,7 @@ NTSTATUS nfs41_FsdDispatch(
  1751.  #endif
  1752.  
  1753.      if (dev != (PDEVICE_OBJECT)nfs41_dev) {
  1754. -        print_error("*** not ours ***\n");
  1755. +        print_error("nfs41_FsdDispatch: *** not ours ***\n");
  1756.          Irp->IoStatus.Status = STATUS_INVALID_DEVICE_REQUEST;
  1757.          Irp->IoStatus.Information = 0;
  1758.          IoCompleteRequest(Irp, IO_NFS41FS_INCREMENT);
  1759. @@ -1452,7 +1460,8 @@ NTSTATUS DriverEntry(
  1760.  
  1761.      status = RxDriverEntry(drv, path);
  1762.      if (status != STATUS_SUCCESS) {
  1763. -        print_error("RxDriverEntry failed: 0x%08lx\n", status);
  1764. +        print_error("DriverEntry: RxDriverEntry failed, status=0x%lx\n",
  1765. +            (long)status);
  1766.          goto out;
  1767.      }
  1768.  
  1769. @@ -1461,11 +1470,12 @@ NTSTATUS DriverEntry(
  1770.  
  1771.      status = nfs41_init_ops();
  1772.      if (status != STATUS_SUCCESS) {
  1773. -        print_error("nfs41_init_ops failed to initialize dispatch table\n");
  1774. +        print_error("DriverEntry: "
  1775. +            "nfs41_init_ops failed to initialize dispatch table\n");
  1776.          goto out;
  1777.      }
  1778.  
  1779. -    DbgP("calling RxRegisterMinirdr\n");
  1780. +    DbgP("DriverEntry: calling RxRegisterMinirdr\n");
  1781.      status = RxRegisterMinirdr(&nfs41_dev, drv, &nfs41_ops, flags, &dev_name,
  1782.                  sizeof(NFS41_DEVICE_EXTENSION),
  1783.                  FILE_DEVICE_NETWORK_FILE_SYSTEM, FILE_REMOTE_DEVICE);
  1784. @@ -1482,10 +1492,13 @@ NTSTATUS DriverEntry(
  1785.      dev_exts->DeviceObject = nfs41_dev;
  1786.  
  1787.      RtlInitUnicodeString(&user_dev_name, NFS41_SHADOW_DEVICE_NAME);
  1788. -    DbgP("calling IoCreateSymbolicLink '%wZ' '%wZ'\n", &user_dev_name, &dev_name);
  1789. +    DbgP("DriverEntry: calling IoCreateSymbolicLink '%wZ' '%wZ'\n",
  1790. +        &user_dev_name, &dev_name);
  1791.      status = IoCreateSymbolicLink(&user_dev_name, &dev_name);
  1792.      if (status != STATUS_SUCCESS) {
  1793. -        print_error("Device name IoCreateSymbolicLink failed: 0x%08lx\n", status);
  1794. +        print_error("DriverEntry: "
  1795. +            "Device name IoCreateSymbolicLink failed: status=0x%lx\n",
  1796. +            (long)status);
  1797.          goto out_unregister;
  1798.      }
  1799.  
  1800. @@ -1568,15 +1581,17 @@ unload:
  1801.      RtlInitUnicodeString(&dev_name, NFS41_SHADOW_DEVICE_NAME);
  1802.      status = IoDeleteSymbolicLink(&dev_name);
  1803.      if (status != STATUS_SUCCESS) {
  1804. -        print_error("couldn't delete device symbolic link\n");
  1805. +        print_error("nfs41_driver_unload: "
  1806. +            "could not delete device symbolic link\n");
  1807.      }
  1808.      RtlInitUnicodeString(&pipe_name, NFS41_SHADOW_PIPE_NAME);
  1809.      status = IoDeleteSymbolicLink(&pipe_name);
  1810.      if (status != STATUS_SUCCESS) {
  1811. -        print_error("couldn't delete pipe symbolic link\n");
  1812. +        print_error("nfs41_driver_unload: "
  1813. +            "could not delete pipe symbolic link\n");
  1814.      }
  1815.      RxUnload(drv);
  1816.  
  1817. -    DbgP("driver unloaded 0x%p\n", drv);
  1818. +    DbgP("nfs41_driver_unload: driver unloaded 0x%p\n", drv);
  1819.      DbgR();
  1820.  }
  1821. diff --git a/sys/nfs41sys_fileinfo.c b/sys/nfs41sys_fileinfo.c
  1822. index 8d26824..c86838c 100644
  1823. --- a/sys/nfs41sys_fileinfo.c
  1824. +++ b/sys/nfs41sys_fileinfo.c
  1825. @@ -226,7 +226,8 @@ NTSTATUS nfs41_QueryFileInformation(
  1826.  
  1827.      status = check_nfs41_dirquery_args(RxContext);
  1828.      if (status) {
  1829. -        print_error("check_nfs41_dirquery_args failed.\n");
  1830. +        print_error("nfs41_QueryFileInformation: "
  1831. +            "check_nfs41_dirquery_args failed.\n");
  1832.          goto out;
  1833.      }
  1834.  
  1835. @@ -399,7 +400,8 @@ NTSTATUS nfs41_QueryFileInformation(
  1836.  #endif /* NFS41_DRIVER_WSL_SUPPORT */
  1837.          break;
  1838.      default:
  1839. -        print_error("nfs41_QueryFileInformation: unhandled class %d\n", InfoClass);
  1840. +        print_error("nfs41_QueryFileInformation: "
  1841. +            "unhandled class %d\n", (int)InfoClass);
  1842.          status = STATUS_NOT_SUPPORTED;
  1843.          goto out;
  1844.      }
  1845. @@ -408,7 +410,8 @@ NTSTATUS nfs41_QueryFileInformation(
  1846.          pVNetRootContext->session, nfs41_fobx->nfs41_open_state,
  1847.          pNetRootContext->nfs41d_version, SrvOpen->pAlreadyPrefixedName, &entry);
  1848.      if (status) {
  1849. -        print_error("nfs41_UpcallCreate() failed, status=0x%lx\n",
  1850. +        print_error("nfs41_QueryFileInformation: "
  1851. +            "nfs41_UpcallCreate() failed, status=0x%lx\n",
  1852.              (long)status);
  1853.          goto out;
  1854.      }
  1855. @@ -426,11 +429,12 @@ NTSTATUS nfs41_QueryFileInformation(
  1856.  
  1857.      if (entry->status == STATUS_BUFFER_TOO_SMALL) {
  1858.          RxContext->InformationToReturn = entry->u.QueryFile.buf_len;
  1859. -        print_error("entry->status == STATUS_BUFFER_TOO_SMALL\n");
  1860. +        print_error("nfs41_QueryFileInformation: "
  1861. +            "entry->status == STATUS_BUFFER_TOO_SMALL\n");
  1862.          status = STATUS_BUFFER_TOO_SMALL;
  1863.      } else if (entry->status == STATUS_SUCCESS) {
  1864.  #ifdef DEBUG_FILE_QUERY
  1865. -        print_error("entry->status == STATUS_SUCCESS\n");
  1866. +        print_error("nfs41_QueryFileInformation: entry->status == STATUS_SUCCESS\n");
  1867.  #endif
  1868.          BOOLEAN DeletePending = FALSE;
  1869.  #ifdef ENABLE_TIMINGS
  1870. @@ -498,11 +502,13 @@ NTSTATUS nfs41_QueryFileInformation(
  1871.  #endif /* NFS41_DRIVER_WSL_SUPPORT */
  1872.              break;
  1873.          default:
  1874. -            print_error("Unhandled/unsupported InfoClass(%d)\n", (int)InfoClass);
  1875. +            print_error("nfs41_QueryFileInformation: "
  1876. +                "Unhandled/unsupported InfoClass(%d)\n", (int)InfoClass);
  1877.          }
  1878.      } else {
  1879.          status = map_queryfile_error(entry->status);
  1880. -        print_error("status(0x%lx) = map_queryfile_error(entry->status(0x%lx));\n",
  1881. +        print_error("nfs41_QueryFileInformation: "
  1882. +            "status(0x%lx) = map_queryfile_error(entry->status(0x%lx));\n",
  1883.              (long)status, (long)entry->status);
  1884.      }
  1885.  out:
  1886. diff --git a/sys/nfs41sys_updowncall.c b/sys/nfs41sys_updowncall.c
  1887. index 64b0432..5a4c250 100644
  1888. --- a/sys/nfs41sys_updowncall.c
  1889. +++ b/sys/nfs41sys_updowncall.c
  1890. @@ -335,7 +335,9 @@ NTSTATUS handle_upcall(
  1891.          break;
  1892.      default:
  1893.          status = STATUS_INVALID_PARAMETER;
  1894. -        print_error("Unknown nfs41 ops %d\n", entry->opcode);
  1895. +        print_error("handle_upcall: Unknown nfs41 ops %d\n",
  1896. +            (int)entry->opcode);
  1897. +        break;
  1898.      }
  1899.  
  1900.      // if (status == STATUS_SUCCESS)
  1901. diff --git a/sys/nfs41sys_util.c b/sys/nfs41sys_util.c
  1902. index 65c1990..6cceee8 100644
  1903. --- a/sys/nfs41sys_util.c
  1904. +++ b/sys/nfs41sys_util.c
  1905. @@ -128,7 +128,7 @@ NTSTATUS nfs41_ProbeAndLockKernelPages(
  1906.      } __except(EXCEPTION_EXECUTE_HANDLER) {
  1907.          NTSTATUS code;
  1908.          code = GetExceptionCode();
  1909. -        print_error("marshal_nfs41_dirquery: Call to "
  1910. +        print_error("nfs41_ProbeAndLockKernelPages: Call to "
  1911.              "MmMapLockedPagesSpecifyCache() failed "
  1912.              "due to exception 0x%lx\n", (long)code);
  1913.          status = STATUS_ACCESS_VIOLATION;
  1914. @@ -186,8 +186,8 @@ NTSTATUS nfs41_UnmapLockedKernelPagesInNfsDaemonAddressSpace(
  1915.      } __except(EXCEPTION_EXECUTE_HANDLER) {
  1916.          NTSTATUS code;
  1917.          code = GetExceptionCode();
  1918. -        print_error("nfs41_UnmapLockedKernelPages: "
  1919. -            "MmUnmapLockedPages thrown exception=0x%lx\n",
  1920. +        print_error("nfs41_UnmapLockedKernelPagesInNfsDaemonAddressSpace: "
  1921. +            "MmUnmapLockedPages() thrown exception=0x%lx\n",
  1922.              (long)code);
  1923.          status = STATUS_ACCESS_VIOLATION;
  1924.      }
  1925. --
  1926. 2.51.0
  1927.  
  1928. From c3d823b20c0c96affd7cae9db9a3f538ba194cf2 Mon Sep 17 00:00:00 2001
  1929. From: Roland Mainz <roland.mainz@nrubsig.org>
  1930. Date: Wed, 22 Oct 2025 22:16:12 +0200
  1931. Subject: [PATCH 8/9] daemon: |handle_nfs41_setattr_basicinfo()| should only
  1932.  return read delegations for unsafe attributes
  1933.  
  1934. |handle_nfs41_setattr_basicinfo()| should only return read delegations for
  1935. unsafe attributes (e.g. |FATTR4_WORD1_MODE|, |FATTR4_WORD1_TIME_CREATE|),
  1936. the NFS server will issue a delegation recall anyway if it disagrees.
  1937.  
  1938. Signed-off-by: Cedric Blancher <cedric.blancher@gmail.com>
  1939. ---
  1940. daemon/setattr.c | 26 +++++++++++++++++++++++---
  1941.  1 file changed, 23 insertions(+), 3 deletions(-)
  1942.  
  1943. diff --git a/daemon/setattr.c b/daemon/setattr.c
  1944. index 90b177a..a45e782 100644
  1945. --- a/daemon/setattr.c
  1946. +++ b/daemon/setattr.c
  1947. @@ -174,9 +174,29 @@ static int handle_nfs41_setattr_basicinfo(void *daemon_context, setattr_upcall_a
  1948.      if (info.attrmask.count == 0)
  1949.          goto out;
  1950.  
  1951. -    /* break read delegations before SETATTR */
  1952. -    nfs41_delegation_return(state->session, &state->file,
  1953. -        OPEN_DELEGATE_READ, FALSE);
  1954. +    /*
  1955. +     * Break read delegations before SETATTR, but only for attributes
  1956. +     * which are unsafe even if we hold a read delegation.
  1957. +     *
  1958. +     * FIXME:
  1959. +     * 1. Should we do this if we own a write delegation ?
  1960. +     * 2. Should we do this for |FATTR4_WORD1_TIME_MODIFY_SET| too,
  1961. +     * even if we have the file open for writing, and/or have a write
  1962. +     * delegation (well, the NFS server will do a delegation recall
  1963. +     * via CB if it disagrees...) ?
  1964. +     * 3. The NFSv4 RFCs really should have a list of attributes which
  1965. +     * would trigger a recall for read or write delegations
  1966. +     */
  1967. +    if (bitmap_isset(&info.attrmask, 1, FATTR4_WORD1_MODE) ||
  1968. +        bitmap_isset(&info.attrmask, 1, FATTR4_WORD1_TIME_CREATE)) {
  1969. +        DPRINTF(0, ("handle_nfs41_setattr_basicinfo(args->path='%s'): "
  1970. +            "returning read delegation because of mode=%d, time_create=%d\n",
  1971. +            args->path,
  1972. +            (int)bitmap_isset(&info.attrmask, 1, FATTR4_WORD1_MODE),
  1973. +            (int)bitmap_isset(&info.attrmask, 1, FATTR4_WORD1_TIME_CREATE)));
  1974. +        nfs41_delegation_return(state->session, &state->file,
  1975. +            OPEN_DELEGATE_READ, FALSE);
  1976. +    }
  1977.  
  1978.      nfs41_open_stateid_arg(state, &stateid);
  1979.  
  1980. --
  1981. 2.51.0
  1982.  
  1983. From 9ad4b6c07b18930a33028b2af1bfbf5d7d27c62e Mon Sep 17 00:00:00 2001
  1984. From: Dan Shelton <dan.f.shelton@gmail.com>
  1985. Date: Wed, 22 Oct 2025 22:23:12 +0200
  1986. Subject: [PATCH 9/9] sys: Implement |FSCTL_SET_PURGE_FAILURE_MODE| dummy
  1987.  support like OpenAFS does
  1988.  
  1989. Implement |FSCTL_SET_PURGE_FAILURE_MODE| dummy support like OpenAFS does
  1990.  
  1991. Signed-off-by: Cedric Blancher <cedric.blancher@gmail.com>
  1992. ---
  1993. sys/nfs41sys_fsctl.c | 8 ++++++++
  1994.  1 file changed, 8 insertions(+)
  1995.  
  1996. diff --git a/sys/nfs41sys_fsctl.c b/sys/nfs41sys_fsctl.c
  1997. index adc322e..f6d44da 100644
  1998. --- a/sys/nfs41sys_fsctl.c
  1999. +++ b/sys/nfs41sys_fsctl.c
  2000. @@ -1399,6 +1399,14 @@ NTSTATUS nfs41_FsCtl(
  2001.      case FSCTL_OFFLOAD_WRITE:
  2002.          status = nfs41_OffloadWrite(RxContext);
  2003.          break;
  2004. +    case FSCTL_SET_PURGE_FAILURE_MODE:
  2005. +        /*
  2006. +         * For the time being just succeed this call, as OpenAFS
  2007. +         * does in openafs.git commit #0af079f2d03d1b76bd4221cb56b27091b5635fd0
  2008. +         * (https://git.openafs.org/?p=openafs.git;a=commit;h=0af079f2d03d1b76bd4221cb56b27091b5635fd0)
  2009. +         */
  2010. +        status = STATUS_SUCCESS;
  2011. +        break;
  2012.      default:
  2013.          break;
  2014.      }
  2015. --
  2016. 2.51.0

Submit a correction or amendment below (click here to make a fresh posting)
After submitting an amendment, you'll be able to view the differences between the old and new posts easily.

Syntax highlighting:

To highlight particular lines, prefix each line with {%HIGHLIGHT}




All content is user-submitted.
The administrators of this site (kpaste.net) are not responsible for their content.
Abuse reports should be emailed to us at