pastebin - collaborative debugging tool
rovema.kpaste.net RSS


msnfs41client: Patches for moving secctx to nfs41srvopen, secctx locking+misc, 2025-12-06
Posted by Anonymous on Tue 9th Dec 2025 19:40
raw | new post

  1. From 2b3ae315eb3046e02d91556b5556465359a579c4 Mon Sep 17 00:00:00 2001
  2. From: Roland Mainz <roland.mainz@nrubsig.org>
  3. Date: Sat, 6 Dec 2025 18:32:30 +0100
  4. Subject: [PATCH 1/3] sys: Move |SECURITY_CLIENT_CONTEXT| from |NFS41_FOBX| to
  5.  |NFS41_SRV_OPEN|
  6.  
  7. Move |SECURITY_CLIENT_CONTEXT| from |NFS41_FOBX| to |NFS41_SRV_OPEN|.
  8.  
  9. Signed-off-by: Cedric Blancher <cedric.blancher@gmail.com>
  10. ---
  11. sys/nfs41sys_acl.c         |  6 +--
  12.  sys/nfs41sys_buildconfig.h |  1 -
  13.  sys/nfs41sys_dir.c         |  3 +-
  14.  sys/nfs41sys_driver.c      | 66 ++++++++++++++------------
  15.  sys/nfs41sys_driver.h      | 17 +++----
  16.  sys/nfs41sys_ea.c          |  9 ++--
  17.  sys/nfs41sys_fileinfo.c    |  6 +--
  18.  sys/nfs41sys_fsctl.c       | 12 ++---
  19.  sys/nfs41sys_lock.c        |  6 +--
  20.  sys/nfs41sys_openclose.c   | 94 +++++++++++++-------------------------
  21.  sys/nfs41sys_readwrite.c   |  4 +-
  22.  sys/nfs41sys_symlink.c     |  6 +--
  23.  sys/nfs41sys_updowncall.c  | 32 -------------
  24.  sys/nfs41sys_volinfo.c     |  3 +-
  25.  14 files changed, 94 insertions(+), 171 deletions(-)
  26.  
  27. diff --git a/sys/nfs41sys_acl.c b/sys/nfs41sys_acl.c
  28. index 0ab1f80..e9b0a6e 100644
  29. --- a/sys/nfs41sys_acl.c
  30. +++ b/sys/nfs41sys_acl.c
  31. @@ -223,7 +223,6 @@ NTSTATUS nfs41_QuerySecurityInformation(
  32.  {
  33.      NTSTATUS status = STATUS_NOT_SUPPORTED;
  34.      nfs41_updowncall_entry *entry = NULL;
  35. -    __notnull PNFS41_FOBX nfs41_fobx = NFS41GetFobxExtension(RxContext->pFobx);
  36.      __notnull PMRX_SRV_OPEN SrvOpen = RxContext->pRelevantSrvOpen;
  37.      __notnull PNFS41_SRV_OPEN nfs41_srvopen = NFS41GetSrvOpenExtension(SrvOpen);
  38.      __notnull PNFS41_FCB nfs41_fcb = NFS41GetFcbExtension(RxContext->pFcb);
  39. @@ -319,7 +318,7 @@ NTSTATUS nfs41_QuerySecurityInformation(
  40.          DbgP("nfs41_QuerySecurityInformation: cached ACL info invalidated\n");
  41.      }
  42.  
  43. -    status = nfs41_UpcallCreate(NFS41_SYSOP_ACL_QUERY, &nfs41_fobx->sec_ctx,
  44. +    status = nfs41_UpcallCreate(NFS41_SYSOP_ACL_QUERY, &nfs41_srvopen->sec_ctx,
  45.          pVNetRootContext->session, nfs41_srvopen->nfs41_open_state,
  46.          pNetRootContext->nfs41d_version, SrvOpen->pAlreadyPrefixedName, &entry);
  47.      if (status) goto out;
  48. @@ -439,7 +438,6 @@ NTSTATUS nfs41_SetSecurityInformation(
  49.  {
  50.      NTSTATUS status = STATUS_NOT_SUPPORTED;
  51.      nfs41_updowncall_entry *entry = NULL;
  52. -    __notnull PNFS41_FOBX nfs41_fobx = NFS41GetFobxExtension(RxContext->pFobx);
  53.      __notnull PMRX_SRV_OPEN SrvOpen = RxContext->pRelevantSrvOpen;
  54.      __notnull PNFS41_SRV_OPEN nfs41_srvopen = NFS41GetSrvOpenExtension(SrvOpen);
  55.      __notnull PNFS41_V_NET_ROOT_EXTENSION pVNetRootContext =
  56. @@ -484,7 +482,7 @@ NTSTATUS nfs41_SetSecurityInformation(
  57.          }
  58.      }
  59.  
  60. -    status = nfs41_UpcallCreate(NFS41_SYSOP_ACL_SET, &nfs41_fobx->sec_ctx,
  61. +    status = nfs41_UpcallCreate(NFS41_SYSOP_ACL_SET, &nfs41_srvopen->sec_ctx,
  62.          pVNetRootContext->session, nfs41_srvopen->nfs41_open_state,
  63.          pNetRootContext->nfs41d_version, SrvOpen->pAlreadyPrefixedName, &entry);
  64.      if (status) goto out;
  65. diff --git a/sys/nfs41sys_buildconfig.h b/sys/nfs41sys_buildconfig.h
  66. index dea5e1d..5df638e 100644
  67. --- a/sys/nfs41sys_buildconfig.h
  68. +++ b/sys/nfs41sys_buildconfig.h
  69. @@ -93,7 +93,6 @@
  70.  #define ENABLE_COLLAPSEOPEN 1
  71.  #ifdef ENABLE_COLLAPSEOPEN
  72.  #define WINBUG_NO_COLLAPSE_IF_PRIMARYGROUPS_DIFFER 1
  73. -#define WINBUG_WORKAROUND_CLOSESRVOPEN_CALLED_AFTER_FOXB_CLEANUP 1
  74.  #endif /* ENABLE_COLLAPSEOPEN */
  75.  
  76.  /* debugging printout defines */
  77. diff --git a/sys/nfs41sys_dir.c b/sys/nfs41sys_dir.c
  78. index 60e5b50..77c2aca 100644
  79. --- a/sys/nfs41sys_dir.c
  80. +++ b/sys/nfs41sys_dir.c
  81. @@ -236,7 +236,6 @@ NTSTATUS nfs41_QueryDirectory(
  82.          NFS41GetVNetRootExtension(SrvOpen->pVNetRoot);
  83.      __notnull PNFS41_NETROOT_EXTENSION pNetRootContext =
  84.          NFS41GetNetRootExtension(SrvOpen->pVNetRoot->pNetRoot);
  85. -    __notnull PNFS41_FOBX nfs41_fobx = NFS41GetFobxExtension(RxContext->pFobx);
  86.  #ifdef ENABLE_TIMINGS
  87.      LARGE_INTEGER t1, t2;
  88.      t1 = KeQueryPerformanceCounter(NULL);
  89. @@ -269,7 +268,7 @@ NTSTATUS nfs41_QueryDirectory(
  90.          status = STATUS_NOT_SUPPORTED;
  91.          goto out;
  92.      }
  93. -    status = nfs41_UpcallCreate(NFS41_SYSOP_DIR_QUERY, &nfs41_fobx->sec_ctx,
  94. +    status = nfs41_UpcallCreate(NFS41_SYSOP_DIR_QUERY, &nfs41_srvopen->sec_ctx,
  95.          pVNetRootContext->session, nfs41_srvopen->nfs41_open_state,
  96.          pNetRootContext->nfs41d_version, SrvOpen->pAlreadyPrefixedName, &entry);
  97.      if (status) goto out;
  98. diff --git a/sys/nfs41sys_driver.c b/sys/nfs41sys_driver.c
  99. index e043602..796b77f 100644
  100. --- a/sys/nfs41sys_driver.c
  101. +++ b/sys/nfs41sys_driver.c
  102. @@ -841,7 +841,7 @@ out:
  103.  }
  104.  
  105.  VOID nfs41_remove_fcb_entry(
  106. -    PMRX_FCB fcb)
  107. +    PMRX_SRV_OPEN SrvOpen)
  108.  {
  109.      PLIST_ENTRY pEntry;
  110.      nfs41_fcb_list_entry *cur;
  111. @@ -851,9 +851,11 @@ VOID nfs41_remove_fcb_entry(
  112.      while (!IsListEmpty(&openlist.head)) {
  113.          cur = (nfs41_fcb_list_entry *)CONTAINING_RECORD(pEntry,
  114.                  nfs41_fcb_list_entry, next);
  115. -        if (cur->fcb == fcb) {
  116. +        if (cur->srvopen == SrvOpen) {
  117.  #ifdef DEBUG_CLOSE
  118. -            DbgP("nfs41_remove_fcb_entry: Found match for fcb=0x%p\n", fcb);
  119. +            DbgP("nfs41_remove_fcb_entry: "
  120. +                "Found match for fcb=0x%p srvopen=0x%p\n",
  121. +                cur->srvopen->pFcb, cur->srvopen);
  122.  #endif
  123.              RemoveEntryList(pEntry);
  124.              nfs41_free_nfs41_fcb_list_entry(cur);
  125. @@ -862,7 +864,7 @@ VOID nfs41_remove_fcb_entry(
  126.          if (pEntry->Flink == &openlist.head) {
  127.  #ifdef DEBUG_CLOSE
  128.              DbgP("nfs41_remove_fcb_entry: reached EOL looking "
  129. -                "for fcb 0x%p\n", fcb);
  130. +                "for SrvOpen=0x%p\n", SrvOpen);
  131.  #endif
  132.              break;
  133.          }
  134. @@ -885,8 +887,6 @@ NTSTATUS nfs41_DeallocateForFcb(
  135.  {
  136.      __notnull PNFS41_FCB nfs41_fcb = NFS41GetFcbExtension(pFcb);
  137.  
  138. -    nfs41_remove_fcb_entry(pFcb);
  139. -
  140.      if (nfs41_fcb->aclcache.data) {
  141.          RxFreePool(nfs41_fcb->aclcache.data);
  142.          nfs41_fcb->aclcache.data = NULL;
  143. @@ -906,8 +906,8 @@ VOID nfs41_update_fcb_list(
  144.      while (!IsListEmpty(&openlist.head)) {
  145.          cur = (nfs41_fcb_list_entry *)CONTAINING_RECORD(pEntry,
  146.                  nfs41_fcb_list_entry, next);
  147. -        if (cur->fcb == fcb &&
  148. -                cur->ChangeTime != ChangeTime) {
  149. +        if ((cur->srvopen->pFcb == fcb) &&
  150. +            (cur->ChangeTime != ChangeTime)) {
  151.  #if defined(DEBUG_FILE_SET) || defined(DEBUG_ACL_SET) || \
  152.      defined(DEBUG_WRITE) || defined(DEBUG_EA_SET)
  153.              DbgP("nfs41_update_fcb_list: Found match for fcb 0x%p: "
  154. @@ -1022,7 +1022,8 @@ void enable_caching(
  155.      while (!IsListEmpty(&openlist.head)) {
  156.          cur = (nfs41_fcb_list_entry *)CONTAINING_RECORD(pEntry,
  157.                  nfs41_fcb_list_entry, next);
  158. -        if (cur->fcb == SrvOpen->pFcb) {
  159. +        if ((cur->srvopen != NULL) &&
  160. +            (cur->srvopen->pFcb == SrvOpen->pFcb)) {
  161.  #ifdef DEBUG_TIME_BASED_COHERENCY
  162.              DbgP("enable_caching: Looked&Found match for fcb=0x%p '%wZ'\n",
  163.                  SrvOpen->pFcb, SrvOpen->pAlreadyPrefixedName);
  164. @@ -1048,9 +1049,7 @@ void enable_caching(
  165.          oentry = nfs41_allocate_nfs41_fcb_list_entry();
  166.          if (oentry == NULL)
  167.              goto out_release_fcblistlock;
  168. -        oentry->fcb = SrvOpen->pFcb;
  169. -        oentry->session = session;
  170. -        oentry->nfs41_fobx = nfs41_fobx;
  171. +        oentry->srvopen = SrvOpen;
  172.          oentry->ChangeTime = ChangeTime;
  173.          oentry->skip = FALSE;
  174.          InsertTailList(&openlist.head, &oentry->next);
  175. @@ -1326,36 +1325,45 @@ VOID fcbopen_main(PVOID ctx)
  176.                      nfs41_fcb_list_entry, next);
  177.  
  178.  #ifdef DEBUG_TIME_BASED_COHERENCY
  179. -            DbgP("fcbopen_main: Checking attributes for fcb=0x%p "
  180. -                "change_time=%llu skipping=%d\n", cur->fcb,
  181. -                cur->ChangeTime, cur->skip);
  182. +            DbgP("fcbopen_main: Checking attributes for srvopen=%0x%p fcb=0x%p "
  183. +                "change_time=%llu skipping=%d\n",
  184. +                cur->srvopen,
  185. +                ((cur->srvopen != NULL)?cur->srvopen->pFcb:NULL),
  186. +                cur->ChangeTime,
  187. +                cur->skip);
  188.  #endif
  189.              if (cur->skip) goto out;
  190.  
  191. +            PNFS41_SRV_OPEN nfs41_srvopen =
  192. +                NFS41GetSrvOpenExtension(cur->srvopen);
  193. +
  194.              /*
  195. -             * This can only happen if |nfs41_DeallocateForFobx()|
  196. +             * This can only happen if |nfs41_CloseSrvOpen()|
  197.               * was called
  198.               */
  199. -            if ((!cur->nfs41_fobx) || (!cur->nfs41_fobx->sec_ctx.ClientToken))
  200. +            if ((nfs41_srvopen == NULL) ||
  201. +                (nfs41_srvopen->sec_ctx.ClientToken == NULL)) {
  202.                  goto out;
  203. +            }
  204. +
  205. +            PNFS41_V_NET_ROOT_EXTENSION pVNetRootContext =
  206. +                NFS41GetVNetRootExtension(cur->srvopen->pVNetRoot);
  207.  
  208. -            if (!cur->nfs41_fobx->timebasedcoherency) {
  209. +            if (!pVNetRootContext->timebasedcoherency) {
  210.  #ifdef DEBUG_TIME_BASED_COHERENCY
  211.                  DbgP("fcbopen_main: timebasedcoherency disabled for "
  212. -                    "fcb=0x%p, nfs41_fobx=0x%p\n", cur->fcb, cur->nfs41_fobx);
  213. +                    "fcb=0x%p\n", cur->srvopen->pFcb);
  214.  #endif
  215.                  goto out;
  216.              }
  217.  
  218.              pNetRootContext =
  219. -                NFS41GetNetRootExtension(cur->fcb->pNetRoot);
  220. -            PNFS41_SRV_OPEN nfs41_srvopen =
  221. -                NFS41GetSrvOpenExtension(cur->srvopen);
  222. +                NFS41GetNetRootExtension(cur->srvopen->pFcb->pNetRoot);
  223.  
  224.              /* place an upcall for this srv_open */
  225.              status = nfs41_UpcallCreate(
  226.                  NFS41_SYSOP_FILE_QUERY_TIME_BASED_COHERENCY,
  227. -                &cur->nfs41_fobx->sec_ctx, cur->session,
  228. +                &nfs41_srvopen->sec_ctx, pVNetRootContext->session,
  229.                  nfs41_srvopen->nfs41_open_state,
  230.                  pNetRootContext->nfs41d_version, NULL, &entry);
  231.              if (status) goto out;
  232. @@ -1377,9 +1385,9 @@ VOID fcbopen_main(PVOID ctx)
  233.  #endif
  234.                  cur->ChangeTime = entry->ChangeTime;
  235.                  cur->skip = TRUE;
  236. -                psrvEntry = &cur->fcb->SrvOpenList;
  237. +                psrvEntry = &cur->srvopen->pFcb->SrvOpenList;
  238.                  psrvEntry = psrvEntry->Flink;
  239. -                while (!IsListEmpty(&cur->fcb->SrvOpenList)) {
  240. +                while (!IsListEmpty(&cur->srvopen->pFcb->SrvOpenList)) {
  241.                      srv_open = (PMRX_SRV_OPEN)CONTAINING_RECORD(psrvEntry,
  242.                              MRX_SRV_OPEN, SrvOpenQLinks);
  243.                      if (srv_open->DesiredAccess &
  244. @@ -1389,20 +1397,20 @@ VOID fcbopen_main(PVOID ctx)
  245.                               "************\n", srv_open->pAlreadyPrefixedName);
  246.  #endif
  247.                          RxIndicateChangeOfBufferingStateForSrvOpen(
  248. -                            cur->fcb->pNetRoot->pSrvCall, srv_open,
  249. +                            cur->srvopen->pFcb->pNetRoot->pSrvCall, srv_open,
  250.                              srv_open->Key, ULongToPtr(flag));
  251.                      }
  252. -                    if (psrvEntry->Flink == &cur->fcb->SrvOpenList) {
  253. +                    if (psrvEntry->Flink == &cur->srvopen->pFcb->SrvOpenList) {
  254.  #ifdef DEBUG_TIME_BASED_COHERENCY
  255.                          DbgP("fcbopen_main: reached end of srvopen for fcb 0x%p\n",
  256. -                            cur->fcb);
  257. +                            cur->srvopen->pFcb);
  258.  #endif
  259.                          break;
  260.                      }
  261.                      psrvEntry = psrvEntry->Flink;
  262.                  };
  263.              }
  264. -            nfs41_fcb = NFS41GetFcbExtension(cur->fcb);
  265. +            nfs41_fcb = NFS41GetFcbExtension(cur->srvopen->pFcb);
  266.              nfs41_fcb->changeattr = entry->ChangeTime;
  267.  out:
  268.              nfs41_UpcallDestroy(entry);
  269. diff --git a/sys/nfs41sys_driver.h b/sys/nfs41sys_driver.h
  270. index d6bd5ca..a998ed6 100644
  271. --- a/sys/nfs41sys_driver.h
  272. +++ b/sys/nfs41sys_driver.h
  273. @@ -503,6 +503,12 @@ typedef struct _NFS41_FCB {
  274.  
  275.  typedef struct _NFS41_SRV_OPEN {
  276.      BOOLEAN         initialised;
  277. +    /*
  278. +     * |sec_ctx| must be per |SRV_OPEN| to handle newgrp()/|setgid()|
  279. +     * support. But this only works if we prevent |SRV_OPEN| collapsing
  280. +     * if the PrimaryGroups of the SRV_OPENs are not the same
  281. +     */
  282. +    SECURITY_CLIENT_CONTEXT sec_ctx;
  283.      HANDLE          nfs41_open_state;
  284.      nfs41_open_delegation_type deleg_type;
  285.  #ifdef WINBUG_NO_COLLAPSE_IF_PRIMARYGROUPS_DIFFER
  286. @@ -527,14 +533,8 @@ typedef struct _NFS41_FOBX {
  287.      NODE_TYPE_CODE          NodeTypeCode;
  288.      NODE_BYTE_SIZE          NodeByteSize;
  289.  
  290. -    /*
  291. -     * |sec_ctx| must be per |FILE_OBJECT| to handle newgrp()1/|setgid()|
  292. -     * support
  293. -     */
  294. -    SECURITY_CLIENT_CONTEXT sec_ctx;
  295.      BOOLEAN write_thru;
  296.      BOOLEAN nocache;
  297. -    BOOLEAN timebasedcoherency;
  298.  } NFS41_FOBX, *PNFS41_FOBX;
  299.  #define NFS41GetFobxExtension(pFobx)  \
  300.          (((pFobx) == NULL) ? NULL : (PNFS41_FOBX)((pFobx)->Context))
  301. @@ -561,10 +561,7 @@ typedef struct _NFS41_DEVICE_EXTENSION {
  302.  
  303.  typedef struct _nfs41_fcb_list_entry {
  304.      LIST_ENTRY next;
  305. -    PMRX_FCB fcb;
  306.      PMRX_SRV_OPEN srvopen;
  307. -    HANDLE session;
  308. -    PNFS41_FOBX nfs41_fobx;
  309.      ULONGLONG ChangeTime;
  310.      BOOLEAN skip;
  311.  } nfs41_fcb_list_entry;
  312. @@ -652,7 +649,7 @@ NTSTATUS map_symlink_errors(
  313.      NTSTATUS status);
  314.  
  315.  VOID nfs41_remove_fcb_entry(
  316. -    PMRX_FCB fcb);
  317. +    PMRX_SRV_OPEN SrvOpen);
  318.  
  319.  /* nfs41sys_acl.c */
  320.  NTSTATUS marshal_nfs41_getacl(
  321. diff --git a/sys/nfs41sys_ea.c b/sys/nfs41sys_ea.c
  322. index 8ba33f4..8499cbc 100644
  323. --- a/sys/nfs41sys_ea.c
  324. +++ b/sys/nfs41sys_ea.c
  325. @@ -355,7 +355,6 @@ NTSTATUS nfs41_SetEaInformation(
  326.      __notnull PNFS41_NETROOT_EXTENSION pNetRootContext =
  327.          NFS41GetNetRootExtension(SrvOpen->pVNetRoot->pNetRoot);
  328.      __notnull PNFS41_FCB nfs41_fcb = NFS41GetFcbExtension(RxContext->pFcb);
  329. -    __notnull PNFS41_FOBX nfs41_fobx = NFS41GetFobxExtension(RxContext->pFobx);
  330.  #ifdef ENABLE_TIMINGS
  331.      LARGE_INTEGER t1, t2;
  332.      t1 = KeQueryPerformanceCounter(NULL);
  333. @@ -371,7 +370,7 @@ NTSTATUS nfs41_SetEaInformation(
  334.      status = check_nfs41_setea_args(RxContext);
  335.      if (status) goto out;
  336.  
  337. -    status = nfs41_UpcallCreate(NFS41_SYSOP_EA_SET, &nfs41_fobx->sec_ctx,
  338. +    status = nfs41_UpcallCreate(NFS41_SYSOP_EA_SET, &nfs41_srvopen->sec_ctx,
  339.          pVNetRootContext->session, nfs41_srvopen->nfs41_open_state,
  340.          pNetRootContext->nfs41d_version, SrvOpen->pAlreadyPrefixedName, &entry);
  341.      if (status) goto out;
  342. @@ -486,7 +485,6 @@ NTSTATUS QueryCygwinSymlink(
  343.              NFS41GetVNetRootExtension(SrvOpen->pVNetRoot);
  344.      __notnull PNFS41_NETROOT_EXTENSION NetRootContext =
  345.              NFS41GetNetRootExtension(SrvOpen->pVNetRoot->pNetRoot);
  346. -    __notnull PNFS41_FOBX Fobx = NFS41GetFobxExtension(RxContext->pFobx);
  347.      nfs41_updowncall_entry *entry = NULL;
  348.      UNICODE_STRING TargetName;
  349.      const USHORT HeaderLen = FIELD_OFFSET(FILE_FULL_EA_INFORMATION, EaName) +
  350. @@ -503,7 +501,7 @@ NTSTATUS QueryCygwinSymlink(
  351.      TargetName.MaximumLength = (USHORT)min(RxContext->Info.LengthRemaining -
  352.          HeaderLen, 0xFFFF);
  353.  
  354. -    status = nfs41_UpcallCreate(NFS41_SYSOP_SYMLINK_GET, &Fobx->sec_ctx,
  355. +    status = nfs41_UpcallCreate(NFS41_SYSOP_SYMLINK_GET, &nfs41_srvopen->sec_ctx,
  356.          VNetRootContext->session, nfs41_srvopen->nfs41_open_state,
  357.          NetRootContext->nfs41d_version, SrvOpen->pAlreadyPrefixedName, &entry);
  358.      if (status) goto out;
  359. @@ -638,7 +636,6 @@ NTSTATUS nfs41_QueryEaInformation(
  360.              NFS41GetVNetRootExtension(SrvOpen->pVNetRoot);
  361.      __notnull PNFS41_NETROOT_EXTENSION pNetRootContext =
  362.              NFS41GetNetRootExtension(SrvOpen->pVNetRoot->pNetRoot);
  363. -    __notnull PNFS41_FOBX nfs41_fobx = NFS41GetFobxExtension(RxContext->pFobx);
  364.  #ifdef ENABLE_TIMINGS
  365.      LARGE_INTEGER t1, t2;
  366.      t1 = KeQueryPerformanceCounter(NULL);
  367. @@ -660,7 +657,7 @@ NTSTATUS nfs41_QueryEaInformation(
  368.      if (status != STATUS_NONEXISTENT_EA_ENTRY)
  369.          goto out;
  370.  
  371. -    status = nfs41_UpcallCreate(NFS41_SYSOP_EA_GET, &nfs41_fobx->sec_ctx,
  372. +    status = nfs41_UpcallCreate(NFS41_SYSOP_EA_GET, &nfs41_srvopen->sec_ctx,
  373.          pVNetRootContext->session, nfs41_srvopen->nfs41_open_state,
  374.          pNetRootContext->nfs41d_version, SrvOpen->pAlreadyPrefixedName, &entry);
  375.      if (status) goto out;
  376. diff --git a/sys/nfs41sys_fileinfo.c b/sys/nfs41sys_fileinfo.c
  377. index b1642bf..203c503 100644
  378. --- a/sys/nfs41sys_fileinfo.c
  379. +++ b/sys/nfs41sys_fileinfo.c
  380. @@ -211,7 +211,6 @@ NTSTATUS nfs41_QueryFileInformation(
  381.      __notnull PNFS41_NETROOT_EXTENSION pNetRootContext =
  382.          NFS41GetNetRootExtension(SrvOpen->pVNetRoot->pNetRoot);
  383.      __notnull PNFS41_FCB nfs41_fcb = NFS41GetFcbExtension(RxContext->pFcb);
  384. -    __notnull PNFS41_FOBX nfs41_fobx = NFS41GetFobxExtension(RxContext->pFobx);
  385.  #ifdef ENABLE_TIMINGS
  386.      LARGE_INTEGER t1, t2;
  387.      t1 = KeQueryPerformanceCounter(NULL);
  388. @@ -407,7 +406,7 @@ NTSTATUS nfs41_QueryFileInformation(
  389.          goto out;
  390.      }
  391.  
  392. -    status = nfs41_UpcallCreate(NFS41_SYSOP_FILE_QUERY, &nfs41_fobx->sec_ctx,
  393. +    status = nfs41_UpcallCreate(NFS41_SYSOP_FILE_QUERY, &nfs41_srvopen->sec_ctx,
  394.          pVNetRootContext->session, nfs41_srvopen->nfs41_open_state,
  395.          pNetRootContext->nfs41d_version, SrvOpen->pAlreadyPrefixedName, &entry);
  396.      if (status) {
  397. @@ -683,7 +682,6 @@ NTSTATUS nfs41_SetFileInformationImpl(
  398.      __notnull PNFS41_NETROOT_EXTENSION pNetRootContext =
  399.          NFS41GetNetRootExtension(SrvOpen->pVNetRoot->pNetRoot);
  400.      __notnull PNFS41_FCB nfs41_fcb = NFS41GetFcbExtension(RxContext->pFcb);
  401. -    __notnull PNFS41_FOBX nfs41_fobx = NFS41GetFobxExtension(RxContext->pFobx);
  402.  #ifdef ENABLE_TIMINGS
  403.      LARGE_INTEGER t1, t2;
  404.      t1 = KeQueryPerformanceCounter(NULL);
  405. @@ -789,7 +787,7 @@ NTSTATUS nfs41_SetFileInformationImpl(
  406.          }
  407.      }
  408.  
  409. -    status = nfs41_UpcallCreate(opcode, &nfs41_fobx->sec_ctx,
  410. +    status = nfs41_UpcallCreate(opcode, &nfs41_srvopen->sec_ctx,
  411.          pVNetRootContext->session, nfs41_srvopen->nfs41_open_state,
  412.          pNetRootContext->nfs41d_version, SrvOpen->pAlreadyPrefixedName, &entry);
  413.      if (status) goto out;
  414. diff --git a/sys/nfs41sys_fsctl.c b/sys/nfs41sys_fsctl.c
  415. index d39544f..b79fd30 100644
  416. --- a/sys/nfs41sys_fsctl.c
  417. +++ b/sys/nfs41sys_fsctl.c
  418. @@ -140,7 +140,6 @@ NTSTATUS nfs41_QueryAllocatedRanges(
  419.      __notnull PFILE_ALLOCATED_RANGE_BUFFER out_range_buffer =
  420.          (PFILE_ALLOCATED_RANGE_BUFFER)FsCtl->pOutputBuffer;
  421.      ULONG out_range_buffer_len = FsCtl->OutputBufferLength;
  422. -    __notnull PNFS41_FOBX nfs41_fobx = NFS41GetFobxExtension(RxContext->pFobx);
  423.  
  424.      DbgEn();
  425.  
  426. @@ -160,7 +159,7 @@ NTSTATUS nfs41_QueryAllocatedRanges(
  427.          (long long)in_range_buffer->Length.QuadPart);
  428.  
  429.      status = nfs41_UpcallCreate(NFS41_SYSOP_FSCTL_QUERYALLOCATEDRANGES,
  430. -        &nfs41_fobx->sec_ctx,
  431. +        &nfs41_srvopen->sec_ctx,
  432.          pVNetRootContext->session,
  433.          nfs41_srvopen->nfs41_open_state,
  434.          pNetRootContext->nfs41d_version,
  435. @@ -458,7 +457,6 @@ NTSTATUS nfs41_SetZeroData(
  436.          &RxContext->LowIoContext.ParamsFor.FsCtl;
  437.      __notnull const PFILE_ZERO_DATA_INFORMATION setzerodatabuffer =
  438.          (const PFILE_ZERO_DATA_INFORMATION)FsCtl->pInputBuffer;
  439. -    __notnull PNFS41_FOBX nfs41_fobx = NFS41GetFobxExtension(RxContext->pFobx);
  440.      bool fcb_locked_exclusive = false;
  441.  
  442.      DbgEn();
  443. @@ -508,7 +506,7 @@ NTSTATUS nfs41_SetZeroData(
  444.      (void)RxPurgeFcbInSystemCache((PFCB)RxContext->pFcb, NULL, 0L, TRUE, TRUE);
  445.  
  446.      status = nfs41_UpcallCreate(NFS41_SYSOP_FSCTL_SET_ZERO_DATA,
  447. -        &nfs41_fobx->sec_ctx,
  448. +        &nfs41_srvopen->sec_ctx,
  449.          pVNetRootContext->session,
  450.          nfs41_srvopen->nfs41_open_state,
  451.          pNetRootContext->nfs41d_version,
  452. @@ -649,7 +647,6 @@ NTSTATUS nfs41_DuplicateData(
  453.          NFS41GetNetRootExtension(SrvOpen->pVNetRoot->pNetRoot);
  454.      __notnull XXCTL_LOWIO_COMPONENT *FsCtl =
  455.          &RxContext->LowIoContext.ParamsFor.FsCtl;
  456. -    __notnull PNFS41_FOBX nfs41_fobx = NFS41GetFobxExtension(RxContext->pFobx);
  457.      PFCB srcfcb = NULL;
  458.      PFOBX srcfox = NULL;
  459.      bool src_fcb_locked_exclusive = false;
  460. @@ -818,7 +815,7 @@ NTSTATUS nfs41_DuplicateData(
  461.      (void)RxPurgeFcbInSystemCache((PFCB)RxContext->pFcb, NULL, 0L, TRUE, TRUE);
  462.  
  463.      status = nfs41_UpcallCreate(NFS41_SYSOP_FSCTL_DUPLICATE_DATA,
  464. -        &nfs41_fobx->sec_ctx,
  465. +        &nfs41_srvopen->sec_ctx,
  466.          pVNetRootContext->session,
  467.          nfs41_srvopen->nfs41_open_state,
  468.          pNetRootContext->nfs41d_version,
  469. @@ -1207,7 +1204,6 @@ NTSTATUS nfs41_OffloadWrite(
  470.          NFS41GetNetRootExtension(SrvOpen->pVNetRoot->pNetRoot);
  471.      __notnull const XXCTL_LOWIO_COMPONENT *FsCtl =
  472.          &RxContext->LowIoContext.ParamsFor.FsCtl;
  473. -    __notnull PNFS41_FOBX nfs41_fobx = NFS41GetFobxExtension(RxContext->pFobx);
  474.      offloadcontext_entry *src_oce = NULL;
  475.      bool src_fcb_locked_exclusive = false;
  476.      bool dest_fcb_locked_exclusive = false;
  477. @@ -1352,7 +1348,7 @@ NTSTATUS nfs41_OffloadWrite(
  478.      (void)RxPurgeFcbInSystemCache((PFCB)RxContext->pFcb, NULL, 0L, TRUE, TRUE);
  479.  
  480.      status = nfs41_UpcallCreate(NFS41_SYSOP_FSCTL_OFFLOAD_DATACOPY,
  481. -        &nfs41_fobx->sec_ctx,
  482. +        &nfs41_srvopen->sec_ctx,
  483.          pVNetRootContext->session,
  484.          nfs41_srvopen->nfs41_open_state,
  485.          pNetRootContext->nfs41d_version,
  486. diff --git a/sys/nfs41sys_lock.c b/sys/nfs41sys_lock.c
  487. index 71a7dec..85d6c32 100644
  488. --- a/sys/nfs41sys_lock.c
  489. +++ b/sys/nfs41sys_lock.c
  490. @@ -266,7 +266,6 @@ NTSTATUS nfs41_Lock(
  491.      NTSTATUS status = STATUS_SUCCESS;
  492.      nfs41_updowncall_entry *entry = NULL;
  493.      PLOWIO_CONTEXT LowIoContext = &RxContext->LowIoContext;
  494. -    __notnull PNFS41_FOBX nfs41_fobx = NFS41GetFobxExtension(RxContext->pFobx);
  495.      __notnull PMRX_SRV_OPEN SrvOpen = RxContext->pRelevantSrvOpen;
  496.      __notnull PNFS41_SRV_OPEN nfs41_srvopen = NFS41GetSrvOpenExtension(SrvOpen);
  497.      __notnull PNFS41_V_NET_ROOT_EXTENSION pVNetRootContext =
  498. @@ -301,7 +300,7 @@ NTSTATUS nfs41_Lock(
  499.      }
  500.  #endif /* NFS41_DRIVER_HACK_LOCKING_STORAGE32_RANGELOCK_PROBING */
  501.  
  502. -    status = nfs41_UpcallCreate(NFS41_SYSOP_LOCK, &nfs41_fobx->sec_ctx,
  503. +    status = nfs41_UpcallCreate(NFS41_SYSOP_LOCK, &nfs41_srvopen->sec_ctx,
  504.          pVNetRootContext->session, nfs41_srvopen->nfs41_open_state,
  505.          pNetRootContext->nfs41d_version, SrvOpen->pAlreadyPrefixedName, &entry);
  506.      if (status) goto out;
  507. @@ -378,7 +377,6 @@ NTSTATUS nfs41_Unlock(
  508.      NTSTATUS status = STATUS_SUCCESS;
  509.      nfs41_updowncall_entry *entry = NULL;
  510.      PLOWIO_CONTEXT LowIoContext  = &RxContext->LowIoContext;
  511. -    __notnull PNFS41_FOBX nfs41_fobx = NFS41GetFobxExtension(RxContext->pFobx);
  512.      __notnull PMRX_SRV_OPEN SrvOpen = RxContext->pRelevantSrvOpen;
  513.      __notnull PNFS41_SRV_OPEN nfs41_srvopen = NFS41GetSrvOpenExtension(SrvOpen);
  514.      __notnull PNFS41_V_NET_ROOT_EXTENSION pVNetRootContext =
  515. @@ -416,7 +414,7 @@ NTSTATUS nfs41_Unlock(
  516.      }
  517.  #endif /* NFS41_DRIVER_HACK_LOCKING_STORAGE32_RANGELOCK_PROBING */
  518.  
  519. -    status = nfs41_UpcallCreate(NFS41_SYSOP_UNLOCK, &nfs41_fobx->sec_ctx,
  520. +    status = nfs41_UpcallCreate(NFS41_SYSOP_UNLOCK, &nfs41_srvopen->sec_ctx,
  521.          pVNetRootContext->session, nfs41_srvopen->nfs41_open_state,
  522.          pNetRootContext->nfs41d_version, SrvOpen->pAlreadyPrefixedName, &entry);
  523.      if (status) goto out;
  524. diff --git a/sys/nfs41sys_openclose.c b/sys/nfs41sys_openclose.c
  525. index 57b10d5..6934223 100644
  526. --- a/sys/nfs41sys_openclose.c
  527. +++ b/sys/nfs41sys_openclose.c
  528. @@ -383,40 +383,6 @@ NTSTATUS nfs41_AreFilesAliased(
  529.      }
  530.  }
  531.  
  532. -static
  533. -VOID nfs41_invalidate_fobx_entry(
  534. -    IN OUT PMRX_FOBX pFobx)
  535. -{
  536. -    PLIST_ENTRY pEntry;
  537. -    nfs41_fcb_list_entry *cur;
  538. -    __notnull PNFS41_FOBX nfs41_fobx = NFS41GetFobxExtension(pFobx);
  539. -
  540. -    ExAcquireFastMutexUnsafe(&openlist.lock);
  541. -
  542. -    pEntry = openlist.head.Flink;
  543. -    while (!IsListEmpty(&openlist.head)) {
  544. -        cur = (nfs41_fcb_list_entry *)CONTAINING_RECORD(pEntry,
  545. -                nfs41_fcb_list_entry, next);
  546. -        if (cur->nfs41_fobx == nfs41_fobx) {
  547. -#ifdef DEBUG_CLOSE
  548. -            DbgP("nfs41_invalidate_fobx_entry: Found match for nfs41_fobx=0x%p\n",
  549. -                nfs41_fobx);
  550. -#endif
  551. -            cur->nfs41_fobx = NULL;
  552. -            break;
  553. -        }
  554. -        if (pEntry->Flink == &openlist.head) {
  555. -#ifdef DEBUG_CLOSE
  556. -            DbgP("nfs41_invalidate_fobx_entry: reached EOL looking "
  557. -                "for nfs41_fobx=0x%p\n", nfs41_fobx);
  558. -#endif
  559. -            break;
  560. -        }
  561. -        pEntry = pEntry->Flink;
  562. -    }
  563. -    ExReleaseFastMutexUnsafe(&openlist.lock);
  564. -}
  565. -
  566.  static BOOLEAN isDataAccess(
  567.      ACCESS_MASK mask)
  568.  {
  569. @@ -693,8 +659,7 @@ NTSTATUS nfs41_createnetfobx(
  570.      PRX_CONTEXT  RxContext,
  571.      PMRX_SRV_OPEN SrvOpen)
  572.  {
  573. -    NTSTATUS status;
  574. -    PNFS41_FOBX nfs41_fobx;
  575. +    NTSTATUS status = STATUS_SUCCESS;
  576.  
  577.      RxContext->pFobx = RxCreateNetFobx(RxContext, SrvOpen);
  578.      if (RxContext->pFobx == NULL) {
  579. @@ -702,9 +667,6 @@ NTSTATUS nfs41_createnetfobx(
  580.          goto out;
  581.      }
  582.  
  583. -    nfs41_fobx = NFS41GetFobxExtension(RxContext->pFobx);
  584. -    status = nfs41_get_sec_ctx(SecurityImpersonation, &nfs41_fobx->sec_ctx);
  585. -
  586.  out:
  587.      return status;
  588.  }
  589. @@ -752,6 +714,16 @@ NTSTATUS nfs41_Create(
  590.          ExInitializeFastMutex(&nfs41_fcb->aclcache.lock);
  591.      }
  592.  
  593. +    if (nfs41_srvopen->sec_ctx.ClientToken == NULL) {
  594. +        status = nfs41_get_sec_ctx(SecurityImpersonation,
  595. +            &nfs41_srvopen->sec_ctx);
  596. +        if (status) {
  597. +            DbgP("nfs41_Create: nfs41_get_sec_ctx() failed, status=0x%lx\n",
  598. +                (long)status);
  599. +            goto out;
  600. +        }
  601. +    }
  602. +
  603.      if (nfs41_srvopen->initialised == FALSE) {
  604.          nfs41_srvopen->initialised = TRUE;
  605.  #ifdef WINBUG_NO_COLLAPSE_IF_PRIMARYGROUPS_DIFFER
  606. @@ -799,7 +771,7 @@ NTSTATUS nfs41_Create(
  607.          SdBuffer, SdLength);
  608.  #endif /* NFS41_DRIVER_ALLOW_CREATEFILE_ACLS */
  609.  
  610. -    status = nfs41_UpcallCreate(NFS41_SYSOP_OPEN, NULL,
  611. +    status = nfs41_UpcallCreate(NFS41_SYSOP_OPEN, &nfs41_srvopen->sec_ctx,
  612.          pVNetRootContext->session, INVALID_HANDLE_VALUE,
  613.          pNetRootContext->nfs41d_version,
  614.          SrvOpen->pAlreadyPrefixedName, &entry);
  615. @@ -1262,7 +1234,6 @@ retry_on_link:
  616.                  (FCB_STATE_READBUFFERING_ENABLED |
  617.                  FCB_STATE_READCACHING_ENABLED);
  618.          }
  619. -        nfs41_fobx->timebasedcoherency = pVNetRootContext->timebasedcoherency;
  620.          if (pVNetRootContext->nocache ||
  621.                  (params->CreateOptions & FILE_NO_INTERMEDIATE_BUFFERING)) {
  622.  #ifdef DEBUG_OPEN
  623. @@ -1282,10 +1253,7 @@ retry_on_link:
  624.                  status = STATUS_INSUFFICIENT_RESOURCES;
  625.                  goto out;
  626.              }
  627. -            oentry->fcb = RxContext->pFcb;
  628.              oentry->srvopen = SrvOpen;
  629. -            oentry->nfs41_fobx = nfs41_fobx;
  630. -            oentry->session = pVNetRootContext->session;
  631.              oentry->ChangeTime = entry->ChangeTime;
  632.              oentry->skip = FALSE;
  633.              nfs41_AddEntry(openlist.lock, openlist, oentry);
  634. @@ -1305,6 +1273,13 @@ retry_on_link:
  635.      status = RxContext->CurrentIrp->IoStatus.Status = STATUS_SUCCESS;
  636.  
  637.  out:
  638. +    if (status) {
  639. +        if (nfs41_srvopen->sec_ctx.ClientToken) {
  640. +            SeDeleteClientSecurity(&nfs41_srvopen->sec_ctx);
  641. +            nfs41_srvopen->sec_ctx.ClientToken = NULL;
  642. +        }
  643. +    }
  644. +
  645.      if (fcb_locked_exclusive) {
  646.          RxReleaseFcbResourceInMRx(Fcb);
  647.      }
  648. @@ -1536,7 +1511,6 @@ NTSTATUS nfs41_CloseSrvOpen(
  649.      __notnull PNFS41_NETROOT_EXTENSION pNetRootContext =
  650.          NFS41GetNetRootExtension(SrvOpen->pVNetRoot->pNetRoot);
  651.      __notnull PNFS41_FCB nfs41_fcb = NFS41GetFcbExtension(RxContext->pFcb);
  652. -    __notnull PNFS41_FOBX nfs41_fobx = NFS41GetFobxExtension(RxContext->pFobx);
  653.  #ifdef ENABLE_TIMINGS
  654.      LARGE_INTEGER t1, t2;
  655.      t1 = KeQueryPerformanceCounter(NULL);
  656. @@ -1548,13 +1522,14 @@ NTSTATUS nfs41_CloseSrvOpen(
  657.  #endif
  658.      FsRtlEnterFileSystem();
  659.  
  660. -    if (IS_NFS41_OPEN_DELEGATE_NONE(nfs41_srvopen->deleg_type) &&
  661. -        !nfs41_fcb->StandardInfo.Directory &&
  662. -        RxContext->pFcb->OpenCount == 0) {
  663. -        nfs41_remove_fcb_entry(RxContext->pFcb);
  664. -    }
  665. +    /*
  666. +     * Remove these BEOFRE doing the |NFS41_SYSOP_CLOSE|, so noone can issue
  667. +     * a request while the NFS file handle is being destroyed
  668. +     */
  669. +    nfs41_remove_fcb_entry(SrvOpen);
  670. +    nfs41_remove_offloadcontext_for_srvopen(SrvOpen);
  671.  
  672. -    status = nfs41_UpcallCreate(NFS41_SYSOP_CLOSE, &nfs41_fobx->sec_ctx,
  673. +    status = nfs41_UpcallCreate(NFS41_SYSOP_CLOSE, &nfs41_srvopen->sec_ctx,
  674.          pVNetRootContext->session, nfs41_srvopen->nfs41_open_state,
  675.          pNetRootContext->nfs41d_version, SrvOpen->pAlreadyPrefixedName, &entry);
  676.      if (status) goto out;
  677. @@ -1580,12 +1555,14 @@ NTSTATUS nfs41_CloseSrvOpen(
  678.          goto out;
  679.      }
  680.  
  681. +    if (nfs41_srvopen->sec_ctx.ClientToken != NULL) {
  682. +        SeDeleteClientSecurity(&nfs41_srvopen->sec_ctx);
  683. +        nfs41_srvopen->sec_ctx.ClientToken = NULL;
  684. +    }
  685. +
  686.      /* map windows ERRORs to NTSTATUS */
  687.      status = map_close_errors(entry->status);
  688.  
  689. -    if (NT_SUCCESS(status)) {
  690. -        nfs41_remove_offloadcontext_for_srvopen(SrvOpen);
  691. -    }
  692.  out:
  693.      if (entry) {
  694.          nfs41_UpcallDestroy(entry);
  695. @@ -1610,19 +1587,10 @@ out:
  696.  NTSTATUS nfs41_DeallocateForFobx(
  697.      IN OUT PMRX_FOBX pFobx)
  698.  {
  699. -    __notnull PNFS41_FOBX nfs41_fobx = NFS41GetFobxExtension(pFobx);
  700. -
  701.  #ifdef DEBUG_CLOSE
  702.      DbgP("nfs41_DeallocateForFobx: FileName is '%wZ'\n",
  703.          pFobx->pSrvOpen->pAlreadyPrefixedName);
  704.  #endif /* DEBUG_CLOSE */
  705.  
  706. -    nfs41_invalidate_fobx_entry(pFobx);
  707. -
  708. -    if (nfs41_fobx->sec_ctx.ClientToken) {
  709. -        SeDeleteClientSecurity(&nfs41_fobx->sec_ctx);
  710. -        nfs41_fobx->sec_ctx.ClientToken = NULL;
  711. -    }
  712. -
  713.      return STATUS_SUCCESS;
  714.  }
  715. diff --git a/sys/nfs41sys_readwrite.c b/sys/nfs41sys_readwrite.c
  716. index 75145a5..f8b2090 100644
  717. --- a/sys/nfs41sys_readwrite.c
  718. +++ b/sys/nfs41sys_readwrite.c
  719. @@ -258,7 +258,7 @@ NTSTATUS nfs41_Read(
  720.      status = check_nfs41_read_args(RxContext);
  721.      if (status) goto out;
  722.  
  723. -    status = nfs41_UpcallCreate(NFS41_SYSOP_READ, &nfs41_fobx->sec_ctx,
  724. +    status = nfs41_UpcallCreate(NFS41_SYSOP_READ, &nfs41_srvopen->sec_ctx,
  725.          pVNetRootContext->session, nfs41_srvopen->nfs41_open_state,
  726.          pNetRootContext->nfs41d_version, SrvOpen->pAlreadyPrefixedName, &entry);
  727.      if (status) goto out;
  728. @@ -387,7 +387,7 @@ NTSTATUS nfs41_Write(
  729.      status = check_nfs41_write_args(RxContext);
  730.      if (status) goto out;
  731.  
  732. -    status = nfs41_UpcallCreate(NFS41_SYSOP_WRITE, &nfs41_fobx->sec_ctx,
  733. +    status = nfs41_UpcallCreate(NFS41_SYSOP_WRITE, &nfs41_srvopen->sec_ctx,
  734.          pVNetRootContext->session, nfs41_srvopen->nfs41_open_state,
  735.          pNetRootContext->nfs41d_version, SrvOpen->pAlreadyPrefixedName, &entry);
  736.      if (status) goto out;
  737. diff --git a/sys/nfs41sys_symlink.c b/sys/nfs41sys_symlink.c
  738. index c157164..5ed5cfe 100644
  739. --- a/sys/nfs41sys_symlink.c
  740. +++ b/sys/nfs41sys_symlink.c
  741. @@ -257,7 +257,6 @@ NTSTATUS nfs41_SetSymlinkReparsePoint(
  742.      __notnull XXCTL_LOWIO_COMPONENT *FsCtl = &RxContext->LowIoContext.ParamsFor.FsCtl;
  743.      __notnull const PREPARSE_DATA_BUFFER Reparse =
  744.          (const PREPARSE_DATA_BUFFER)FsCtl->pInputBuffer;
  745. -    __notnull PNFS41_FOBX Fobx = NFS41GetFobxExtension(RxContext->pFobx);
  746.      __notnull PMRX_SRV_OPEN SrvOpen = RxContext->pRelevantSrvOpen;
  747.      __notnull PNFS41_SRV_OPEN nfs41_srvopen = NFS41GetSrvOpenExtension(SrvOpen);
  748.      __notnull PNFS41_V_NET_ROOT_EXTENSION VNetRootContext =
  749. @@ -416,7 +415,7 @@ NTSTATUS nfs41_SetSymlinkReparsePoint(
  750.          }
  751.      }
  752.  
  753. -    status = nfs41_UpcallCreate(NFS41_SYSOP_SYMLINK_SET, &Fobx->sec_ctx,
  754. +    status = nfs41_UpcallCreate(NFS41_SYSOP_SYMLINK_SET, &nfs41_srvopen->sec_ctx,
  755.          VNetRootContext->session, nfs41_srvopen->nfs41_open_state,
  756.          pNetRootContext->nfs41d_version, SrvOpen->pAlreadyPrefixedName, &entry);
  757.      if (status) goto out;
  758. @@ -568,7 +567,6 @@ NTSTATUS nfs41_GetSymlinkReparsePoint(
  759.      NTSTATUS status;
  760.      UNICODE_STRING TargetName;
  761.      XXCTL_LOWIO_COMPONENT *FsCtl = &RxContext->LowIoContext.ParamsFor.FsCtl;
  762. -    __notnull PNFS41_FOBX Fobx = NFS41GetFobxExtension(RxContext->pFobx);
  763.      __notnull PMRX_SRV_OPEN SrvOpen = RxContext->pRelevantSrvOpen;
  764.      __notnull PNFS41_SRV_OPEN nfs41_srvopen = NFS41GetSrvOpenExtension(SrvOpen);
  765.      __notnull PNFS41_V_NET_ROOT_EXTENSION VNetRootContext =
  766. @@ -603,7 +601,7 @@ NTSTATUS nfs41_GetSymlinkReparsePoint(
  767.      TargetName.Buffer = targetname_buffer;
  768.      TargetName.MaximumLength = (USHORT)targetname_buffer_len;
  769.  
  770. -    status = nfs41_UpcallCreate(NFS41_SYSOP_SYMLINK_GET, &Fobx->sec_ctx,
  771. +    status = nfs41_UpcallCreate(NFS41_SYSOP_SYMLINK_GET, &nfs41_srvopen->sec_ctx,
  772.          VNetRootContext->session, nfs41_srvopen->nfs41_open_state,
  773.          pNetRootContext->nfs41d_version, SrvOpen->pAlreadyPrefixedName, &entry);
  774.      if (status) goto out;
  775. diff --git a/sys/nfs41sys_updowncall.c b/sys/nfs41sys_updowncall.c
  776. index 4a44f2b..6e32ef7 100644
  777. --- a/sys/nfs41sys_updowncall.c
  778. +++ b/sys/nfs41sys_updowncall.c
  779. @@ -383,38 +383,6 @@ NTSTATUS nfs41_UpcallCreate(
  780.      KeInitializeEvent(&entry->cond, SynchronizationEvent, FALSE);
  781.      ExInitializeFastMutex(&entry->lock);
  782.  
  783. -#ifdef WINBUG_WORKAROUND_CLOSESRVOPEN_CALLED_AFTER_FOXB_CLEANUP
  784. -    /*
  785. -     * HACK: Workaround the RDBSS bug where |RxPurgeRelatedFobxs()| first
  786. -     * destroyes a FOBX via |RxFinalizeNetFobx()|,and then calls
  787. -     * |nfs41_CloseSrvOpen()| to close the SRV_OPEN with the same FOBX,
  788. -     * which results in |clnt_sec_ctx->ClientToken == NULL|.
  789. -     *
  790. -     * Without the workaround we crash like this, because
  791. -     * |clnt_sec_ctx->ClientToken == NULL|:
  792. -     * ---- snip ----
  793. -     * nt!ObfReferenceObject
  794. -     * nfs41_driver!nfs41_UpcallCreate
  795. -     * nfs41_driver!nfs41_CloseSrvOpen
  796. -     * nfs41_driver!RxCloseAssociatedSrvOpen
  797. -     * nfs41_driver!RxFinalizeNetFobx
  798. -     * nfs41_driver!RxDereference
  799. -     * nfs41_driver!RxPurgeRelatedFobxs
  800. -     * nfs41_driver!RxCommonSetInformation
  801. -     * nfs41_driver!RxFsdCommonDispatch
  802. -     * nfs41_driver!RxFsdDispatch
  803. -     * nfs41_driver!nfs41_FsdDispatch
  804. -     * ---- snip ----
  805. -     */
  806. -    if (opcode == NFS41_SYSOP_CLOSE) {
  807. -        if (clnt_sec_ctx) {
  808. -            if (clnt_sec_ctx->ClientToken == NULL) {
  809. -                clnt_sec_ctx = NULL;
  810. -            }
  811. -        }
  812. -    }
  813. -#endif /* WINBUG_WORKAROUND_CLOSESRVOPEN_CALLED_AFTER_FOXB_CLEANUP */
  814. -
  815.      if (clnt_sec_ctx == NULL) {
  816.          SeCaptureSubjectContext(&sec_ctx);
  817.          sec_qos.ContextTrackingMode = SECURITY_STATIC_TRACKING;
  818. diff --git a/sys/nfs41sys_volinfo.c b/sys/nfs41sys_volinfo.c
  819. index 10b9c61..d2484b6 100644
  820. --- a/sys/nfs41sys_volinfo.c
  821. +++ b/sys/nfs41sys_volinfo.c
  822. @@ -158,7 +158,6 @@ NTSTATUS nfs41_QueryVolumeInformation(
  823.          NFS41GetVNetRootExtension(SrvOpen->pVNetRoot);
  824.      __notnull PNFS41_NETROOT_EXTENSION pNetRootContext =
  825.          NFS41GetNetRootExtension(SrvOpen->pVNetRoot->pNetRoot);
  826. -    __notnull PNFS41_FOBX nfs41_fobx = NFS41GetFobxExtension(RxContext->pFobx);
  827.  
  828.  #ifdef ENABLE_TIMINGS
  829.      LARGE_INTEGER t1, t2;
  830. @@ -206,7 +205,7 @@ NTSTATUS nfs41_QueryVolumeInformation(
  831.          status = STATUS_NOT_SUPPORTED;
  832.          goto out;
  833.      }
  834. -    status = nfs41_UpcallCreate(NFS41_SYSOP_VOLUME_QUERY, &nfs41_fobx->sec_ctx,
  835. +    status = nfs41_UpcallCreate(NFS41_SYSOP_VOLUME_QUERY, &nfs41_srvopen->sec_ctx,
  836.          pVNetRootContext->session, nfs41_srvopen->nfs41_open_state,
  837.          pNetRootContext->nfs41d_version, SrvOpen->pAlreadyPrefixedName, &entry);
  838.      if (status) goto out;
  839. --
  840. 2.51.0
  841.  
  842. From 4242f5fb938476f4e7cc60d8bb46a7d59abb1212 Mon Sep 17 00:00:00 2001
  843. From: Roland Mainz <roland.mainz@nrubsig.org>
  844. Date: Sat, 6 Dec 2025 20:28:33 +0100
  845. Subject: [PATCH 2/3] sys: |nfs41_ComputeNewBufferingState()| should remove
  846.  |FCB_STATE_DISABLE_LOCAL_BUFFERING| if any caching is enabled
  847.  
  848. |nfs41_ComputeNewBufferingState()| should remove
  849. |FCB_STATE_DISABLE_LOCAL_BUFFERING| if any caching is enabled.
  850.  
  851. Signed-off-by: Cedric Blancher <cedric.blancher@gmail.com>
  852. ---
  853. sys/nfs41sys_driver.c | 7 ++++++-
  854.  1 file changed, 6 insertions(+), 1 deletion(-)
  855.  
  856. diff --git a/sys/nfs41sys_driver.c b/sys/nfs41sys_driver.c
  857. index 796b77f..a4deed7 100644
  858. --- a/sys/nfs41sys_driver.c
  859. +++ b/sys/nfs41sys_driver.c
  860. @@ -966,16 +966,21 @@ NTSTATUS nfs41_ComputeNewBufferingState(
  861.      case ENABLE_READ_CACHING:
  862.          pSrvOpen->BufferingFlags |=
  863.              (FCB_STATE_READBUFFERING_ENABLED | FCB_STATE_READCACHING_ENABLED);
  864. +        pSrvOpen->BufferingFlags &= ~FCB_STATE_DISABLE_LOCAL_BUFFERING;
  865.          break;
  866.      case ENABLE_WRITE_CACHING:
  867.          pSrvOpen->BufferingFlags |=
  868.              (FCB_STATE_WRITECACHING_ENABLED | FCB_STATE_WRITEBUFFERING_ENABLED);
  869. +        pSrvOpen->BufferingFlags &= ~FCB_STATE_DISABLE_LOCAL_BUFFERING;
  870.          break;
  871.      case ENABLE_READWRITE_CACHING:
  872. -        pSrvOpen->BufferingFlags =
  873. +        pSrvOpen->BufferingFlags |=
  874.              (FCB_STATE_READBUFFERING_ENABLED | FCB_STATE_READCACHING_ENABLED |
  875.              FCB_STATE_WRITECACHING_ENABLED | FCB_STATE_WRITEBUFFERING_ENABLED);
  876. +        pSrvOpen->BufferingFlags &= ~FCB_STATE_DISABLE_LOCAL_BUFFERING;
  877. +        break;
  878.      }
  879. +
  880.  #ifdef DEBUG_TIME_BASED_COHERENCY
  881.      DbgP("nfs41_ComputeNewBufferingState: '%wZ' pSrvOpen 0x%p Old %08x New %08x\n",
  882.           pSrvOpen->pAlreadyPrefixedName, pSrvOpen, oldFlags,
  883. --
  884. 2.51.0
  885.  
  886. From 11e132fedb8d85238ca0923944f844ae40c4de79 Mon Sep 17 00:00:00 2001
  887. From: Roland Mainz <roland.mainz@nrubsig.org>
  888. Date: Sat, 6 Dec 2025 20:54:52 +0100
  889. Subject: [PATCH 3/3] sys: Use
  890.  |SeLockSubjectContext()|+|SeUnlockSubjectContext()| when accessing context
  891.  data
  892.  
  893. Use |SeLockSubjectContext()|+|SeUnlockSubjectContext()| when accessing
  894. context data.
  895.  
  896. Signed-off-by: Cedric Blancher <cedric.blancher@gmail.com>
  897. ---
  898. sys/nfs41sys_mount.c      | 3 +++
  899.  sys/nfs41sys_openclose.c  | 4 ++++
  900.  sys/nfs41sys_updowncall.c | 3 +++
  901.  3 files changed, 10 insertions(+)
  902.  
  903. diff --git a/sys/nfs41sys_mount.c b/sys/nfs41sys_mount.c
  904. index 1f330c9..b1a46b5 100644
  905. --- a/sys/nfs41sys_mount.c
  906. +++ b/sys/nfs41sys_mount.c
  907. @@ -750,6 +750,8 @@ NTSTATUS nfs41_GetLUID(
  908.      SECURITY_CLIENT_CONTEXT clnt_sec_ctx;
  909.  
  910.      SeCaptureSubjectContext(&sec_ctx);
  911. +    SeLockSubjectContext(&sec_ctx);
  912. +
  913.      sec_qos.ContextTrackingMode = SECURITY_STATIC_TRACKING;
  914.      sec_qos.ImpersonationLevel = SecurityIdentification;
  915.      sec_qos.Length = sizeof(SECURITY_QUALITY_OF_SERVICE);
  916. @@ -778,6 +780,7 @@ NTSTATUS nfs41_GetLUID(
  917.  release_clnt_sec_ctx:
  918.      SeDeleteClientSecurity(&clnt_sec_ctx);
  919.  release_sec_ctx:
  920. +    SeUnlockSubjectContext(&sec_ctx);
  921.      SeReleaseSubjectContext(&sec_ctx);
  922.  
  923.      return status;
  924. diff --git a/sys/nfs41sys_openclose.c b/sys/nfs41sys_openclose.c
  925. index 6934223..885ec5e 100644
  926. --- a/sys/nfs41sys_openclose.c
  927. +++ b/sys/nfs41sys_openclose.c
  928. @@ -79,6 +79,8 @@ NTSTATUS nfs41_get_sec_ctx(
  929.      SECURITY_QUALITY_OF_SERVICE sec_qos;
  930.  
  931.      SeCaptureSubjectContext(&ctx);
  932. +    SeLockSubjectContext(&ctx);
  933. +
  934.      sec_qos.ContextTrackingMode = SECURITY_STATIC_TRACKING;
  935.      sec_qos.ImpersonationLevel = level;
  936.      sec_qos.Length = sizeof(SECURITY_QUALITY_OF_SERVICE);
  937. @@ -99,6 +101,8 @@ NTSTATUS nfs41_get_sec_ctx(
  938.  #ifdef DEBUG_SECURITY_TOKEN
  939.      DbgP("Created client security token 0x%p\n", out_ctx->ClientToken);
  940.  #endif
  941. +
  942. +    SeUnlockSubjectContext(&ctx);
  943.      SeReleaseSubjectContext(&ctx);
  944.  
  945.      return status;
  946. diff --git a/sys/nfs41sys_updowncall.c b/sys/nfs41sys_updowncall.c
  947. index 6e32ef7..bc9093e 100644
  948. --- a/sys/nfs41sys_updowncall.c
  949. +++ b/sys/nfs41sys_updowncall.c
  950. @@ -385,6 +385,8 @@ NTSTATUS nfs41_UpcallCreate(
  951.  
  952.      if (clnt_sec_ctx == NULL) {
  953.          SeCaptureSubjectContext(&sec_ctx);
  954. +        SeLockSubjectContext(&sec_ctx);
  955. +
  956.          sec_qos.ContextTrackingMode = SECURITY_STATIC_TRACKING;
  957.          sec_qos.ImpersonationLevel = SecurityImpersonation;
  958.          sec_qos.Length = sizeof(SECURITY_QUALITY_OF_SERVICE);
  959. @@ -408,6 +410,7 @@ NTSTATUS nfs41_UpcallCreate(
  960.              entry = NULL;
  961.          }
  962.  
  963. +        SeUnlockSubjectContext(&sec_ctx);
  964.          SeReleaseSubjectContext(&sec_ctx);
  965.      } else {
  966.          entry->psec_ctx = clnt_sec_ctx;
  967. --
  968. 2.51.0

Submit a correction or amendment below (click here to make a fresh posting)
After submitting an amendment, you'll be able to view the differences between the old and new posts easily.

Syntax highlighting:

To highlight particular lines, prefix each line with {%HIGHLIGHT}




All content is user-submitted.
The administrators of this site (kpaste.net) are not responsible for their content.
Abuse reports should be emailed to us at