msnfs41client: Fix kernel crash in |fcbopen_main()|, 2024-07-31
Posted by Anonymous on Wed 31st Jul 2024 18:11
raw | new post

From 4e7d2d8f9eabd04e30b5a50d2e12996ff9fd836e Mon Sep 17 00:00:00 2001
From: Roland Mainz <roland.mainz@nrubsig.org>
Date: Wed, 31 Jul 2024 19:02:17 +0200
Subject: [PATCH] sys: Fix kernel crash in |fcbopen_main()|

Fix kernel crash in |fcbopen_main()|, caused by using
a FCB which has already been deallocated.

Stack trace looks like this:
---- snip ----
nt!KeBugCheckEx
nt!MiSystemFault+0x1ccd81
nt!MmAccessFault+0x400
nt!KiPageFault+0x36d
nfs41_driver!fcbopen_main+0x105 [ms-nfs41-client\sys\nfs41_driver.c @ 7513]
nt!PspSystemThreadStartup+0x55
nt!KiStartSystemThread+0x28
---- snip ----

Signed-off-by: Cedric Blancher <cedric.blancher@gmail.com>
---
 sys/nfs41_driver.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/sys/nfs41_driver.c b/sys/nfs41_driver.c
index 288046b..d85f5fa 100644
--- a/sys/nfs41_driver.c
+++ b/sys/nfs41_driver.c
@@ -4705,6 +4705,7 @@ static NTSTATUS nfs41_Flush(
 static NTSTATUS nfs41_DeallocateForFcb(
     IN OUT PMRX_FCB pFcb)
 {
+    nfs41_remove_fcb_entry(pFcb);
     return STATUS_SUCCESS;
 }

@@ -7508,11 +7509,6 @@ VOID fcbopen_main(PVOID ctx)
 #endif
             if (cur->skip) goto out;

-#ifdef NFS41_DRIVER_STABILITY_HACKS
-            /* FIXME: Why ? */
-            if (!cur->nfs41_fobx->sec_ctx.ClientToken)
-                goto out;
-#endif /* NFS41_DRIVER_STABILITY_HACKS */
             pNetRootContext =
                 NFS41GetNetRootExtension(cur->fcb->pNetRoot);
             /* place an upcall for this srv_open */
--
2.45.1