OPENAFS-SA-2016-002 AFSStoreStatus information leak
[openafs.git] / src / WINNT / afsd / cm_dcache.c
index 96e5dd6..cd73158 100644 (file)
@@ -34,11 +34,6 @@ extern osi_mutex_t cm_Freelance_Lock;
 
 #define USE_RX_IOVEC 1
 
-/* we can access connp->serverp without holding a lock because that
-   never changes since the connection is made. */
-#define SERVERHAS64BIT(connp) (!((connp)->serverp->flags & CM_SERVERFLAG_NO64BIT))
-#define SET_SERVERHASNO64BIT(connp) (cm_SetServerNo64Bit((connp)->serverp, TRUE))
-
 /* functions called back from the buffer package when reading or writing data,
  * or when holding or releasing a vnode pointer.
  */
@@ -50,7 +45,7 @@ long cm_BufWrite(void *vscp, osi_hyper_t *offsetp, long length, long flags,
      * but the vnode involved may or may not be locked depending on whether
      * or not the CM_BUF_WRITE_SCP_LOCKED flag is set.
      */
-    long code, code1;
+    long code;
     cm_scache_t *scp = vscp;
     afs_int32 nbytes;
     afs_int32 save_nbytes;
@@ -362,20 +357,17 @@ long cm_BufWrite(void *vscp, osi_hyper_t *offsetp, long length, long flags,
             }
         }
 
-        code1 = rx_EndCall(rxcallp, code);
+        /* Prefer rx_EndCall error over StoreData error. Note that this will
+        * never set 'code' to 0 if we passed in a non-zero code. */
+        code = rx_EndCall(rxcallp, code);
 
-        if ((code == RXGEN_OPCODE || code1 == RXGEN_OPCODE) && SERVERHAS64BIT(connp)) {
+        if (code == RXGEN_OPCODE && SERVERHAS64BIT(connp)) {
             SET_SERVERHASNO64BIT(connp);
             qdp = NULL;
             nbytes = save_nbytes;
             goto retry;
         }
-        /* Prefer rx_EndCall error over StoreData error */
-        if (code1 != 0) {
-            osi_Log2(afsd_logp, "rx_EndCall converted 0x%x to 0x%x", code, code1);
-            code = code1;
-        }
-    } while (cm_Analyze(connp, userp, reqp, &scp->fid, 1, &volSync, NULL, NULL, code));
+    } while (cm_Analyze(connp, userp, reqp, &scp->fid, NULL, 1, &outStatus, &volSync, NULL, NULL, code));
 
     code = cm_MapRPCError(code, reqp);
 
@@ -418,7 +410,7 @@ long cm_BufWrite(void *vscp, osi_hyper_t *offsetp, long length, long flags,
         if (LargeIntegerGreaterThanOrEqualTo(t, scp->length))
             _InterlockedAnd(&scp->mask, ~CM_SCACHEMASK_LENGTH);
 
-        cm_MergeStatus(NULL, scp, &outStatus, &volSync, userp, reqp, CM_MERGEFLAG_STOREDATA);
+        code = cm_MergeStatus(NULL, scp, &outStatus, &volSync, userp, reqp, CM_MERGEFLAG_STOREDATA);
     } else {
         InterlockedDecrement(&scp->activeRPCs);
         if (code == CM_ERROR_SPACE)
@@ -459,7 +451,7 @@ long cm_StoreMini(cm_scache_t *scp, cm_user_t *userp, cm_req_t *reqp)
     AFSStoreStatus inStatus;
     AFSVolSync volSync;
     AFSFid tfid;
-    long code, code1;
+    long code;
     osi_hyper_t truncPos;
     cm_conn_t *connp;
     struct rx_call *rxcallp;
@@ -468,6 +460,7 @@ long cm_StoreMini(cm_scache_t *scp, cm_user_t *userp, cm_req_t *reqp)
     int call_was_64bit = 0;
 
     memset(&volSync, 0, sizeof(volSync));
+    memset(&inStatus, 0, sizeof(inStatus);
 
     osi_Log2(afsd_logp, "cm_StoreMini scp 0x%p userp 0x%p", scp, userp);
 
@@ -554,17 +547,13 @@ long cm_StoreMini(cm_scache_t *scp, cm_user_t *userp, cm_req_t *reqp)
                    osi_Log0(afsd_logp, "EndRXAFS_StoreData SUCCESS");
             }
         }
-        code1 = rx_EndCall(rxcallp, code);
+        code = rx_EndCall(rxcallp, code);
 
-        if ((code == RXGEN_OPCODE || code1 == RXGEN_OPCODE) && SERVERHAS64BIT(connp)) {
+        if (code == RXGEN_OPCODE && SERVERHAS64BIT(connp)) {
             SET_SERVERHASNO64BIT(connp);
             goto retry;
         }
-
-        /* prefer StoreData error over rx_EndCall error */
-        if (code == 0 && code1 != 0)
-            code = code1;
-    } while (cm_Analyze(connp, userp, reqp, &scp->fid, 1, &volSync, NULL, NULL, code));
+    } while (cm_Analyze(connp, userp, reqp, &scp->fid, NULL, 1, &outStatus, &volSync, NULL, NULL, code));
     code = cm_MapRPCError(code, reqp);
 
     /* now, clean up our state */
@@ -585,7 +574,7 @@ long cm_StoreMini(cm_scache_t *scp, cm_user_t *userp, cm_req_t *reqp)
 
         if (LargeIntegerGreaterThanOrEqualTo(t, scp->length))
             _InterlockedAnd(&scp->mask, ~CM_SCACHEMASK_LENGTH);
-        cm_MergeStatus(NULL, scp, &outStatus, &volSync, userp, reqp, CM_MERGEFLAG_STOREDATA);
+        code = cm_MergeStatus(NULL, scp, &outStatus, &volSync, userp, reqp, CM_MERGEFLAG_STOREDATA);
     } else {
         InterlockedDecrement(&scp->activeRPCs);
     }
@@ -778,29 +767,30 @@ cm_CheckFetchRange(cm_scache_t *scp, osi_hyper_t *startBasep, osi_hyper_t *lengt
 }
 
 afs_int32
-cm_BkgStore(cm_scache_t *scp, afs_uint32 p1, afs_uint32 p2, afs_uint32 p3, afs_uint32 p4,
-           cm_user_t *userp, cm_req_t *reqp)
+cm_BkgStore(cm_scache_t *scp, void *rockp, cm_user_t *userp, cm_req_t *reqp)
 {
     osi_hyper_t toffset;
-    long length;
+    afs_uint32 length;
     long code = 0;
     afs_uint32 req_flags = reqp->flags;
 
+    toffset = ((rock_BkgStore_t *)rockp)->offset;
+    length = ((rock_BkgStore_t *)rockp)->length;
+
     if (scp->flags & CM_SCACHEFLAG_DELETED) {
-       osi_Log4(afsd_logp, "Skipping BKG store - Deleted scp 0x%p, offset 0x%x:%08x, length 0x%x", scp, p2, p1, p3);
+       osi_Log4(afsd_logp, "Skipping BKG store - Deleted scp 0x%p, offset 0x%x:%08x, length 0x%x",
+                 scp, toffset.HighPart, toffset.LowPart, length);
     } else {
        /* Retries will be performed by the BkgDaemon thread if appropriate */
        reqp->flags |= CM_REQ_NORETRY;
 
-       toffset.LowPart = p1;
-       toffset.HighPart = p2;
-       length = p3;
-
-       osi_Log4(afsd_logp, "Starting BKG store scp 0x%p, offset 0x%x:%08x, length 0x%x", scp, p2, p1, p3);
+       osi_Log4(afsd_logp, "Starting BKG store scp 0x%p, offset 0x%x:%08x, length 0x%x",
+                 scp, toffset.HighPart, toffset.LowPart, length);
 
        code = cm_BufWrite(scp, &toffset, length, /* flags */ 0, userp, reqp);
 
-       osi_Log4(afsd_logp, "Finished BKG store scp 0x%p, offset 0x%x:%08x, code 0x%x", scp, p2, p1, code);
+       osi_Log5(afsd_logp, "Finished BKG store scp 0x%p, offset 0x%x:%08x, length 0x%x, code 0x%x",
+                 scp, toffset.HighPart, toffset.LowPart, length, code);
 
         reqp->flags = req_flags;
     }
@@ -846,8 +836,7 @@ void cm_ClearPrefetchFlag(long code, cm_scache_t *scp, osi_hyper_t *base, osi_hy
 /* do the prefetch.  if the prefetch fails, return 0 (success)
  * because there is no harm done.  */
 afs_int32
-cm_BkgPrefetch(cm_scache_t *scp, afs_uint32 p1, afs_uint32 p2, afs_uint32 p3, afs_uint32 p4,
-              cm_user_t *userp, cm_req_t *reqp)
+cm_BkgPrefetch(cm_scache_t *scp, void *rockp, cm_user_t *userp, cm_req_t *reqp)
 {
     osi_hyper_t length;
     osi_hyper_t base;
@@ -867,15 +856,13 @@ cm_BkgPrefetch(cm_scache_t *scp, afs_uint32 p1, afs_uint32 p2, afs_uint32 p3, af
     fetched.LowPart = 0;
     fetched.HighPart = 0;
     tblocksize = ConvertLongToLargeInteger(cm_data.buf_blockSize);
-    base.LowPart = p1;
-    base.HighPart = p2;
-    length.LowPart = p3;
-    length.HighPart = p4;
+    base = ((rock_BkgFetch_t *)rockp)->base;
+    length = ((rock_BkgFetch_t *)rockp)->length;
 
     end = LargeIntegerAdd(base, length);
 
     osi_Log5(afsd_logp, "Starting BKG prefetch scp 0x%p offset 0x%x:%x length 0x%x:%x",
-             scp, p2, p1, p4, p3);
+             scp, base.HighPart, base.LowPart, length.HighPart, length.LowPart);
 
     for ( code = 0, offset = base;
           code == 0 && LargeIntegerLessThan(offset, end);
@@ -886,7 +873,7 @@ cm_BkgPrefetch(cm_scache_t *scp, afs_uint32 p1, afs_uint32 p2, afs_uint32 p3, af
             rxheld = 0;
         }
 
-        code = buf_Get(scp, &offset, reqp, &bp);
+        code = buf_Get(scp, &offset, reqp, 0, &bp);
         if (code)
             break;
 
@@ -921,7 +908,7 @@ cm_BkgPrefetch(cm_scache_t *scp, afs_uint32 p1, afs_uint32 p2, afs_uint32 p3, af
                          scp, &base, &fetched);
 
     /* wakeup anyone who is waiting */
-    if (scp->flags & CM_SCACHEFLAG_WAITING) {
+    if (!osi_QIsEmpty(&scp->waitQueueH)) {
         osi_Log1(afsd_logp, "CM BkgPrefetch Waking scp 0x%p", scp);
         osi_Wakeup((LONG_PTR) &scp->flags);
     }
@@ -947,6 +934,7 @@ void cm_ConsiderPrefetch(cm_scache_t *scp, osi_hyper_t *offsetp, afs_uint32 coun
     osi_hyper_t readLength;
     osi_hyper_t readEnd;
     osi_hyper_t tblocksize;            /* a long long temp variable */
+    rock_BkgFetch_t *rockp;
 
     tblocksize = ConvertLongToLargeInteger(cm_data.buf_blockSize);
 
@@ -988,10 +976,16 @@ void cm_ConsiderPrefetch(cm_scache_t *scp, osi_hyper_t *offsetp, afs_uint32 coun
     osi_Log2(afsd_logp, "BKG Prefetch request scp 0x%p, base 0x%x",
              scp, realBase.LowPart);
 
-    cm_QueueBKGRequest(scp, cm_BkgPrefetch,
-                       realBase.LowPart, realBase.HighPart,
-                       readLength.LowPart, readLength.HighPart,
-                       userp, reqp);
+    rockp = malloc(sizeof(*rockp));
+    if (rockp == NULL) {
+        return;        /* can't proceed without a rock */
+    }
+
+    rockp->base = realBase;
+    rockp->length = readLength;
+
+    /* cm_BkgDaemon frees the rock */
+    cm_QueueBKGRequest(scp, cm_BkgPrefetch, rockp, userp, reqp);
 }
 
 /* scp must be locked; temporarily unlocked during processing.
@@ -1015,9 +1009,13 @@ long cm_SetupStoreBIOD(cm_scache_t *scp, osi_hyper_t *inOffsetp, long inSize,
     osi_hyper_t scanStart;             /* where to start scan for dirty pages */
     osi_hyper_t scanEnd;               /* where to stop scan for dirty pages */
     osi_hyper_t firstModOffset;        /* offset of first modified page in range */
+    osi_hyper_t tblocksize;
     long temp;
     long code;
     long flags;                        /* flags to cm_SyncOp */
+    int blockSize = cm_data.blockSize; /* need a signed version */
+
+    tblocksize = ConvertLongToLargeInteger(cm_data.buf_blockSize);
 
     /* clear things out */
     biop->scp = scp;                   /* do not hold; held by caller */
@@ -1031,11 +1029,12 @@ long cm_SetupStoreBIOD(cm_scache_t *scp, osi_hyper_t *inOffsetp, long inSize,
 
     /* reserve a chunk's worth of buffers */
     lock_ReleaseWrite(&scp->rw);
-    buf_ReserveBuffers(cm_chunkSize / cm_data.buf_blockSize);
+    biop->reserved = (cm_chunkSize / blockSize);
+    buf_ReserveBuffers(biop->reserved);
     lock_ObtainWrite(&scp->rw);
 
     bufp = NULL;
-    for (temp = 0; temp < inSize; temp += cm_data.buf_blockSize) {
+    for (temp = 0; temp < inSize; temp += blockSize) {
         thyper = ConvertLongToLargeInteger(temp);
         tbase = LargeIntegerAdd(*inOffsetp, thyper);
 
@@ -1059,7 +1058,7 @@ long cm_SetupStoreBIOD(cm_scache_t *scp, osi_hyper_t *inOffsetp, long inSize,
                 lock_ReleaseMutex(&bufp->mx);
                 buf_Release(bufp);
                 bufp = NULL;
-                buf_UnreserveBuffers(cm_chunkSize / cm_data.buf_blockSize);
+               buf_UnreserveBuffers(cm_chunkSize / blockSize);
                 return code;
             }
 
@@ -1079,8 +1078,6 @@ long cm_SetupStoreBIOD(cm_scache_t *scp, osi_hyper_t *inOffsetp, long inSize,
         }
     }
 
-    biop->reserved = 1;
-
     /* if we get here, if bufp is null, we didn't find any dirty buffers
      * that weren't already being stored back, so we just quit now.
      */
@@ -1102,7 +1099,7 @@ long cm_SetupStoreBIOD(cm_scache_t *scp, osi_hyper_t *inOffsetp, long inSize,
     osi_QAddH((osi_queue_t **) &biop->bufListp,
               (osi_queue_t **) &biop->bufListEndp,
               &qdp->q);
-    biop->length = cm_data.buf_blockSize;
+    biop->length = blockSize;
     firstModOffset = bufp->offset;
     biop->offset = firstModOffset;
     bufp = NULL;       /* this buffer and reference added to the queue */
@@ -1113,14 +1110,25 @@ long cm_SetupStoreBIOD(cm_scache_t *scp, osi_hyper_t *inOffsetp, long inSize,
     thyper = ConvertLongToLargeInteger(cm_chunkSize);
     scanEnd = LargeIntegerAdd(scanStart, thyper);
 
+    /* do not scan beyond the end of the file */
+    if (scanEnd.QuadPart > scp->length.QuadPart) {
+       scanEnd = scp->length;
+       scanEnd.LowPart &= (-blockSize);
+       if (scanEnd.LowPart < scp->length.LowPart)
+           scanEnd.LowPart += blockSize;
+    }
+
+    /* do not leave out a requested portion of the range */
+    if (scanEnd.QuadPart < inOffsetp->QuadPart + inSize) {
+       scanEnd.QuadPart = inOffsetp->QuadPart + inSize;
+    }
+
     flags = CM_SCACHESYNC_GETSTATUS
         | CM_SCACHESYNC_STOREDATA
         | CM_SCACHESYNC_BUFLOCKED;
 
     /* start by looking backwards until scanStart */
-    /* hyper version of cm_data.buf_blockSize */
-    thyper = ConvertLongToLargeInteger(cm_data.buf_blockSize);
-    tbase = LargeIntegerSubtract(firstModOffset, thyper);
+    tbase = LargeIntegerSubtract(firstModOffset, tblocksize);
     while(LargeIntegerGreaterThanOrEqualTo(tbase, scanStart)) {
         /* see if we can find the buffer */
         bufp = buf_Find(&scp->fid, &tbase);
@@ -1174,17 +1182,15 @@ long cm_SetupStoreBIOD(cm_scache_t *scp, osi_hyper_t *inOffsetp, long inSize,
        bufp = NULL;            /* added to the queue */
 
         /* update biod info describing the transfer */
-        biop->offset = LargeIntegerSubtract(biop->offset, thyper);
-        biop->length += cm_data.buf_blockSize;
+       biop->offset = LargeIntegerSubtract(biop->offset, tblocksize);
+       biop->length += blockSize;
 
         /* update loop pointer */
-        tbase = LargeIntegerSubtract(tbase, thyper);
+       tbase = LargeIntegerSubtract(tbase, tblocksize);
     }  /* while loop looking for pages preceding the one we found */
 
     /* now, find later dirty, contiguous pages, and add them to the list */
-    /* hyper version of cm_data.buf_blockSize */
-    thyper = ConvertLongToLargeInteger(cm_data.buf_blockSize);
-    tbase = LargeIntegerAdd(firstModOffset, thyper);
+    tbase = LargeIntegerAdd(firstModOffset, tblocksize);
     while(LargeIntegerLessThan(tbase, scanEnd)) {
         /* see if we can find the buffer */
         bufp = buf_Find(&scp->fid, &tbase);
@@ -1238,10 +1244,10 @@ long cm_SetupStoreBIOD(cm_scache_t *scp, osi_hyper_t *inOffsetp, long inSize,
        bufp = NULL;
 
         /* update biod info describing the transfer */
-        biop->length += cm_data.buf_blockSize;
+       biop->length += blockSize;
 
         /* update loop pointer */
-        tbase = LargeIntegerAdd(tbase, thyper);
+       tbase = LargeIntegerAdd(tbase, tblocksize);
     }  /* while loop looking for pages following the first page we found */
 
     /* finally, we're done */
@@ -1268,7 +1274,7 @@ long cm_SetupFetchBIOD(cm_scache_t *scp, osi_hyper_t *offsetp,
     osi_hyper_t fileSize;              /* the # of bytes in the file */
     osi_queueData_t *heldBufListp;     /* we hold all buffers in this list */
     osi_queueData_t *heldBufListEndp;  /* first one */
-    int reserving;
+    afs_uint64 reserving;
 
     tblocksize = ConvertLongToLargeInteger(cm_data.buf_blockSize);
 
@@ -1325,7 +1331,7 @@ long cm_SetupFetchBIOD(cm_scache_t *scp, osi_hyper_t *offsetp,
         if (LargeIntegerGreaterThanOrEqualTo(pageBase, fileSize))
             break;
 
-        code = buf_Get(scp, &pageBase, reqp, &tbp);
+        code = buf_Get(scp, &pageBase, reqp, 0, &tbp);
         if (code) {
             lock_ObtainWrite(&scp->rw);
             cm_SyncOpDone(scp, NULL, CM_SCACHESYNC_NEEDCALLBACK | CM_SCACHESYNC_GETSTATUS);
@@ -1490,7 +1496,7 @@ void cm_ReleaseBIOD(cm_bulkIO_t *biop, int isStore, long code, int scp_locked)
 
     /* Give back reserved buffers */
     if (biop->reserved)
-        buf_UnreserveBuffers(cm_chunkSize / cm_data.buf_blockSize);
+        buf_UnreserveBuffers(biop->reserved);
 
     if (isStore)
         flags = CM_SCACHESYNC_STOREDATA;
@@ -1534,12 +1540,14 @@ void cm_ReleaseBIOD(cm_bulkIO_t *biop, int isStore, long code, int scp_locked)
                     case CM_ERROR_TOOBIG:
                     case CM_ERROR_READONLY:
                     case CM_ERROR_NOSUCHPATH:
+                    case EIO:
+                    case CM_ERROR_INVAL_NET_RESP:
+                    case CM_ERROR_UNKNOWN:
                         /*
                          * Apply the fatal error to this buffer.
                          */
                         _InterlockedAnd(&bufp->flags, ~CM_BUF_DIRTY);
                         _InterlockedOr(&bufp->flags, CM_BUF_ERROR);
-                        bufp->dirty_offset = 0;
                         bufp->dirty_length = 0;
                         bufp->error = code;
                         bufp->dataVersion = CM_BUF_VERSION_BAD;
@@ -1647,11 +1655,11 @@ cm_CloneStatus(cm_scache_t *scp, cm_user_t *userp, int scp_locked,
 long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp,
                   cm_req_t *reqp)
 {
-    long code=0, code1=0;
+    long code=0;
     afs_uint32 nbytes;                 /* bytes in transfer */
     afs_uint32 nbytes_hi = 0;            /* high-order 32 bits of bytes in transfer */
     afs_uint64 length_found = 0;
-    long rbytes;                       /* bytes in rx_Read call */
+    long rxbytes;                      /* bytes in rx_Read call */
     long temp;
     AFSFetchStatus afsStatus;
     AFSCallBack callback;
@@ -1673,6 +1681,8 @@ long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp
     int first_read = 1;
     int scp_locked = 1;
 
+    memset(&afsStatus, 0, sizeof(afsStatus));
+    memset(&callback, 0, sizeof(callback));
     memset(&volSync, 0, sizeof(volSync));
 
     /* now, the buffer may or may not be filled with good data (buf_GetNewLocked
@@ -1701,7 +1711,7 @@ long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp
     code = cm_SetupFetchBIOD(scp, &bufp->offset, &biod, userp, reqp);
     if (code) {
         /* couldn't even get the first page setup properly */
-        osi_Log1(afsd_logp, "GetBuffer: SetupFetchBIOD failure code %d", code);
+        osi_Log1(afsd_logp, "cm_GetBuffer: SetupFetchBIOD failure code %d", code);
         return code;
     }
 
@@ -1712,26 +1722,49 @@ long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp
      * We can lose a race condition and end up with biod.length zero, in
      * which case we just retry.
      */
-    if (bufp->dataVersion <= scp->dataVersion && bufp->dataVersion >= scp->bufDataVersionLow || biod.length == 0) {
-        if ((bufp->dataVersion == CM_BUF_VERSION_BAD || bufp->dataVersion < scp->bufDataVersionLow) &&
-             LargeIntegerGreaterThanOrEqualTo(bufp->offset, scp->serverLength))
-        {
-            osi_Log4(afsd_logp, "Bad DVs 0x%x != (0x%x -> 0x%x) or length 0x%x",
-                     bufp->dataVersion, scp->bufDataVersionLow, scp->dataVersion, biod.length);
 
-            if (bufp->dataVersion == CM_BUF_VERSION_BAD)
-                memset(bufp->datap, 0, cm_data.buf_blockSize);
-            bufp->dataVersion = scp->dataVersion;
+    if (bufp->dataVersion <= scp->dataVersion && bufp->dataVersion >= scp->bufDataVersionLow) {
+        /* We obtained the buffer while we were waiting */
+        goto release_biod;
+    }
+
+    if (biod.length == 0) {
+        osi_Log2(afsd_logp, "cm_GetBuffer BIOD length 0 scp 0x%p bufp 0x%p",
+                 scp, bufp);
+        goto release_biod;
+    }
+
+    /* Check for buffers we can fill locally */
+    for (qdp = biod.bufListEndp;
+          qdp;
+          qdp = (osi_queueData_t *) osi_QPrev(&qdp->q)) {
+        tbufp = osi_GetQData(qdp);
+
+        if ( tbufp->dataVersion == CM_BUF_VERSION_BAD ||
+             tbufp->dataVersion < scp->bufDataVersionLow ||
+             tbufp->dataVersion > scp->dataVersion) {
+
+            osi_Log4(afsd_logp, "cm_GetBuffer bufp 0x%p DVs 0x%x != (0x%x -> 0x%x)",
+                     tbufp, tbufp->dataVersion, scp->bufDataVersionLow, scp->dataVersion);
+
+            if (LargeIntegerGreaterThanOrEqualTo(tbufp->offset, scp->length))
+            {
+                if (tbufp->dataVersion == CM_BUF_VERSION_BAD)
+                    memset(tbufp->datap, 0, cm_data.buf_blockSize);
+                tbufp->dataVersion = scp->dataVersion;
+            }
+
+            if ((scp->mask & CM_SCACHEMASK_TRUNCPOS) &&
+                 LargeIntegerGreaterThanOrEqualTo(tbufp->offset, scp->truncPos)) {
+                memset(tbufp->datap, 0, cm_data.buf_blockSize);
+                tbufp->dataVersion = scp->dataVersion;
+            }
         }
-        cm_ReleaseBIOD(&biod, 0, 0, 1);
-        return 0;
-    } else if ((bufp->dataVersion == CM_BUF_VERSION_BAD || bufp->dataVersion < scp->bufDataVersionLow)
-                && (scp->mask & CM_SCACHEMASK_TRUNCPOS) &&
-                LargeIntegerGreaterThanOrEqualTo(bufp->offset, scp->truncPos)) {
-        memset(bufp->datap, 0, cm_data.buf_blockSize);
-        bufp->dataVersion = scp->dataVersion;
-        cm_ReleaseBIOD(&biod, 0, 0, 1);
-        return 0;
+    }
+
+    if (bufp->dataVersion <= scp->dataVersion && bufp->dataVersion >= scp->bufDataVersionLow) {
+        /* We locally populated the buffer we wanted */
+        goto release_biod;
     }
 
     InterlockedIncrement(&scp->activeRPCs);
@@ -1822,7 +1855,8 @@ long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp
      * the network round trip by allocating zeroed buffers and
      * faking the status info.
      */
-    if (biod.offset.QuadPart >= scp->length.QuadPart) {
+    if (biod.offset.QuadPart >= scp->serverLength.QuadPart ||
+        ((scp->mask & CM_SCACHEMASK_TRUNCPOS) && biod.offset.QuadPart > scp->truncPos.QuadPart)) {
         osi_Log5(afsd_logp, "SKIP FetchData64 scp 0x%p, off 0x%x:%08x > length 0x%x:%08x",
                  scp, biod.offset.HighPart, biod.offset.LowPart,
                  scp->length.HighPart, scp->length.LowPart);
@@ -1850,6 +1884,8 @@ long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp
 
     /* now make the call */
     do {
+       long code1;
+
         code = cm_ConnFromFID(&scp->fid, userp, reqp, &connp);
         if (code)
             continue;
@@ -1874,8 +1910,7 @@ long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp
                     nbytes_hi = ntohl(nbytes_hi);
                 } else {
                     nbytes_hi = 0;
-                   code = rx_Error(rxcallp);
-                    code1 = rx_EndCall(rxcallp, code);
+                    code = rx_EndCall(rxcallp, RX_PROTOCOL_ERROR);
                     rxcallp = NULL;
                 }
             }
@@ -1961,18 +1996,20 @@ long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp
                      * length_found and continue as if the file server said
                      * it was sending us zero octets of data.
                      */
-                    if (fs_fetchdata_offset_bug && first_read)
+                    if (fs_fetchdata_offset_bug && first_read) {
                         length_found = 0;
-                    else
+                        break;
+                    } else if (temp <= 0) {
                         code = (rx_Error(rxcallp) < 0) ? rx_Error(rxcallp) : RX_PROTOCOL_ERROR;
-                    break;
+                        break;
+                    }
                 }
 
                 iov = 0;
                 iov_offset = 0;
-                rbytes = temp;
+                rxbytes = temp;
 
-                while (rbytes > 0) {
+                while (rxbytes > 0) {
                     afs_int32 len;
 
                     osi_assertx(bufferp != NULL, "null cm_buf_t");
@@ -1981,7 +2018,7 @@ long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp
                     memcpy(bufferp + buffer_offset, tiov[iov].iov_base + iov_offset, len);
                     iov_offset += len;
                     buffer_offset += len;
-                    rbytes -= len;
+                    rxbytes -= len;
 
                     if (iov_offset == tiov[iov].iov_len) {
                         iov++;
@@ -1996,7 +2033,7 @@ long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp
                         */
                         _InterlockedOr(&tbufp->cmFlags, CM_BUF_CMFULLYFETCHED);
                         lock_ObtainWrite(&scp->rw);
-                        if (scp->flags & CM_SCACHEFLAG_WAITING) {
+                        if (!osi_QIsEmpty(&scp->waitQueueH)) {
                             osi_Log1(afsd_logp, "CM GetBuffer Waking scp 0x%p", scp);
                             osi_Wakeup((LONG_PTR) &scp->flags);
                         }
@@ -2027,10 +2064,10 @@ long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp
                  */
                 osi_assertx(bufferp != NULL, "null cm_buf_t");
 
-                /* read rbytes of data */
-                rbytes = (afs_uint32)(length_found > cm_data.buf_blockSize ? cm_data.buf_blockSize : length_found);
-                temp = rx_Read(rxcallp, bufferp, rbytes);
-                if (temp < rbytes) {
+                /* read rxbytes of data */
+                rxbytes = (afs_uint32)(length_found > cm_data.buf_blockSize ? cm_data.buf_blockSize : length_found);
+                temp = rx_Read(rxcallp, bufferp, rxbytes);
+                if (temp < rxbytes) {
                     /*
                      * If the file server returned (filesize - offset),
                      * then the first rx_Read will return zero octets of data.
@@ -2038,11 +2075,13 @@ long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp
                      * length_found and continue as if the file server said
                      * it was sending us zero octets of data.
                      */
-                    if (fs_fetchdata_offset_bug && first_read)
+                    if (fs_fetchdata_offset_bug && first_read) {
                         length_found = 0;
-                    else
+                        break;
+                    } else if (temp <= 0) {
                         code = (rx_Error(rxcallp) < 0) ? rx_Error(rxcallp) : RX_PROTOCOL_ERROR;
-                    break;
+                        break;
+                    }
                 }
                 first_read = 0;
 
@@ -2053,7 +2092,7 @@ long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp
                  */
                 _InterlockedOr(&tbufp->cmFlags, CM_BUF_CMFULLYFETCHED);
                 lock_ObtainWrite(&scp->rw);
-                if (scp->flags & CM_SCACHEFLAG_WAITING) {
+                if (!osi_QIsEmpty(&scp->waitQueueH)) {
                     osi_Log1(afsd_logp, "CM GetBuffer Waking scp 0x%p", scp);
                     osi_Wakeup((LONG_PTR) &scp->flags);
                 }
@@ -2088,26 +2127,26 @@ long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp
              * all of the rest of the pages.
              */
 #ifdef USE_RX_IOVEC
-            rbytes = cm_data.buf_blockSize - buffer_offset;
+            rxbytes = cm_data.buf_blockSize - buffer_offset;
             bufferp = tbufp->datap + buffer_offset;
 #else /* USE_RX_IOVEC */
             /* bytes fetched */
            osi_assertx((bufferp - tbufp->datap) < LONG_MAX, "data >= LONG_MAX");
-            rbytes = (long) (bufferp - tbufp->datap);
+            rxbytes = (long) (bufferp - tbufp->datap);
 
             /* bytes left to zero */
-            rbytes = cm_data.buf_blockSize - rbytes;
+            rxbytes = cm_data.buf_blockSize - rxbytes;
 #endif /* USE_RX_IOVEC */
             while(qdp) {
-                if (rbytes != 0)
-                    memset(bufferp, 0, rbytes);
+                if (rxbytes != 0)
+                    memset(bufferp, 0, rxbytes);
                 qdp = (osi_queueData_t *) osi_QPrev(&qdp->q);
                 if (qdp == NULL)
                     break;
                 tbufp = osi_GetQData(qdp);
                 bufferp = tbufp->datap;
                 /* bytes to clear in this page */
-                rbytes = cm_data.buf_blockSize;
+                rxbytes = cm_data.buf_blockSize;
             }
         }
 
@@ -2123,6 +2162,7 @@ long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp
                 osi_Log1(afsd_logp, "CALL EndRXAFS_FetchData skipped due to error %d", code);
         }
 
+        code1 = code;
         if (rxcallp)
             code1 = rx_EndCall(rxcallp, code);
 
@@ -2138,12 +2178,13 @@ long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp
                 scp_locked = 0;
             }
             code = 0;
-        /* Prefer the error value from FetchData over rx_EndCall */
-        } else if (code == 0 && code1 != 0)
+        } else {
+           /* Prefer the error from rx_EndCall over any other error */
             code = code1;
+       }
         osi_Log0(afsd_logp, "CALL FetchData DONE");
 
-    } while (cm_Analyze(connp, userp, reqp, &scp->fid, 0, &volSync, NULL, NULL, code));
+    } while (cm_Analyze(connp, userp, reqp, &scp->fid, NULL, 0, &afsStatus, &volSync, NULL, NULL, code));
 
   fetchingcompleted:
     code = cm_MapRPCError(code, reqp);
@@ -2174,10 +2215,11 @@ long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp
     }
 
     if (code == 0)
-        cm_MergeStatus(NULL, scp, &afsStatus, &volSync, userp, reqp, CM_MERGEFLAG_FETCHDATA);
+        code = cm_MergeStatus(NULL, scp, &afsStatus, &volSync, userp, reqp, CM_MERGEFLAG_FETCHDATA);
     else
         InterlockedDecrement(&scp->activeRPCs);
 
+  release_biod:
     /* release scatter/gather I/O structure (buffers, locks) */
     cm_ReleaseBIOD(&biod, 0, code, 1);
 
@@ -2190,15 +2232,15 @@ long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp
  * a provided buffer.  Called with scp locked. The scp is locked on return.
  */
 long cm_GetData(cm_scache_t *scp, osi_hyper_t *offsetp, char *datap, int data_length,
-                cm_user_t *userp, cm_req_t *reqp)
+                int * bytes_readp, cm_user_t *userp, cm_req_t *reqp)
 {
-    long code=0, code1=0;
+    long code=0;
     afs_uint32 nbytes;                 /* bytes in transfer */
     afs_uint32 nbytes_hi = 0;           /* high-order 32 bits of bytes in transfer */
     afs_uint64 length_found = 0;
     char *bufferp = datap;
     afs_uint32 buffer_offset = 0;
-    long rbytes;                       /* bytes in rx_Read call */
+    long rxbytes;                      /* bytes in rx_Read call */
     long temp;
     AFSFetchStatus afsStatus;
     AFSCallBack callback;
@@ -2215,6 +2257,11 @@ long cm_GetData(cm_scache_t *scp, osi_hyper_t *offsetp, char *datap, int data_le
     int first_read = 1;
     int scp_locked = 1;
 
+    if (bytes_readp)
+        *bytes_readp = 0;
+
+    memset(&afsStatus, 0, sizeof(afsStatus));
+    memset(&callback, 0, sizeof(callback));
     memset(&volSync, 0, sizeof(volSync));
 
     /* now, the buffer may or may not be filled with good data (buf_GetNewLocked
@@ -2306,6 +2353,8 @@ long cm_GetData(cm_scache_t *scp, osi_hyper_t *offsetp, char *datap, int data_le
 
     /* now make the call */
     do {
+       long code1;
+
         code = cm_ConnFromFID(&scp->fid, userp, reqp, &connp);
         if (code)
             continue;
@@ -2330,8 +2379,7 @@ long cm_GetData(cm_scache_t *scp, osi_hyper_t *offsetp, char *datap, int data_le
                     nbytes_hi = ntohl(nbytes_hi);
                 } else {
                     nbytes_hi = 0;
-                   code = rx_Error(rxcallp);
-                    code1 = rx_EndCall(rxcallp, code);
+                    code = rx_EndCall(rxcallp, RX_PROTOCOL_ERROR);
                     rxcallp = NULL;
                 }
             }
@@ -2407,18 +2455,20 @@ long cm_GetData(cm_scache_t *scp, osi_hyper_t *offsetp, char *datap, int data_le
                      * length_found and continue as if the file server said
                      * it was sending us zero octets of data.
                      */
-                    if (fs_fetchdata_offset_bug && first_read)
+                    if (fs_fetchdata_offset_bug && first_read) {
                         length_found = 0;
-                    else
+                        break;
+                    } else if (temp <= 0) {
                         code = (rx_Error(rxcallp) < 0) ? rx_Error(rxcallp) : RX_PROTOCOL_ERROR;
-                    break;
+                        break;
+                    }
                 }
 
                 iov = 0;
                 iov_offset = 0;
-                rbytes = temp;
+                rxbytes = temp;
 
-                while (rbytes > 0) {
+                while (rxbytes > 0) {
                     afs_int32 len;
 
                     osi_assertx(bufferp != NULL, "null cm_buf_t");
@@ -2427,7 +2477,7 @@ long cm_GetData(cm_scache_t *scp, osi_hyper_t *offsetp, char *datap, int data_le
                     memcpy(bufferp + buffer_offset, tiov[iov].iov_base + iov_offset, len);
                     iov_offset += len;
                     buffer_offset += len;
-                    rbytes -= len;
+                    rxbytes -= len;
 
                     if (iov_offset == tiov[iov].iov_len) {
                         iov++;
@@ -2443,10 +2493,10 @@ long cm_GetData(cm_scache_t *scp, osi_hyper_t *offsetp, char *datap, int data_le
                  */
                 osi_assertx(bufferp != NULL, "null cm_buf_t");
 
-                /* read rbytes of data */
-                rbytes = (afs_uint32)(length_found > data_length ? data_length : length_found);
-                temp = rx_Read(rxcallp, bufferp, rbytes);
-                if (temp < rbytes) {
+                /* read rxbytes of data */
+                rxbytes = (afs_uint32)(length_found > data_length ? data_length : length_found);
+                temp = rx_Read(rxcallp, bufferp, rxbytes);
+                if (temp < rxbytes) {
                     /*
                      * If the file server returned (filesize - offset),
                      * then the first rx_Read will return zero octets of data.
@@ -2454,11 +2504,13 @@ long cm_GetData(cm_scache_t *scp, osi_hyper_t *offsetp, char *datap, int data_le
                      * length_found and continue as if the file server said
                      * it was sending us zero octets of data.
                      */
-                    if (fs_fetchdata_offset_bug && first_read)
+                    if (fs_fetchdata_offset_bug && first_read) {
                         length_found = 0;
-                    else
+                        break;
+                    } else if (temp <= 0) {
                         code = (rx_Error(rxcallp) < 0) ? rx_Error(rxcallp) : RX_PROTOCOL_ERROR;
-                    break;
+                        break;
+                    }
                 }
                 first_read = 0;
 
@@ -2474,18 +2526,18 @@ long cm_GetData(cm_scache_t *scp, osi_hyper_t *offsetp, char *datap, int data_le
              * all of the rest of the pages.
              */
 #ifdef USE_RX_IOVEC
-            rbytes = data_length - buffer_offset;
+            rxbytes = data_length - buffer_offset;
             bufferp = datap + buffer_offset;
 #else /* USE_RX_IOVEC */
             /* bytes fetched */
            osi_assertx((bufferp - datap) < LONG_MAX, "data >= LONG_MAX");
-            rbytes = (long) (bufferp - datap);
+            rxbytes = (long) (bufferp - datap);
 
             /* bytes left to zero */
-            rbytes = data_length - rbytes;
+            rxbytes = data_length - rxbytes;
 #endif /* USE_RX_IOVEC */
-            if (rbytes != 0)
-                memset(bufferp, 0, rbytes);
+            if (rxbytes != 0)
+                memset(bufferp, 0, rxbytes);
         }
 
         if (code == 0) {
@@ -2500,6 +2552,7 @@ long cm_GetData(cm_scache_t *scp, osi_hyper_t *offsetp, char *datap, int data_le
                 osi_Log1(afsd_logp, "CALL EndRXAFS_FetchData skipped due to error %d", code);
         }
 
+       code1 = code;
         if (rxcallp)
             code1 = rx_EndCall(rxcallp, code);
 
@@ -2515,12 +2568,13 @@ long cm_GetData(cm_scache_t *scp, osi_hyper_t *offsetp, char *datap, int data_le
                 scp_locked = 0;
             }
             code = 0;
-        /* Prefer the error value from FetchData over rx_EndCall */
-        } else if (code == 0 && code1 != 0)
+        } else {
+           /* Prefer the error from rx_EndCall over any other error */
             code = code1;
+       }
         osi_Log0(afsd_logp, "CALL FetchData DONE");
 
-    } while (cm_Analyze(connp, userp, reqp, &scp->fid, 0, &volSync, NULL, NULL, code));
+    } while (cm_Analyze(connp, userp, reqp, &scp->fid, NULL, 0, &afsStatus, &volSync, NULL, NULL, code));
 
   fetchingcompleted:
     code = cm_MapRPCError(code, reqp);
@@ -2529,10 +2583,12 @@ long cm_GetData(cm_scache_t *scp, osi_hyper_t *offsetp, char *datap, int data_le
         lock_ObtainWrite(&scp->rw);
 
     if (code == 0)
-        cm_MergeStatus(NULL, scp, &afsStatus, &volSync, userp, reqp, CM_MERGEFLAG_FETCHDATA);
+        code = cm_MergeStatus(NULL, scp, &afsStatus, &volSync, userp, reqp, CM_MERGEFLAG_FETCHDATA);
     else
         InterlockedDecrement(&scp->activeRPCs);
 
+    *bytes_readp = (long) (bufferp - datap);
+
     return code;
 }
 
@@ -2545,11 +2601,11 @@ long cm_GetData(cm_scache_t *scp, osi_hyper_t *offsetp, char *datap, int data_le
 long
 cm_VerifyStoreData(cm_bulkIO_t *biod, cm_scache_t *savedScp)
 {
-    long code=0, code1=0;
+    long code=0;
     afs_uint32 nbytes;                 /* bytes in transfer */
     afs_uint32 nbytes_hi = 0;           /* high-order 32 bits of bytes in transfer */
     afs_uint64 length_found = 0;
-    long rbytes;                       /* bytes in rx_Read call */
+    long rxbytes;                      /* bytes in rx_Read call */
     long temp;
     AFSFetchStatus afsStatus;
     AFSCallBack callback;
@@ -2570,6 +2626,8 @@ cm_VerifyStoreData(cm_bulkIO_t *biod, cm_scache_t *savedScp)
     cm_req_t *reqp = biod->reqp;
     afs_uint64 dataVersion = scp->dataVersion;
 
+    memset(&afsStatus, 0, sizeof(afsStatus));
+    memset(&callback, 0, sizeof(callback));
     memset(&volSync, 0, sizeof(volSync));
     memset(bufferp, 0, biod->length);
 
@@ -2591,6 +2649,8 @@ cm_VerifyStoreData(cm_bulkIO_t *biod, cm_scache_t *savedScp)
 
     /* now make the call */
     do {
+       long code1;
+
         code = cm_ConnFromFID(&scp->fid, userp, reqp, &connp);
         if (code)
             continue;
@@ -2615,8 +2675,7 @@ cm_VerifyStoreData(cm_bulkIO_t *biod, cm_scache_t *savedScp)
                     nbytes_hi = ntohl(nbytes_hi);
                 } else {
                     nbytes_hi = 0;
-                   code = rx_Error(rxcallp);
-                    code1 = rx_EndCall(rxcallp, code);
+                    code = rx_EndCall(rxcallp, RX_PROTOCOL_ERROR);
                     rxcallp = NULL;
                 }
             }
@@ -2684,10 +2743,10 @@ cm_VerifyStoreData(cm_bulkIO_t *biod, cm_scache_t *savedScp)
                  */
                 osi_assertx(bufferp != NULL, "null cm_buf_t");
 
-                /* read rbytes of data */
-                rbytes = (afs_uint32)(length_found > biod->length ? biod->length : length_found);
-                temp = rx_Read(rxcallp, bufferp, rbytes);
-                if (temp < rbytes) {
+                /* read rxbytes of data */
+                rxbytes = (afs_uint32)(length_found > biod->length ? biod->length : length_found);
+                temp = rx_Read(rxcallp, bufferp, rxbytes);
+                if (temp < rxbytes) {
                     /*
                      * If the file server returned (filesize - offset),
                      * then the first rx_Read will return zero octets of data.
@@ -2695,11 +2754,13 @@ cm_VerifyStoreData(cm_bulkIO_t *biod, cm_scache_t *savedScp)
                      * length_found and continue as if the file server said
                      * it was sending us zero octets of data.
                      */
-                    if (fs_fetchdata_offset_bug && first_read)
+                    if (fs_fetchdata_offset_bug && first_read) {
                         length_found = 0;
-                    else
+                        break;
+                    } else if (temp <= 0) {
                         code = (rx_Error(rxcallp) < 0) ? rx_Error(rxcallp) : RX_PROTOCOL_ERROR;
-                    break;
+                        break;
+                    }
                 }
                 first_read = 0;
 
@@ -2720,6 +2781,7 @@ cm_VerifyStoreData(cm_bulkIO_t *biod, cm_scache_t *savedScp)
                 osi_Log1(afsd_logp, "CALL EndRXAFS_FetchData skipped due to error %d", code);
         }
 
+       code1 = code;
         if (rxcallp)
             code1 = rx_EndCall(rxcallp, code);
 
@@ -2735,12 +2797,13 @@ cm_VerifyStoreData(cm_bulkIO_t *biod, cm_scache_t *savedScp)
                 scp_locked = 0;
             }
             code = 0;
-        /* Prefer the error value from FetchData over rx_EndCall */
-        } else if (code == 0 && code1 != 0)
+        } else {
+           /* Prefer the error from rx_EndCall over any other error */
             code = code1;
+       }
         osi_Log0(afsd_logp, "CALL FetchData DONE");
 
-    } while (cm_Analyze(connp, userp, reqp, &scp->fid, 0, &volSync, NULL, NULL, code));
+    } while (cm_Analyze(connp, userp, reqp, &scp->fid, NULL, 0, &afsStatus, &volSync, NULL, NULL, code));
 
   fetchingcompleted:
     code = cm_MapRPCError(code, reqp);
@@ -2749,7 +2812,7 @@ cm_VerifyStoreData(cm_bulkIO_t *biod, cm_scache_t *savedScp)
         lock_ObtainWrite(&scp->rw);
 
     if (code == 0)
-        cm_MergeStatus(NULL, scp, &afsStatus, &volSync, userp, reqp, CM_MERGEFLAG_FETCHDATA);
+        code = cm_MergeStatus(NULL, scp, &afsStatus, &volSync, userp, reqp, CM_MERGEFLAG_FETCHDATA);
     else
         InterlockedDecrement(&scp->activeRPCs);
 
@@ -2776,6 +2839,8 @@ cm_VerifyStoreData(cm_bulkIO_t *biod, cm_scache_t *savedScp)
                     buf_offset = 0;
                 }
                 cmp_length =  cm_data.buf_blockSize - buf_offset;
+                if (cmp_length > biod->length - bytes_compared)
+                    cmp_length = biod->length - bytes_compared;
 
                 osi_assertx(qdp != NULL, "null osi_queueData_t");
                 bufp = osi_GetQData(qdp);