Windows: AFSInvalidateObject can overwrite input param

[openafs.git] / src / WINNT / afsrdr / kernel / lib / AFSGeneric.cpp

diff --git a/src/WINNT/afsrdr/kernel/lib/AFSGeneric.cpp b/src/WINNT/afsrdr/kernel/lib/AFSGeneric.cpp
index 2202c57..80a1b4c 100644 (file)
--- a/src/WINNT/afsrdr/kernel/lib/AFSGeneric.cpp
+++ b/src/WINNT/afsrdr/kernel/lib/AFSGeneric.cpp
@@ -424,10 +424,10 @@ AFSLockUserBuffer( IN void *UserBuffer,
 
     NTSTATUS ntStatus = STATUS_SUCCESS;
     void *pAddress = NULL;
-       MDL *pMdl = NULL;
+    MDL *pMdl = NULL;
 
-       __Enter
-       {
+    __Enter
+    {
 
         pMdl = IoAllocateMdl( UserBuffer,
                               BufferLength,
@@ -435,11 +435,11 @@ AFSLockUserBuffer( IN void *UserBuffer,
                               FALSE,
                               NULL);
 
-               if( pMdl == NULL)
-               {
+            if( pMdl == NULL)
+            {
 
-                       try_return( ntStatus = STATUS_INSUFFICIENT_RESOURCES);
-               }
+                try_return( ntStatus = STATUS_INSUFFICIENT_RESOURCES);
+            }
 
         //
         //  Lock the new Mdl in memory.
@@ -449,11 +449,11 @@ AFSLockUserBuffer( IN void *UserBuffer,
         {
 
             MmProbeAndLockPages( pMdl,
-                                                                KernelMode,
+                                 KernelMode,
                                  IoWriteAccess);
 
             pAddress = MmGetSystemAddressForMdlSafe( pMdl,
-                                                                                                        NormalPagePriority);
+                                                     NormalPagePriority);
         }
         __except( AFSExceptionFilter( GetExceptionCode(), GetExceptionInformation()) )
         {
@@ -463,11 +463,11 @@ AFSLockUserBuffer( IN void *UserBuffer,
             pAddress = NULL;
         }
 
-               if( pMdl != NULL)
-               {
+        if( pMdl != NULL)
+        {
 
-                       *Mdl = pMdl;
-               }
+            *Mdl = pMdl;
+        }
 
 try_exit:
 
@@ -1958,6 +1958,9 @@ AFSInvalidateCache( IN AFSInvalidateCacheCB *InvalidateCB)
             try_return( ntStatus);
         }
 
+        AFSAcquireShared( pVolumeCB->ObjectInfoTree.TreeLock,
+                          TRUE);
+
         if ( AFSIsVolumeFID( &InvalidateCB->FileID))
         {
 
@@ -1966,9 +1969,6 @@ AFSInvalidateCache( IN AFSInvalidateCacheCB *InvalidateCB)
         else
         {
 
-            AFSAcquireShared( pVolumeCB->ObjectInfoTree.TreeLock,
-                              TRUE);
-
             lCount = InterlockedDecrement( &pVolumeCB->VolumeReferenceCount);
 
             AFSDbgLogMsg( AFS_SUBSYSTEM_VOLUME_REF_COUNTING,
@@ -1982,9 +1982,6 @@ AFSInvalidateCache( IN AFSInvalidateCacheCB *InvalidateCB)
             ntStatus = AFSLocateHashEntry( pVolumeCB->ObjectInfoTree.TreeHead,
                                            ullIndex,
                                            (AFSBTreeEntry **)&pObjectInfo);
-
-            AFSReleaseResource( pVolumeCB->ObjectInfoTree.TreeLock);
-
         }
 
         if( pObjectInfo != NULL)
@@ -2003,6 +2000,8 @@ AFSInvalidateCache( IN AFSInvalidateCacheCB *InvalidateCB)
                           lCount);
         }
 
+        AFSReleaseResource( pVolumeCB->ObjectInfoTree.TreeLock);
+
         if( !NT_SUCCESS( ntStatus) ||
             pObjectInfo == NULL)
         {
@@ -2482,13 +2481,17 @@ AFSInvalidateVolume( IN AFSVolumeCB *VolumeCB,
             AFSInvalidateObject( &pCurrentObject,
                                  Reason);
 
-            lCount = InterlockedDecrement( &pCurrentObject->ObjectReferenceCount);
+            if ( pCurrentObject)
+            {
 
-            AFSDbgLogMsg( AFS_SUBSYSTEM_OBJECT_REF_COUNTING,
-                          AFS_TRACE_LEVEL_VERBOSE,
-                          "AFSInvalidateVolumeObjects Decrement count on object %08lX Cnt %d\n",
-                          pCurrentObject,
-                          lCount);
+                lCount = InterlockedDecrement( &pCurrentObject->ObjectReferenceCount);
+
+                AFSDbgLogMsg( AFS_SUBSYSTEM_OBJECT_REF_COUNTING,
+                              AFS_TRACE_LEVEL_VERBOSE,
+                              "AFSInvalidateVolumeObjects Decrement count on object %08lX Cnt %d\n",
+                              pCurrentObject,
+                              lCount);
+            }
         }
 
         //