sys: QueryDirectory stability:

- FspMetaCacheAddItem now handles exceptions during copy from fs buffer
- FspFsvolQueryDirectoryLengthMax is correct max length for QueryDirectory

Changelog.asciidoc

@@ -1,6 +1,16 @@
 = Changelog
 
 
+v1.2B2 (2017.2 B2)::
+
+Changes since v1.1:
+
+- New command line tool `fsptool` allows command line access to some WinFsp features.
+- New `GetDirInfoByName` file system operation adds fast queries of directory info by file name rather than pattern [e.g. `FindFirstFileW(L"foobar", FindData)`]. Tests with fsbench showed that such queries are sped up by an order of magnitude when using `GetDirInfoByName` in MEMFS. Case-sensitive FUSE file systems get this optimization for free. The .NET layer also adds `GetDirInfoByName`.
+- New `FspFileSystemOperationProcessId` API adds support for getting the originating process ID (PID) during `Create`, `Open` and `Rename` calls. FUSE file systems can now access `fuse_context::pid`. The .NET layer also adds `GetOperationProcessId`.
+- Important GitHub issues fixed: #96, #97, #103, #107
+
+
 v1.2B1 (2017.2 B1)::
 
 - New command line tool `fsptool` allows command line access to some WinFsp features.

appveyor.yml

@@ -6,6 +6,8 @@ environment:
     TESTING: Func
   - CONFIGURATION: Release
     TESTING: Func
+  - CONFIGURATION: Release
+    TESTING: Avast
   - CONFIGURATION: Release
     TESTING: Perf
 
@@ -30,6 +32,8 @@ test_script:
 - if %TESTING%==Func tools\run-tests.bat %CONFIGURATION%
 - if %TESTING%==Func tools\run-tests.bat %CONFIGURATION% ifstest
 - if %TESTING%==Func tools\run-tests.bat %CONFIGURATION% sample
+- if %TESTING%==Avast choco install avastfreeantivirus && fltmc instances -v "C:"
+- if %TESTING%==Avast tools\run-tests.bat %CONFIGURATION% avast-tests
 - if %TESTING%==Perf tools\run-perf-tests.bat %CONFIGURATION% baseline > perf-tests.csv && type perf-tests.csv & appveyor PushArtifact perf-tests.csv
 - choco uninstall winfsp -y
 - if exist %SystemRoot%\memory.dmp exit 1

build/VStudio/version.properties

@@ -18,7 +18,7 @@
 
         <MyCanonicalVersion>1.2</MyCanonicalVersion>
 
-        <MyProductVersion>2017.2 B1</MyProductVersion>
+        <MyProductVersion>2017.2 B2</MyProductVersion>
         <MyProductStage>Beta</MyProductStage>
 
         <MyVersion>$(MyCanonicalVersion).$(MyBuildNumber)</MyVersion>

inc/winfsp/winfsp.h

@@ -981,14 +981,12 @@ FSP_API VOID FspFileSystemSendResponse(FSP_FILE_SYSTEM *FileSystem,
  *     The current operation context.
  */
 FSP_API FSP_FILE_SYSTEM_OPERATION_CONTEXT *FspFileSystemGetOperationContext(VOID);
-FSP_API PWSTR FspFileSystemMountPointF(FSP_FILE_SYSTEM *FileSystem);
 static inline
 PWSTR FspFileSystemMountPoint(FSP_FILE_SYSTEM *FileSystem)
 {
     return FileSystem->MountPoint;
 }
-FSP_API NTSTATUS FspFileSystemEnterOperationF(FSP_FILE_SYSTEM *FileSystem,
+FSP_API PWSTR FspFileSystemMountPointF(FSP_FILE_SYSTEM *FileSystem);
-    FSP_FSCTL_TRANSACT_REQ *Request, FSP_FSCTL_TRANSACT_RSP *Response);
 static inline
 NTSTATUS FspFileSystemEnterOperation(FSP_FILE_SYSTEM *FileSystem,
     FSP_FSCTL_TRANSACT_REQ *Request, FSP_FSCTL_TRANSACT_RSP *Response)
@@ -998,7 +996,7 @@ NTSTATUS FspFileSystemEnterOperation(FSP_FILE_SYSTEM *FileSystem,
 
     return FileSystem->EnterOperation(FileSystem, Request, Response);
 }
-FSP_API NTSTATUS FspFileSystemLeaveOperationF(FSP_FILE_SYSTEM *FileSystem,
+FSP_API NTSTATUS FspFileSystemEnterOperationF(FSP_FILE_SYSTEM *FileSystem,
     FSP_FSCTL_TRANSACT_REQ *Request, FSP_FSCTL_TRANSACT_RSP *Response);
 static inline
 NTSTATUS FspFileSystemLeaveOperation(FSP_FILE_SYSTEM *FileSystem,
@@ -1009,9 +1007,8 @@ NTSTATUS FspFileSystemLeaveOperation(FSP_FILE_SYSTEM *FileSystem,
 
     return FileSystem->LeaveOperation(FileSystem, Request, Response);
 }
-FSP_API VOID FspFileSystemSetOperationGuardF(FSP_FILE_SYSTEM *FileSystem,
+FSP_API NTSTATUS FspFileSystemLeaveOperationF(FSP_FILE_SYSTEM *FileSystem,
-    FSP_FILE_SYSTEM_OPERATION_GUARD *EnterOperation,
+    FSP_FSCTL_TRANSACT_REQ *Request, FSP_FSCTL_TRANSACT_RSP *Response);
-    FSP_FILE_SYSTEM_OPERATION_GUARD *LeaveOperation);
 static inline
 VOID FspFileSystemSetOperationGuard(FSP_FILE_SYSTEM *FileSystem,
     FSP_FILE_SYSTEM_OPERATION_GUARD *EnterOperation,
@@ -1020,6 +1017,9 @@ VOID FspFileSystemSetOperationGuard(FSP_FILE_SYSTEM *FileSystem,
     FileSystem->EnterOperation = EnterOperation;
     FileSystem->LeaveOperation = LeaveOperation;
 }
+FSP_API VOID FspFileSystemSetOperationGuardF(FSP_FILE_SYSTEM *FileSystem,
+    FSP_FILE_SYSTEM_OPERATION_GUARD *EnterOperation,
+    FSP_FILE_SYSTEM_OPERATION_GUARD *LeaveOperation);
 /**
  * Set file system locking strategy.
  *
@@ -1030,17 +1030,14 @@ VOID FspFileSystemSetOperationGuard(FSP_FILE_SYSTEM *FileSystem,
  * @see
  *     FSP_FILE_SYSTEM_OPERATION_GUARD_STRATEGY
  */
-FSP_API VOID FspFileSystemSetOperationGuardStrategyF(FSP_FILE_SYSTEM *FileSystem,
-    FSP_FILE_SYSTEM_OPERATION_GUARD_STRATEGY GuardStrategy);
 static inline
 VOID FspFileSystemSetOperationGuardStrategy(FSP_FILE_SYSTEM *FileSystem,
     FSP_FILE_SYSTEM_OPERATION_GUARD_STRATEGY GuardStrategy)
 {
     FileSystem->OpGuardStrategy = GuardStrategy;
 }
-FSP_API VOID FspFileSystemSetOperationF(FSP_FILE_SYSTEM *FileSystem,
+FSP_API VOID FspFileSystemSetOperationGuardStrategyF(FSP_FILE_SYSTEM *FileSystem,
-    ULONG Index,
+    FSP_FILE_SYSTEM_OPERATION_GUARD_STRATEGY GuardStrategy);
-    FSP_FILE_SYSTEM_OPERATION *Operation);
 static inline
 VOID FspFileSystemSetOperation(FSP_FILE_SYSTEM *FileSystem,
     ULONG Index,
@@ -1048,8 +1045,9 @@ VOID FspFileSystemSetOperation(FSP_FILE_SYSTEM *FileSystem,
 {
     FileSystem->Operations[Index] = Operation;
 }
-FSP_API VOID FspFileSystemGetDispatcherResultF(FSP_FILE_SYSTEM *FileSystem,
+FSP_API VOID FspFileSystemSetOperationF(FSP_FILE_SYSTEM *FileSystem,
-    NTSTATUS *PDispatcherResult);
+    ULONG Index,
+    FSP_FILE_SYSTEM_OPERATION *Operation);
 static inline
 VOID FspFileSystemGetDispatcherResult(FSP_FILE_SYSTEM *FileSystem,
     NTSTATUS *PDispatcherResult)
@@ -1058,8 +1056,8 @@ VOID FspFileSystemGetDispatcherResult(FSP_FILE_SYSTEM *FileSystem,
     *PDispatcherResult = FileSystem->DispatcherResult;
     MemoryBarrier();
 }
-FSP_API VOID FspFileSystemSetDispatcherResultF(FSP_FILE_SYSTEM *FileSystem,
+FSP_API VOID FspFileSystemGetDispatcherResultF(FSP_FILE_SYSTEM *FileSystem,
-    NTSTATUS DispatcherResult);
+    NTSTATUS *PDispatcherResult);
 static inline
 VOID FspFileSystemSetDispatcherResult(FSP_FILE_SYSTEM *FileSystem,
     NTSTATUS DispatcherResult)
@@ -1068,15 +1066,16 @@ VOID FspFileSystemSetDispatcherResult(FSP_FILE_SYSTEM *FileSystem,
         return;
     InterlockedCompareExchange(&FileSystem->DispatcherResult, DispatcherResult, 0);
 }
-FSP_API VOID FspFileSystemSetDebugLogF(FSP_FILE_SYSTEM *FileSystem,
+FSP_API VOID FspFileSystemSetDispatcherResultF(FSP_FILE_SYSTEM *FileSystem,
-    UINT32 DebugLog);
+    NTSTATUS DispatcherResult);
 static inline
 VOID FspFileSystemSetDebugLog(FSP_FILE_SYSTEM *FileSystem,
     UINT32 DebugLog)
 {
     FileSystem->DebugLog = DebugLog;
 }
-FSP_API BOOLEAN FspFileSystemIsOperationCaseSensitiveF(VOID);
+FSP_API VOID FspFileSystemSetDebugLogF(FSP_FILE_SYSTEM *FileSystem,
+    UINT32 DebugLog);
 static inline
 BOOLEAN FspFileSystemIsOperationCaseSensitive(VOID)
 {
@@ -1085,7 +1084,12 @@ BOOLEAN FspFileSystemIsOperationCaseSensitive(VOID)
         FspFsctlTransactCreateKind == Request->Kind && Request->Req.Create.CaseSensitive ||
         FspFsctlTransactQueryDirectoryKind == Request->Kind && Request->Req.QueryDirectory.CaseSensitive;
 }
-FSP_API UINT32 FspFileSystemOperationProcessIdF(VOID);
+FSP_API BOOLEAN FspFileSystemIsOperationCaseSensitiveF(VOID);
+/**
+ * Gets the originating process ID.
+ *
+ * Valid only during Create, Open and Rename requests when the target exists.
+ */
 static inline
 UINT32 FspFileSystemOperationProcessId(VOID)
 {
@@ -1102,6 +1106,7 @@ UINT32 FspFileSystemOperationProcessId(VOID)
         return 0;
     }
 }
+FSP_API UINT32 FspFileSystemOperationProcessIdF(VOID);
 
 /*
  * Operations

src/dotnet/FileSystemBase.cs

@@ -983,6 +983,16 @@ namespace Fsp
             return Api.FspWin32FromNtStatus(Status);
         }
         /// <summary>
+        /// Gets the originating process ID.
+        /// </summary>
+        /// <remarks>
+        /// Valid only during Create, Open and Rename requests when the target exists.
+        /// </remarks>
+        public static int GetOperationProcessId()
+        {
+            return (int)Api.FspFileSystemOperationProcessId();
+        }
+        /// <summary>
         /// Modifies a security descriptor.
         /// </summary>
         /// <remarks>

src/dotnet/Interop.cs

@@ -539,6 +539,8 @@ namespace Fsp.Interop
                 IntPtr FileSystem,
                 UInt32 DebugLog);
             [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
+            internal delegate UInt32 FspFileSystemOperationProcessIdF();
+            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
             [return: MarshalAs(UnmanagedType.U1)]
             internal delegate Boolean FspFileSystemAddDirInfo(
                 IntPtr DirInfo,
@@ -706,6 +708,7 @@ namespace Fsp.Interop
         internal static Proto.FspFileSystemMountPointF FspFileSystemMountPoint;
         internal static Proto.FspFileSystemSetOperationGuardStrategyF FspFileSystemSetOperationGuardStrategy;
         internal static Proto.FspFileSystemSetDebugLogF FspFileSystemSetDebugLog;
+        internal static Proto.FspFileSystemOperationProcessIdF FspFileSystemOperationProcessId;
         internal static Proto.FspFileSystemAddDirInfo _FspFileSystemAddDirInfo;
         internal static Proto.FspFileSystemFindReparsePoint FspFileSystemFindReparsePoint;
         internal static Proto.FspFileSystemResolveReparsePoints FspFileSystemResolveReparsePoints;
@@ -1015,6 +1018,7 @@ namespace Fsp.Interop
             FspFileSystemMountPoint = GetEntryPoint<Proto.FspFileSystemMountPointF>(Module);
             FspFileSystemSetOperationGuardStrategy = GetEntryPoint<Proto.FspFileSystemSetOperationGuardStrategyF>(Module);
             FspFileSystemSetDebugLog = GetEntryPoint<Proto.FspFileSystemSetDebugLogF>(Module);
+            FspFileSystemOperationProcessId = GetEntryPoint<Proto.FspFileSystemOperationProcessIdF>(Module);
             _FspFileSystemAddDirInfo = GetEntryPoint<Proto.FspFileSystemAddDirInfo>(Module);
             FspFileSystemFindReparsePoint = GetEntryPoint<Proto.FspFileSystemFindReparsePoint>(Module);
             FspFileSystemResolveReparsePoints = GetEntryPoint<Proto.FspFileSystemResolveReparsePoints>(Module);

src/sys/create.c

@@ -545,7 +545,7 @@ NTSTATUS FspFsvolCreatePrepare(
     SECURITY_CLIENT_CONTEXT SecurityClientContext;
     HANDLE UserModeAccessToken;
     PEPROCESS Process;
-    HANDLE ProcessId;
+    ULONG OriginatingProcessId;
     FSP_FILE_NODE *FileNode;
     FSP_FILE_DESC *FileDesc;
     PFILE_OBJECT FileObject;
@@ -579,15 +579,17 @@ NTSTATUS FspFsvolCreatePrepare(
         /* get a pointer to the current process so that we can close the impersonation token later */
         Process = PsGetCurrentProcess();
         ObReferenceObject(Process);
-        ProcessId = PsGetProcessId(Process);
+
+        /* get the originating process ID stored in the IRP */
+        OriginatingProcessId = IoGetRequestorProcessId(Irp);
 
         /* send the user-mode handle to the user-mode file system */
         FspIopRequestContext(Request, RequestAccessToken) = UserModeAccessToken;
         FspIopRequestContext(Request, RequestProcess) = Process;
         ASSERT((UINT64)(UINT_PTR)UserModeAccessToken <= 0xffffffffULL);
-        ASSERT((UINT64)(UINT_PTR)ProcessId <= 0xffffffffULL);
+        ASSERT((UINT64)(UINT_PTR)OriginatingProcessId <= 0xffffffffULL);
         Request->Req.Create.AccessToken =
-            ((UINT64)(UINT_PTR)ProcessId << 32) | (UINT64)(UINT_PTR)UserModeAccessToken;
+            ((UINT64)(UINT_PTR)OriginatingProcessId << 32) | (UINT64)(UINT_PTR)UserModeAccessToken;
 
         return STATUS_SUCCESS;
     }

src/sys/dirctl.c

@@ -17,15 +17,6 @@
 
 #include <sys/driver.h>
 
-/*
- * NOTE:
- *
- * FspIopCompleteIrpEx does some special processing for IRP_MJ_DIRECTORY_CONTROL /
- * IRP_MN_QUERY_DIRECTORY IRP's that come from SRV2. If the processing of this IRP
- * changes substantially (in particular if we eliminate our use of
- * Irp->AssociatedIrp.SystemBuffer) we should also revisit FspIopCompleteIrpEx.
- */
-
 static NTSTATUS FspFsvolQueryDirectoryCopy(
     PUNICODE_STRING DirectoryPattern, BOOLEAN CaseInsensitive,
     PUNICODE_STRING DirectoryMarker, PUNICODE_STRING DirectoryMarkerOut,
@@ -77,19 +68,17 @@ FSP_DRIVER_DISPATCH FspDirectoryControl;
 enum
 {
     /* QueryDirectory */
-    RequestIrp                          = 0,
+    RequestFileNode                     = 0,
     RequestCookie                       = 1,
-    RequestMdl                          = 1,
     RequestAddress                      = 2,
     RequestProcess                      = 3,
-
-    /* QueryDirectoryRetry */
-    RequestSystemBufferLength           = 0,
-
-    /* DirectoryControlComplete retry */
-    RequestDirInfoChangeNumber          = 0,
 };
-FSP_FSCTL_STATIC_ASSERT(RequestCookie == RequestMdl, "");
+
+enum
+{
+    FspFsvolQueryDirectoryLengthMax     =
+        FspFsvolDeviceDirInfoCacheItemSizeMax - FspMetaCacheItemHeaderSize,
+};
 
 static NTSTATUS FspFsvolQueryDirectoryCopy(
     PUNICODE_STRING DirectoryPattern, BOOLEAN CaseInsensitive,
@@ -362,7 +351,6 @@ static NTSTATUS FspFsvolQueryDirectoryCopyInPlace(
     PUNICODE_STRING DirectoryPattern = &FileDesc->DirectoryPattern;
     UNICODE_STRING DirectoryMarker = FileDesc->DirectoryMarker;
 
-    ASSERT(DirInfo == DestBuf);
     FSP_FSCTL_STATIC_ASSERT(
         FIELD_OFFSET(FSP_FSCTL_DIR_INFO, FileNameBuf) >=
         FIELD_OFFSET(FILE_ID_BOTH_DIR_INFORMATION, FileName),
@@ -389,77 +377,10 @@ static NTSTATUS FspFsvolQueryDirectoryCopyInPlace(
     return Result;
 }
 
-static inline NTSTATUS FspFsvolQueryDirectoryBufferUserBuffer(
-    FSP_FSVOL_DEVICE_EXTENSION *FsvolDeviceExtension, PIRP Irp, PULONG PLength)
-{
-    if (0 != Irp->AssociatedIrp.SystemBuffer)
-        return STATUS_SUCCESS;
-
-    NTSTATUS Result;
-    ULONG Length = *PLength;
-
-    if (Length > FspFsvolDeviceDirInfoCacheItemSizeMax)
-        Length = FspFsvolDeviceDirInfoCacheItemSizeMax;
-    else if (Length < sizeof(FSP_FSCTL_DIR_INFO) +
-        FsvolDeviceExtension->VolumeParams.MaxComponentLength * sizeof(WCHAR))
-        Length = sizeof(FSP_FSCTL_DIR_INFO) +
-            FsvolDeviceExtension->VolumeParams.MaxComponentLength * sizeof(WCHAR);
-
-    Result = FspBufferUserBuffer(Irp, FSP_FSCTL_ALIGN_UP(Length, PAGE_SIZE), IoWriteAccess);
-    if (!NT_SUCCESS(Result))
-        return Result;
-
-    *PLength = Length;
-
-    return STATUS_SUCCESS;
-}
-
 static NTSTATUS FspFsvolQueryDirectoryRetry(
     PDEVICE_OBJECT FsvolDeviceObject, PIRP Irp, PIO_STACK_LOCATION IrpSp,
     BOOLEAN CanWait)
 {
-    /*
-     * The SystemBufferLength contains the length of the SystemBuffer that we
-     * are going to allocate (in FspFsvolQueryDirectoryBufferUserBuffer). This
-     * buffer is going to be used as the IRP SystemBuffer and it will also be
-     * mapped into the user mode file system process (in
-     * FspFsvolDirectoryControlPrepare) so that the file system can fill in the
-     * buffer.
-     *
-     * The SystemBufferLength is not the actual length that we are going to use
-     * when completing the IRP. This will be computed at IRP completion time
-     * (using FspFsvolQueryDirectoryCopy). Instead the SystemBufferLength is
-     * the size that we want the user mode file system to see and it may be
-     * different from the requested length for the following reasons:
-     *
-     *   - If the FileInfoTimeout is non-zero, then the directory maintains a
-     *     DirInfo meta cache that can be used to fulfill IRP requests without
-     *     reaching out to user mode. In this case we want the SystemBufferLength
-     *     to be FspFsvolDeviceDirInfoCacheItemSizeMax so that we read up to the
-     *     cache size maximum.
-     *
-     *   - If the requested DirectoryPattern (stored in FileDesc) is not the "*"
-     *     (MatchAll) pattern, then we want to read as many entries as possible
-     *     from the user mode file system to avoid multiple roundtrips to user
-     *     mode when doing file name matching. In this case we set again the
-     *     SystemBufferLength to be FspFsvolDeviceDirInfoCacheItemSizeMax. This
-     *     is an important optimization and without it QueryDirectory is *very*
-     *     slow without the DirInfo meta cache (i.e. when FileInfoTimeout is 0).
-     *
-     *   - If the requsted DirectoryPattern is the MatchAll pattern then we set
-     *     the SystemBufferLength to the requested (IRP) length as it is actually
-     *     counter-productive to try to read more than we need.
-     */
-#define GetSystemBufferLengthMaybeCached()\
-    (0 != FsvolDeviceExtension->VolumeParams.FileInfoTimeout && 0 == FileDesc->DirectoryMarker.Buffer) ||\
-    FspFileDescDirectoryPatternMatchAll != FileDesc->DirectoryPattern.Buffer ?\
-        FspFsvolDeviceDirInfoCacheItemSizeMax : Length
-#define GetSystemBufferLengthNonCached()\
-    FspFileDescDirectoryPatternMatchAll != FileDesc->DirectoryPattern.Buffer ?\
-        FspFsvolDeviceDirInfoCacheItemSizeMax : Length
-#define GetSystemBufferLengthBestGuess()\
-    FspFsvolDeviceDirInfoCacheItemSizeMax
-
     PAGED_CODE();
 
     NTSTATUS Result;
@@ -471,12 +392,13 @@ static NTSTATUS FspFsvolQueryDirectoryRetry(
     BOOLEAN IndexSpecified = BooleanFlagOn(IrpSp->Flags, SL_INDEX_SPECIFIED);
     BOOLEAN ReturnSingleEntry = BooleanFlagOn(IrpSp->Flags, SL_RETURN_SINGLE_ENTRY);
     FILE_INFORMATION_CLASS FileInformationClass = IrpSp->Parameters.QueryDirectory.FileInformationClass;
+    ULONG BaseInfoLen;
     PUNICODE_STRING FileName = IrpSp->Parameters.QueryDirectory.FileName;
     //ULONG FileIndex = IrpSp->Parameters.QueryDirectory.FileIndex;
-    PVOID Buffer = 0 != Irp->AssociatedIrp.SystemBuffer ?
+    PVOID Buffer = 0 == Irp->MdlAddress ?
-        Irp->AssociatedIrp.SystemBuffer : Irp->UserBuffer;
+        Irp->UserBuffer : MmGetSystemAddressForMdlSafe(Irp->MdlAddress, NormalPagePriority);
     ULONG Length = IrpSp->Parameters.QueryDirectory.Length;
-    ULONG SystemBufferLength;
+    ULONG QueryDirectoryLength, QueryDirectoryLengthMin;
     PVOID DirInfoBuffer;
     ULONG DirInfoSize;
     FSP_FSCTL_TRANSACT_REQ *Request = FspIrpRequest(Irp);
@@ -485,34 +407,42 @@ static NTSTATUS FspFsvolQueryDirectoryRetry(
 
     ASSERT(FileNode == FileDesc->FileNode);
 
-    SystemBufferLength = 0 != Request ?
+    if (0 == Buffer)
-        (ULONG)(UINT_PTR)FspIopRequestContext(Request, RequestSystemBufferLength) : 0;
+        return 0 == Irp->MdlAddress ? STATUS_INVALID_PARAMETER : STATUS_INSUFFICIENT_RESOURCES;
+
+    /* is this an allowed file information class? */
+    switch (FileInformationClass)
+    {
+    case FileDirectoryInformation:
+        BaseInfoLen = FIELD_OFFSET(FILE_DIRECTORY_INFORMATION, FileName);
+        break;
+    case FileFullDirectoryInformation:
+        BaseInfoLen = FIELD_OFFSET(FILE_FULL_DIR_INFORMATION, FileName);
+        break;
+    case FileIdFullDirectoryInformation:
+        BaseInfoLen = FIELD_OFFSET(FILE_ID_FULL_DIR_INFORMATION, FileName);
+        break;
+    case FileNamesInformation:
+        BaseInfoLen = FIELD_OFFSET(FILE_NAMES_INFORMATION, FileName);
+        break;
+    case FileBothDirectoryInformation:
+        BaseInfoLen = FIELD_OFFSET(FILE_BOTH_DIR_INFORMATION, FileName);
+        break;
+    case FileIdBothDirectoryInformation:
+        BaseInfoLen = FIELD_OFFSET(FILE_ID_BOTH_DIR_INFORMATION, FileName);
+        break;
+    default:
+        return STATUS_INVALID_INFO_CLASS;
+    }
+
+    if (BaseInfoLen >= Length)
+        return STATUS_BUFFER_TOO_SMALL;
 
     /* try to acquire the FileNode exclusive; Full because we may need to send a Request */
     Success = DEBUGTEST(90) &&
         FspFileNodeTryAcquireExclusiveF(FileNode, FspFileNodeAcquireFull, CanWait);
     if (!Success)
-    {
+        return FspWqRepostIrpWorkItem(Irp, FspFsvolQueryDirectoryRetry, 0);
-        if (0 == SystemBufferLength)
-            SystemBufferLength = GetSystemBufferLengthBestGuess();
-
-        Result = FspFsvolQueryDirectoryBufferUserBuffer(
-            FsvolDeviceExtension, Irp, &SystemBufferLength);
-        if (!NT_SUCCESS(Result))
-            return Result;
-
-        Result = FspWqCreateIrpWorkItem(Irp, FspFsvolQueryDirectoryRetry, 0);
-        if (!NT_SUCCESS(Result))
-            return Result;
-
-        Request = FspIrpRequest(Irp);
-        FspIopRequestContext(Request, RequestSystemBufferLength) =
-            (PVOID)(UINT_PTR)SystemBufferLength;
-
-        FspWqPostIrpWorkItem(Irp);
-
-        return STATUS_PENDING;
-    }
 
     /* if we have been retried reset our work item now! */
     if (0 != Request)
@@ -532,9 +462,6 @@ static NTSTATUS FspFsvolQueryDirectoryRetry(
     /* see if the required information is still in the cache and valid! */
     if (FspFileNodeReferenceDirInfo(FileNode, &DirInfoBuffer, &DirInfoSize))
     {
-        if (0 == SystemBufferLength)
-            SystemBufferLength = GetSystemBufferLengthNonCached();
-
         Result = FspFsvolQueryDirectoryCopyCache(FileDesc,
             IndexSpecified || RestartScan,
             FileInformationClass, ReturnSingleEntry,
@@ -548,11 +475,9 @@ static NTSTATUS FspFsvolQueryDirectoryRetry(
             Irp->IoStatus.Information = Length;
             return Result;
         }
-    }
+
-    else
+        /* reset Length! */
-    {
+        Length = IrpSp->Parameters.QueryDirectory.Length;
-        if (0 == SystemBufferLength)
-            SystemBufferLength = GetSystemBufferLengthMaybeCached();
     }
 
     FspFileNodeConvertExclusiveToShared(FileNode, Full);
@@ -573,9 +498,8 @@ static NTSTATUS FspFsvolQueryDirectoryRetry(
             STATUS_NO_SUCH_FILE : STATUS_NO_MORE_FILES;
     }
 
-    /* buffer the user buffer! */
+    /* probe and lock the user buffer */
-    Result = FspFsvolQueryDirectoryBufferUserBuffer(
+    Result = FspLockUserBuffer(Irp, Length, IoWriteAccess);
-        FsvolDeviceExtension, Irp, &SystemBufferLength);
     if (!NT_SUCCESS(Result))
     {
         FspFileNodeRelease(FileNode, Full);
@@ -593,10 +517,81 @@ static NTSTATUS FspFsvolQueryDirectoryRetry(
         return Result;
     }
 
+    /*
+     * Compute QueryDirectoryLength
+     *
+     * How much data to request from the file system varies according to the following matrix:
+     *
+     * Pattern                  | NoCache | Cache+1st | Cache+2nd
+     * -------------------------+---------+-----------+----------
+     * Full Wild                | Ratio   | Maximum   | Ratio
+     * Partial Wild w/o PassQDP | Maximum | Maximum   | Maximum
+     * Partial Wild w/  PassQDP | Ratio   | Ratio     | Ratio
+     * File Name w/o PassQDF    | Maximum | Maximum   | Maximum
+     * File Name w/  PassQDF    | Minimum | Minimum   | Minimum
+     *
+     * NoCache means DirInfo caching disabled. Cache+1st means DirInfo caching enabled, but
+     * cache not primed. Cache+2nd means DirInfo caching enabled, cache is primed, but missed.
+     * [If there is no cache miss, there is no need to send the request to the file system.]
+     *
+     * Maximum means to request the maximum size allowed by the FSD. Minimum means the size that
+     * is guaranteed to contain at least one entry. Ratio means to compute how many directory
+     * entries to request from the file system based on an estimate of how many entries the FSD
+     * is supposed to deliver.
+     *
+     * The Ratio computation is as follows: Assume that N is the size of the average file name,
+     * taken to be 24 * sizeof(WCHAR). Let M be the number of entries that can fit in the passed
+     * buffer:
+     *
+     * M := Length / (BaseInfoLen + N) = QueryDirectoryLength / (sizeof(FSP_FSCTL_DIR_INFO) + N)
+     * => QueryDirectoryLength = Length * (sizeof(FSP_FSCTL_DIR_INFO) + N) / (BaseInfoLen + N)
+     */
+
+    QueryDirectoryLengthMin = sizeof(FSP_FSCTL_DIR_INFO) +
+        FsvolDeviceExtension->VolumeParams.MaxComponentLength * sizeof(WCHAR);
+    QueryDirectoryLengthMin = FSP_FSCTL_ALIGN_UP(QueryDirectoryLengthMin, 8);
+    ASSERT(QueryDirectoryLengthMin < FspFsvolQueryDirectoryLengthMax);
+    if (0 != FsvolDeviceExtension->VolumeParams.FileInfoTimeout &&
+        0 == FileDesc->DirectoryMarker.Buffer)
+    {
+        if (PatternIsFileName)
+            QueryDirectoryLength = QueryDirectoryLengthMin;
+        else if (PassQueryDirectoryPattern)
+        {
+            QueryDirectoryLength = Length *
+                (sizeof(FSP_FSCTL_DIR_INFO) + 24 * sizeof(WCHAR)) / (BaseInfoLen + 24 * sizeof(WCHAR));
+            QueryDirectoryLength = FSP_FSCTL_ALIGN_UP(QueryDirectoryLength, 8);
+            if (QueryDirectoryLength < QueryDirectoryLengthMin)
+                QueryDirectoryLength = QueryDirectoryLengthMin;
+            else if (QueryDirectoryLength > FspFsvolQueryDirectoryLengthMax)
+                QueryDirectoryLength = FspFsvolQueryDirectoryLengthMax;
+        }
+        else
+            QueryDirectoryLength = FspFsvolQueryDirectoryLengthMax;
+    }
+    else
+    {
+        if (PatternIsFileName)
+            QueryDirectoryLength = QueryDirectoryLengthMin;
+        else if (PassQueryDirectoryPattern ||
+            FspFileDescDirectoryPatternMatchAll == FileDesc->DirectoryPattern.Buffer)
+        {
+            QueryDirectoryLength = Length *
+                (sizeof(FSP_FSCTL_DIR_INFO) + 24 * sizeof(WCHAR)) / (BaseInfoLen + 24 * sizeof(WCHAR));
+            QueryDirectoryLength = FSP_FSCTL_ALIGN_UP(QueryDirectoryLength, 8);
+            if (QueryDirectoryLength < QueryDirectoryLengthMin)
+                QueryDirectoryLength = QueryDirectoryLengthMin;
+            else if (QueryDirectoryLength > FspFsvolQueryDirectoryLengthMax)
+                QueryDirectoryLength = FspFsvolQueryDirectoryLengthMax;
+        }
+        else
+            QueryDirectoryLength = FspFsvolQueryDirectoryLengthMax;
+    }
+
     Request->Kind = FspFsctlTransactQueryDirectoryKind;
     Request->Req.QueryDirectory.UserContext = FileNode->UserContext;
     Request->Req.QueryDirectory.UserContext2 = FileDesc->UserContext2;
-    Request->Req.QueryDirectory.Length = SystemBufferLength;
+    Request->Req.QueryDirectory.Length = QueryDirectoryLength;
     Request->Req.QueryDirectory.CaseSensitive = FileDesc->CaseSensitive;
 
     if (PassQueryDirectoryPattern)
@@ -631,13 +626,9 @@ static NTSTATUS FspFsvolQueryDirectoryRetry(
     }
 
     FspFileNodeSetOwner(FileNode, Full, Request);
-    FspIopRequestContext(Request, RequestIrp) = Irp;
+    FspIopRequestContext(Request, RequestFileNode) = FileNode;
 
     return FSP_STATUS_IOQ_POST;
-
-#undef GetSystemBufferLengthBestGuess
-#undef GetSystemBufferLengthNonCached
-#undef GetSystemBufferLengthMaybeCached
 }
 
 static NTSTATUS FspFsvolQueryDirectory(
@@ -649,21 +640,10 @@ static NTSTATUS FspFsvolQueryDirectory(
     if (!FspFileNodeIsValid(IrpSp->FileObject->FsContext))
         return STATUS_INVALID_DEVICE_REQUEST;
 
-    NTSTATUS Result;
     FSP_FSVOL_DEVICE_EXTENSION *FsvolDeviceExtension = FspFsvolDeviceExtension(FsvolDeviceObject);
     PFILE_OBJECT FileObject = IrpSp->FileObject;
     FSP_FILE_NODE *FileNode = FileObject->FsContext;
-    FILE_INFORMATION_CLASS FileInformationClass = IrpSp->Parameters.QueryDirectory.FileInformationClass;
     PUNICODE_STRING FileName = IrpSp->Parameters.QueryDirectory.FileName;
-    ULONG Length = IrpSp->Parameters.QueryDirectory.Length;
-    ULONG BaseInfoLen;
-
-    /* SystemBuffer must be NULL as we are going to be using it! */
-    if (0 != Irp->AssociatedIrp.SystemBuffer)
-    {
-        ASSERT(0);
-        return STATUS_INVALID_PARAMETER;
-    }
 
     /* only directory files can be queried */
     if (!FileNode->IsDirectory)
@@ -674,36 +654,7 @@ static NTSTATUS FspFsvolQueryDirectory(
         !FspFileNameIsValidPattern(FileName, FsvolDeviceExtension->VolumeParams.MaxComponentLength))
         return STATUS_INVALID_PARAMETER;
 
-    /* is this an allowed file information class? */
+    return FspFsvolQueryDirectoryRetry(FsvolDeviceObject, Irp, IrpSp, IoIsOperationSynchronous(Irp));
-    switch (FileInformationClass)
-    {
-    case FileDirectoryInformation:
-        BaseInfoLen = FIELD_OFFSET(FILE_DIRECTORY_INFORMATION, FileName);
-        break;
-    case FileFullDirectoryInformation:
-        BaseInfoLen = FIELD_OFFSET(FILE_FULL_DIR_INFORMATION, FileName);
-        break;
-    case FileIdFullDirectoryInformation:
-        BaseInfoLen = FIELD_OFFSET(FILE_ID_FULL_DIR_INFORMATION, FileName);
-        break;
-    case FileNamesInformation:
-        BaseInfoLen = FIELD_OFFSET(FILE_NAMES_INFORMATION, FileName);
-        break;
-    case FileBothDirectoryInformation:
-        BaseInfoLen = FIELD_OFFSET(FILE_BOTH_DIR_INFORMATION, FileName);
-        break;
-    case FileIdBothDirectoryInformation:
-        BaseInfoLen = FIELD_OFFSET(FILE_ID_BOTH_DIR_INFORMATION, FileName);
-        break;
-    default:
-        return STATUS_INVALID_INFO_CLASS;
-    }
-    if (BaseInfoLen >= Length)
-        return STATUS_BUFFER_TOO_SMALL;
-
-    Result = FspFsvolQueryDirectoryRetry(FsvolDeviceObject, Irp, IrpSp, IoIsOperationSynchronous(Irp));
-
-    return Result;
 }
 
 typedef struct
@@ -850,67 +801,26 @@ NTSTATUS FspFsvolDirectoryControlPrepare(
 {
     PAGED_CODE();
 
-    if (FspQueryDirectoryIrpShouldUseProcessBuffer(Irp, Request->Req.QueryDirectory.Length))
+    NTSTATUS Result;
-    {
+    PVOID Cookie;
-        NTSTATUS Result;
+    PVOID Address;
-        PVOID Cookie;
+    PEPROCESS Process;
-        PVOID Address;
-        PEPROCESS Process;
 
-        Result = FspProcessBufferAcquire(Request->Req.QueryDirectory.Length, &Cookie, &Address);
+    Result = FspProcessBufferAcquire(Request->Req.QueryDirectory.Length, &Cookie, &Address);
-        if (!NT_SUCCESS(Result))
+    if (!NT_SUCCESS(Result))
-            return Result;
+        return Result;
 
-        /* get a pointer to the current process so that we can release the buffer later */
+    /* get a pointer to the current process so that we can release the buffer later */
-        Process = PsGetCurrentProcess();
+    Process = PsGetCurrentProcess();
-        ObReferenceObject(Process);
+    ObReferenceObject(Process);
 
-        Request->Req.QueryDirectory.Address = (UINT64)(UINT_PTR)Address;
+    Request->Req.QueryDirectory.Address = (UINT64)(UINT_PTR)Address;
 
-        FspIopRequestContext(Request, RequestCookie) = (PVOID)((UINT_PTR)Cookie | 1);
+    FspIopRequestContext(Request, RequestCookie) = (PVOID)((UINT_PTR)Cookie | 1);
-        FspIopRequestContext(Request, RequestAddress) = Address;
+    FspIopRequestContext(Request, RequestAddress) = Address;
-        FspIopRequestContext(Request, RequestProcess) = Process;
+    FspIopRequestContext(Request, RequestProcess) = Process;
 
-        return STATUS_SUCCESS;
+    return STATUS_SUCCESS;
-    }
-    else
-    {
-        NTSTATUS Result;
-        PMDL Mdl = 0;
-        PVOID Address;
-        PEPROCESS Process;
-
-        Mdl = IoAllocateMdl(
-            Irp->AssociatedIrp.SystemBuffer,
-            Request->Req.QueryDirectory.Length,
-            FALSE, FALSE, 0);
-        if (0 == Mdl)
-            return STATUS_INSUFFICIENT_RESOURCES;
-
-        MmBuildMdlForNonPagedPool(Mdl);
-
-        /* map the MDL into user-mode */
-        Result = FspMapLockedPagesInUserMode(Mdl, &Address, 0);
-        if (!NT_SUCCESS(Result))
-        {
-            if (0 != Mdl)
-                IoFreeMdl(Mdl);
-
-            return Result;
-        }
-
-        /* get a pointer to the current process so that we can unmap the address later */
-        Process = PsGetCurrentProcess();
-        ObReferenceObject(Process);
-
-        Request->Req.QueryDirectory.Address = (UINT64)(UINT_PTR)Address;
-
-        FspIopRequestContext(Request, RequestMdl) = Mdl;
-        FspIopRequestContext(Request, RequestAddress) = Address;
-        FspIopRequestContext(Request, RequestProcess) = Process;
-
-        return STATUS_SUCCESS;
-    }
 }
 
 NTSTATUS FspFsvolDirectoryControlComplete(
@@ -935,9 +845,8 @@ NTSTATUS FspFsvolDirectoryControlComplete(
     FSP_FILE_DESC *FileDesc = FileObject->FsContext2;
     BOOLEAN ReturnSingleEntry = BooleanFlagOn(IrpSp->Flags, SL_RETURN_SINGLE_ENTRY);
     FILE_INFORMATION_CLASS FileInformationClass = IrpSp->Parameters.QueryDirectory.FileInformationClass;
-    PVOID Buffer = Irp->AssociatedIrp.SystemBuffer;
+    PVOID Buffer = MmGetSystemAddressForMdlSafe(Irp->MdlAddress, NormalPagePriority);
     ULONG Length = IrpSp->Parameters.QueryDirectory.Length;
-    ULONG DirInfoChangeNumber;
     PVOID DirInfoBuffer;
     ULONG DirInfoSize;
     BOOLEAN Success;
@@ -951,33 +860,14 @@ NTSTATUS FspFsvolDirectoryControlComplete(
         FSP_RETURN();
     }
 
-    if (FspFsctlTransactQueryDirectoryKind == Request->Kind)
+    if (0 != FspIopRequestContext(Request, RequestFileNode))
     {
-        if ((UINT_PTR)FspIopRequestContext(Request, RequestCookie) & 1)
+        FspIopRequestContext(Request, FspIopRequestExtraContext) = (PVOID)
-        {
+            FspFileNodeDirInfoChangeNumber(FileNode);
-            PVOID Address = FspIopRequestContext(Request, RequestAddress);
+        FspIopRequestContext(Request, RequestFileNode) = 0;
 
-            ASSERT(0 != Address);
+        FspFileNodeReleaseOwner(FileNode, Full, Request);
-            try
-            {
-                RtlCopyMemory(Irp->AssociatedIrp.SystemBuffer, Address, Response->IoStatus.Information);
-            }
-            except (EXCEPTION_EXECUTE_HANDLER)
-            {
-                Result = GetExceptionCode();
-                Result = FsRtlIsNtstatusExpected(Result) ? STATUS_INVALID_USER_BUFFER : Result;
-                FSP_RETURN();
-            }
-        }
-
-        DirInfoChangeNumber = FspFileNodeDirInfoChangeNumber(FileNode);
-        Request->Kind = FspFsctlTransactReservedKind;
-        FspIopResetRequest(Request, 0);
-        FspIopRequestContext(Request, RequestDirInfoChangeNumber) = (PVOID)DirInfoChangeNumber;
     }
-    else
-        DirInfoChangeNumber =
-            (ULONG)(UINT_PTR)FspIopRequestContext(Request, RequestDirInfoChangeNumber);
 
     /* acquire FileNode exclusive Full (because we may need to go back to user-mode) */
     Success = DEBUGTEST(90) && FspFileNodeTryAcquireExclusive(FileNode, Full);
@@ -990,9 +880,9 @@ NTSTATUS FspFsvolDirectoryControlComplete(
     if (0 == Request->Req.QueryDirectory.Pattern.Size &&
         0 == Request->Req.QueryDirectory.Marker.Size &&
         FspFileNodeTrySetDirInfo(FileNode,
-            Irp->AssociatedIrp.SystemBuffer,
+            (PVOID)(UINT_PTR)Request->Req.QueryDirectory.Address,
             (ULONG)Response->IoStatus.Information,
-            DirInfoChangeNumber) &&
+            (ULONG)(UINT_PTR)FspIopRequestContext(Request, FspIopRequestExtraContext)) &&
         FspFileNodeReferenceDirInfo(FileNode, &DirInfoBuffer, &DirInfoSize))
     {
         Result = FspFsvolQueryDirectoryCopyCache(FileDesc,
@@ -1004,7 +894,7 @@ NTSTATUS FspFsvolDirectoryControlComplete(
     }
     else
     {
-        DirInfoBuffer = Irp->AssociatedIrp.SystemBuffer;
+        DirInfoBuffer = (PVOID)(UINT_PTR)Request->Req.QueryDirectory.Address;
         DirInfoSize = (ULONG)Response->IoStatus.Information;
         Result = FspFsvolQueryDirectoryCopyInPlace(FileDesc,
             FileInformationClass, ReturnSingleEntry,
@@ -1023,7 +913,6 @@ NTSTATUS FspFsvolDirectoryControlComplete(
 
         FspFileNodeConvertExclusiveToShared(FileNode, Full);
 
-        Request->Kind = FspFsctlTransactQueryDirectoryKind;
         FspIopResetRequest(Request, FspFsvolQueryDirectoryRequestFini);
 
         Request->Req.QueryDirectory.Address = 0;
@@ -1047,7 +936,7 @@ NTSTATUS FspFsvolDirectoryControlComplete(
         }
 
         FspFileNodeSetOwner(FileNode, Full, Request);
-        FspIopRequestContext(Request, RequestIrp) = Irp;
+        FspIopRequestContext(Request, RequestFileNode) = FileNode;
 
         FspIoqPostIrp(FsvolDeviceExtension->Ioq, Irp, &Result);
     }
@@ -1069,65 +958,30 @@ static VOID FspFsvolQueryDirectoryRequestFini(FSP_FSCTL_TRANSACT_REQ *Request, P
 {
     PAGED_CODE();
 
-    PIRP Irp = Context[RequestIrp];
+    FSP_FILE_NODE *FileNode = Context[RequestFileNode];
+    PVOID Cookie = (PVOID)((UINT_PTR)Context[RequestCookie] & ~1);
+    PVOID Address = Context[RequestAddress];
+    PEPROCESS Process = Context[RequestProcess];
 
-    if ((UINT_PTR)Context[RequestCookie] & 1)
+    if (0 != Address)
     {
-        PVOID Cookie = (PVOID)((UINT_PTR)Context[RequestCookie] & ~1);
+        KAPC_STATE ApcState;
-        PVOID Address = Context[RequestAddress];
+        BOOLEAN Attach;
-        PEPROCESS Process = Context[RequestProcess];
 
-        if (0 != Address)
+        ASSERT(0 != Process);
-        {
+        Attach = Process != PsGetCurrentProcess();
-            KAPC_STATE ApcState;
-            BOOLEAN Attach;
 
-            ASSERT(0 != Process);
+        if (Attach)
-            Attach = Process != PsGetCurrentProcess();
+            KeStackAttachProcess(Process, &ApcState);
+        FspProcessBufferRelease(Cookie, Address);
+        if (Attach)
+            KeUnstackDetachProcess(&ApcState);
 
-            if (Attach)
+        ObDereferenceObject(Process);
-                KeStackAttachProcess(Process, &ApcState);
-            FspProcessBufferRelease(Cookie, Address);
-            if (Attach)
-                KeUnstackDetachProcess(&ApcState);
-
-            ObDereferenceObject(Process);
-        }
-    }
-    else
-    {
-        PMDL Mdl = Context[RequestMdl];
-        PVOID Address = Context[RequestAddress];
-        PEPROCESS Process = Context[RequestProcess];
-
-        if (0 != Address)
-        {
-            KAPC_STATE ApcState;
-            BOOLEAN Attach;
-
-            ASSERT(0 != Process);
-            Attach = Process != PsGetCurrentProcess();
-
-            if (Attach)
-                KeStackAttachProcess(Process, &ApcState);
-            MmUnmapLockedPages(Address, Mdl);
-            if (Attach)
-                KeUnstackDetachProcess(&ApcState);
-
-            ObDereferenceObject(Process);
-        }
-
-        if (0 != Mdl)
-            IoFreeMdl(Mdl);
     }
 
-    if (0 != Irp)
+    if (0 != FileNode)
-    {
-        PIO_STACK_LOCATION IrpSp = IoGetCurrentIrpStackLocation(Irp);
-        FSP_FILE_NODE *FileNode = IrpSp->FileObject->FsContext;
-
         FspFileNodeReleaseOwner(FileNode, Full, Request);
-    }
 }
 
 NTSTATUS FspDirectoryControl(

src/sys/driver.h

@@ -837,6 +837,10 @@ PIRP FspIoqNextCompleteIrp(FSP_IOQ *Ioq, PIRP BoundaryIrp);
 ULONG FspIoqRetriedIrpCount(FSP_IOQ *Ioq);
 
 /* meta cache */
+enum
+{
+    FspMetaCacheItemHeaderSize = MEMORY_ALLOCATION_ALIGNMENT,
+};
 typedef struct
 {
     KSPIN_LOCK SpinLock;
@@ -1144,11 +1148,13 @@ BOOLEAN FspWriteIrpShouldUseProcessBuffer(PIRP Irp, SIZE_T BufferSize)
     return FspProcessBufferSizeMax >= BufferSize;
 #endif
 }
+#if 0
 static inline
 BOOLEAN FspQueryDirectoryIrpShouldUseProcessBuffer(PIRP Irp, SIZE_T BufferSize)
 {
     return FspReadIrpShouldUseProcessBuffer(Irp, BufferSize);
 }
+#endif
 
 /* volume management */
 #define FspVolumeTransactEarlyTimeout   (1 * 10000ULL)

src/sys/fileinfo.c

@@ -1573,7 +1573,7 @@ NTSTATUS FspFsvolSetInformationPrepare(
     SECURITY_CLIENT_CONTEXT SecurityClientContext;
     HANDLE UserModeAccessToken;
     PEPROCESS Process;
-    HANDLE ProcessId;
+    ULONG OriginatingProcessId;
 
     SecuritySubjectContext = FspIopRequestContext(Request, RequestSubjectContextOrAccessToken);
 
@@ -1605,15 +1605,17 @@ NTSTATUS FspFsvolSetInformationPrepare(
     /* get a pointer to the current process so that we can close the impersonation token later */
     Process = PsGetCurrentProcess();
     ObReferenceObject(Process);
-    ProcessId = PsGetProcessId(Process);
+
+    /* get the originating process ID stored in the IRP */
+    OriginatingProcessId = IoGetRequestorProcessId(Irp);
 
     /* send the user-mode handle to the user-mode file system */
     FspIopRequestContext(Request, RequestSubjectContextOrAccessToken) = UserModeAccessToken;
     FspIopRequestContext(Request, RequestProcess) = Process;
     ASSERT((UINT64)(UINT_PTR)UserModeAccessToken <= 0xffffffffULL);
-    ASSERT((UINT64)(UINT_PTR)ProcessId <= 0xffffffffULL);
+    ASSERT((UINT64)(UINT_PTR)OriginatingProcessId <= 0xffffffffULL);
     Request->Req.SetInformation.Info.Rename.AccessToken =
-        ((UINT64)(UINT_PTR)ProcessId << 32) | (UINT64)(UINT_PTR)UserModeAccessToken;
+        ((UINT64)(UINT_PTR)OriginatingProcessId << 32) | (UINT64)(UINT_PTR)UserModeAccessToken;
 
     return STATUS_SUCCESS;
 }

src/sys/iop.c

@@ -306,47 +306,6 @@ VOID FspIopCompleteIrpEx(PIRP Irp, NTSTATUS Result, BOOLEAN DeviceDereference)
             }
         }
     }
-    else
-    /*
-     * HACK:
-     *
-     * Turns out that SRV2 sends an undocumented flavor of IRP_MJ_DIRECTORY_CONTROL /
-     * IRP_MN_QUERY_DIRECTORY. These IRP's have a non-NULL Irp->MdlAddress. They expect
-     * the FSD to fill the buffer pointed by Irp->MdlAddress and they cannot handle
-     * completed IRP's with a non-NULL Irp->AssociatedIrp.SystemBuffer. So we have to
-     * provide special support for these IRPs.
-     *
-     * While this processing is IRP_MJ_DIRECTORY_CONTROL specific, we do this here for
-     * these reasons:
-     *
-     * 1.  There may be other IRP's that have similar completion requirements under SRV2.
-     *     If/when such IRP's are discovered the completion processing can be centralized
-     *     here.
-     * 2.  IRP_MJ_DIRECTORY_CONTROL has a few different ways that it can complete IRP's.
-     *     It is far simpler to do this processing here, even if not academically correct.
-     *
-     * This will have to be revisited if IRP_MJ_DIRECTORY_CONTROL processing changes
-     * substantially (e.g. to no longer use Irp->AssociatedIrp.SystemBuffer).
-     */
-    if (IRP_MJ_DIRECTORY_CONTROL == IrpSp->MajorFunction &&
-        IRP_MN_QUERY_DIRECTORY == IrpSp->MinorFunction &&
-        0 != Irp->MdlAddress && /* SRV2 queries have this set */
-        0 != Irp->AssociatedIrp.SystemBuffer &&
-        FlagOn(Irp->Flags, IRP_BUFFERED_IO))
-    {
-        if (STATUS_SUCCESS == Result)
-        {
-            PVOID Address = MmGetSystemAddressForMdlSafe(Irp->MdlAddress, NormalPagePriority);
-            if (0 != Address)
-                RtlCopyMemory(Address, Irp->AssociatedIrp.SystemBuffer, Irp->IoStatus.Information);
-            else
-                Result = STATUS_INSUFFICIENT_RESOURCES;
-        }
-
-        FspFreeExternal(Irp->AssociatedIrp.SystemBuffer);
-        Irp->AssociatedIrp.SystemBuffer = 0;
-        ClearFlag(Irp->Flags, IRP_INPUT_OPERATION | IRP_BUFFERED_IO | IRP_DEALLOCATE_BUFFER);
-    }
 
     if (STATUS_SUCCESS != Result &&
         STATUS_REPARSE != Result &&

src/sys/meta.c

@@ -33,6 +33,8 @@ typedef struct
     ULONG Size;
     __declspec(align(MEMORY_ALLOCATION_ALIGNMENT)) UINT8 Buffer[];
 } FSP_META_CACHE_ITEM_BUFFER;
+FSP_FSCTL_STATIC_ASSERT(FIELD_OFFSET(FSP_META_CACHE_ITEM_BUFFER, Buffer) == FspMetaCacheItemHeaderSize,
+    "FspMetaCacheItemHeaderSize must match offset of FSP_META_CACHE_ITEM_BUFFER::Buffer");
 
 static inline VOID FspMetaCacheDereferenceItem(FSP_META_CACHE_ITEM *Item)
 {
@@ -218,7 +220,16 @@ UINT64 FspMetaCacheAddItem(FSP_META_CACHE *MetaCache, PCVOID Buffer, ULONG Size)
     Item->RefCount = 1;
     ItemBuffer->Item = Item;
     ItemBuffer->Size = Size;
-    RtlCopyMemory(ItemBuffer->Buffer, Buffer, Size);
+    try
+    {
+        RtlCopyMemory(ItemBuffer->Buffer, Buffer, Size);
+    }
+    except (EXCEPTION_EXECUTE_HANDLER)
+    {
+        FspFree(ItemBuffer);
+        FspFree(Item);
+        return 0;
+    }
     KeAcquireSpinLock(&MetaCache->SpinLock, &Irql);
     if (MetaCache->ItemCount >= MetaCache->MetaCapacity)
         FspMetaCacheRemoveExpiredItemAtDpcLevel(MetaCache, (UINT64)-1LL);

src/sys/wq.c

@@ -32,7 +32,7 @@ static VOID FspWqWorkRoutine(PVOID Context);
 static inline
 NTSTATUS FspWqPrepareIrpWorkItem(PIRP Irp)
 {
-    NTSTATUS Result;
+    NTSTATUS Result = STATUS_SUCCESS;
     PIO_STACK_LOCATION IrpSp = IoGetCurrentIrpStackLocation(Irp);
 
     /* lock/buffer the user buffer */
@@ -43,11 +43,12 @@ NTSTATUS FspWqPrepareIrpWorkItem(PIRP Irp)
             Result = FspLockUserBuffer(Irp, IrpSp->Parameters.Read.Length, IoWriteAccess);
         else
             Result = FspLockUserBuffer(Irp, IrpSp->Parameters.Write.Length, IoReadAccess);
-        if (!NT_SUCCESS(Result))
-            return Result;
     }
+    else
+    if (IRP_MJ_DIRECTORY_CONTROL == IrpSp->MajorFunction)
+        Result = FspLockUserBuffer(Irp, IrpSp->Parameters.QueryDirectory.Length, IoWriteAccess);
 
-    return STATUS_SUCCESS;
+    return Result;
 }
 
 NTSTATUS FspWqCreateAndPostIrpWorkItem(PIRP Irp,

tools/run-tests.bat

@@ -77,7 +77,10 @@ set opt_tests=^
     sample-fsx-passthrough-fuse-x64 ^
     sample-passthrough-fuse-x86 ^
     sample-fsx-passthrough-fuse-x86 ^
-    sample-passthrough-dotnet
+    sample-passthrough-dotnet ^
+    avast-tests-x64 ^
+    avast-tests-x86 ^
+    avast-tests-dotnet
 
 set tests=
 for %%f in (%dfl_tests%) do (
@@ -212,14 +215,28 @@ exit /b 0
 
 :winfsp-tests-x64-external
 M:
-"%ProjRoot%\build\VStudio\build\%Configuration%\winfsp-tests-x64.exe" --external --resilient
+fltmc instances -v M: | findstr aswSnx >nul
+if !ERRORLEVEL! neq 0 (
+    "%ProjRoot%\build\VStudio\build\%Configuration%\winfsp-tests-x64.exe" --external --resilient
+) else (
+    REM Avast present
+    "%ProjRoot%\build\VStudio\build\%Configuration%\winfsp-tests-x64.exe" --external --resilient ^
+        -querydir_buffer_overflow_test
+)
 if !ERRORLEVEL! neq 0 goto fail
 exit /b 0
 
 :winfsp-tests-x64-external-share
 M:
-"%ProjRoot%\build\VStudio\build\%Configuration%\winfsp-tests-x64.exe" --external --share=winfsp-tests-share=M:\ --resilient ^
+fltmc instances -v M: | findstr aswSnx >nul
-    -reparse_symlink*
+if !ERRORLEVEL! neq 0 (
+    "%ProjRoot%\build\VStudio\build\%Configuration%\winfsp-tests-x64.exe" --external --share=winfsp-tests-share=M:\ --resilient ^
+        -reparse_symlink*
+) else (
+    REM Avast present
+    "%ProjRoot%\build\VStudio\build\%Configuration%\winfsp-tests-x64.exe" --external --share=winfsp-tests-share=M:\ --resilient ^
+        -reparse_symlink* -querydir_buffer_overflow_test
+)
 if !ERRORLEVEL! neq 0 goto fail
 exit /b 0
 
@@ -265,14 +282,28 @@ exit /b 0
 
 :winfsp-tests-x86-external
 O:
-"%ProjRoot%\build\VStudio\build\%Configuration%\winfsp-tests-x86.exe" --external --resilient
+fltmc instances -v O: | findstr aswSnx >nul
+if !ERRORLEVEL! neq 0 (
+    "%ProjRoot%\build\VStudio\build\%Configuration%\winfsp-tests-x86.exe" --external --resilient
+) else (
+    REM Avast present
+    "%ProjRoot%\build\VStudio\build\%Configuration%\winfsp-tests-x86.exe" --external --resilient ^
+        -querydir_buffer_overflow_test
+)
 if !ERRORLEVEL! neq 0 goto fail
 exit /b 0
 
 :winfsp-tests-x86-external-share
 O:
-"%ProjRoot%\build\VStudio\build\%Configuration%\winfsp-tests-x86.exe" --external --share=winfsp-tests-share=O:\ --resilient ^
+fltmc instances -v O: | findstr aswSnx >nul
-    -reparse_symlink*
+if !ERRORLEVEL! neq 0 (
+    "%ProjRoot%\build\VStudio\build\%Configuration%\winfsp-tests-x86.exe" --external --share=winfsp-tests-share=O:\ --resilient ^
+        -reparse_symlink*
+) else (
+    REM Avast present
+    "%ProjRoot%\build\VStudio\build\%Configuration%\winfsp-tests-x86.exe" --external --share=winfsp-tests-share=O:\ --resilient ^
+        -reparse_symlink* -querydir_buffer_overflow_test
+)
 if !ERRORLEVEL! neq 0 goto fail
 exit /b 0
 
@@ -380,14 +411,28 @@ exit /b 0
 
 :winfsp-tests-dotnet-external
 Q:
-"%ProjRoot%\build\VStudio\build\%Configuration%\winfsp-tests-x64.exe" --external --resilient
+fltmc instances -v Q: | findstr aswSnx >nul
+if !ERRORLEVEL! neq 0 (
+    "%ProjRoot%\build\VStudio\build\%Configuration%\winfsp-tests-x64.exe" --external --resilient
+) else (
+    REM Avast present
+    "%ProjRoot%\build\VStudio\build\%Configuration%\winfsp-tests-x64.exe" --external --resilient ^
+        -querydir_buffer_overflow_test
+)
 if !ERRORLEVEL! neq 0 goto fail
 exit /b 0
 
 :winfsp-tests-dotnet-external-share
 Q:
-"%ProjRoot%\build\VStudio\build\%Configuration%\winfsp-tests-x64.exe" --external --share=winfsp-tests-share=Q:\ --resilient ^
+fltmc instances -v Q: | findstr aswSnx >nul
-    -reparse_symlink*
+if !ERRORLEVEL! neq 0 (
+    "%ProjRoot%\build\VStudio\build\%Configuration%\winfsp-tests-x64.exe" --external --share=winfsp-tests-share=Q:\ --resilient ^
+        -reparse_symlink*
+) else (
+    REM Avast present
+    "%ProjRoot%\build\VStudio\build\%Configuration%\winfsp-tests-x64.exe" --external --share=winfsp-tests-share=Q:\ --resilient ^
+        -reparse_symlink* -querydir_buffer_overflow_test
+)
 if !ERRORLEVEL! neq 0 goto fail
 exit /b 0
 
@@ -681,6 +726,27 @@ call "%ProjRoot%\tools\fsreg" -u %1
 rmdir /s/q "%TMP%\%1"
 exit /b !RunSampleTestExit!
 
+:avast-tests-x64
+call :winfsp-tests-x64-external
+if !ERRORLEVEL! neq 0 goto fail
+call :winfsp-tests-x64-external-share
+if !ERRORLEVEL! neq 0 goto fail
+exit /b 0
+
+:avast-tests-x86
+call :winfsp-tests-x86-external
+if !ERRORLEVEL! neq 0 goto fail
+call :winfsp-tests-x86-external-share
+if !ERRORLEVEL! neq 0 goto fail
+exit /b 0
+
+:avast-tests-dotnet
+call :winfsp-tests-dotnet-external
+if !ERRORLEVEL! neq 0 goto fail
+call :winfsp-tests-dotnet-external-share
+if !ERRORLEVEL! neq 0 goto fail
+exit /b 0
+
 :leak-test
 for /F "tokens=1,2 delims=:" %%i in ('verifier /query ^| findstr ^
     /c:"Current Pool Allocations:" ^

tst/winfsp-tests/dirctl-test.c

@@ -202,6 +202,12 @@ static void querydir_dotest(ULONG Flags, PWSTR Prefix, ULONG FileInfoTimeout, UL
     ASSERT(INVALID_HANDLE_VALUE == Handle);
     ASSERT(ERROR_FILE_NOT_FOUND == GetLastError());
 
+    StringCbPrintfW(FilePath, sizeof FilePath, L"%s%s\\DOES-NOT-EXIST*",
+        Prefix ? L"" : L"\\\\?\\GLOBALROOT", Prefix ? Prefix : memfs_volumename(memfs));
+    Handle = FindFirstFileW(FilePath, &FindData);
+    ASSERT(INVALID_HANDLE_VALUE == Handle);
+    ASSERT(ERROR_FILE_NOT_FOUND == GetLastError());
+
     times[1] = GetTickCount();
     FspDebugLog(__FUNCTION__ "(Flags=%lx, Prefix=\"%S\", FileInfoTimeout=%ld, SleepTimeout=%ld): %ldms\n",
         Flags, Prefix, FileInfoTimeout, SleepTimeout, times[1] - times[0]);