From 78ad433718469ec4040251728afb583cab14877d Mon Sep 17 00:00:00 2001
From: Thomas Faber <thomas.faber@reactos.org>
Date: Sat, 29 Oct 2016 20:30:49 +0000
Subject: [PATCH] [FASTFAT] - Only lock down the user buffer in the non-cached
 read/write case. CcCopyRead/CcCopyWrite takes care of this in the cached
 case, and does not impose a size limit like an MDL does. CORE-12132 #resolve

svn path=/trunk/; revision=73072
---
 reactos/drivers/filesystems/fastfat/rw.c | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/reactos/drivers/filesystems/fastfat/rw.c b/reactos/drivers/filesystems/fastfat/rw.c
index 23e91d0d932..fd0a396bcfe 100644
--- a/reactos/drivers/filesystems/fastfat/rw.c
+++ b/reactos/drivers/filesystems/fastfat/rw.c
@@ -656,11 +656,6 @@ VfatRead(
     }
 
     Buffer = VfatGetUserBuffer(IrpContext->Irp, BooleanFlagOn(IrpContext->Irp->Flags, IRP_PAGING_IO));
-    Status = VfatLockUserBuffer(IrpContext->Irp, Length, IoWriteAccess);
-    if (!NT_SUCCESS(Status))
-    {
-        goto ByeBye;
-    }
 
     if (!(IrpContext->Irp->Flags & (IRP_NOCACHE|IRP_PAGING_IO)) &&
         !(Fcb->Flags & (FCB_IS_PAGE_FILE|FCB_IS_VOLUME)))
@@ -711,6 +706,12 @@ VfatRead(
     else
     {
         // non cached read
+        Status = VfatLockUserBuffer(IrpContext->Irp, Length, IoWriteAccess);
+        if (!NT_SUCCESS(Status))
+        {
+            goto ByeBye;
+        }
+
         if (ByteOffset.QuadPart + Length > ROUND_UP_64(Fcb->RFCB.FileSize.QuadPart, BytesPerSector))
         {
             Length = (ULONG)(ROUND_UP_64(Fcb->RFCB.FileSize.QuadPart, BytesPerSector) - ByteOffset.QuadPart);
@@ -921,12 +922,6 @@ VfatWrite(
     }
 
     Buffer = VfatGetUserBuffer(IrpContext->Irp, BooleanFlagOn(IrpContext->Irp->Flags, IRP_PAGING_IO));
-    Status = VfatLockUserBuffer(IrpContext->Irp, Length, IoReadAccess);
-    if (!NT_SUCCESS(Status))
-    {
-        Status = STATUS_INVALID_USER_BUFFER;
-        goto ByeBye;
-    }
 
     if (!(Fcb->Flags & (FCB_IS_FAT|FCB_IS_VOLUME)) &&
         !(IrpContext->Irp->Flags & IRP_PAGING_IO) &&
@@ -987,6 +982,12 @@ VfatWrite(
     else
     {
         // non cached write
+        Status = VfatLockUserBuffer(IrpContext->Irp, Length, IoReadAccess);
+        if (!NT_SUCCESS(Status))
+        {
+            Status = STATUS_INVALID_USER_BUFFER;
+            goto ByeBye;
+        }
 
         if (ByteOffset.QuadPart > OldFileSize.QuadPart)
         {