From 9166ff8f343e9076208fe543d06dabcbcb88ebfc Mon Sep 17 00:00:00 2001
From: Art Yerkes <art.yerkes@gmail.com>
Date: Mon, 11 Apr 2005 06:03:20 +0000
Subject: [PATCH] lock: Fixes suggested by w3seek: protect the remaining
 MmProbeAndLockPages don't return from the exception handler

read: Hopefully the last indecision in here:

Avoid using AFD_EVENT_CLOSE until the socket is really toast.
Use AFD_EVENT_DISCONNECT instead when we've got an EOF, but still have
buffered data.
I was doing this socket fiddling without a callout block.  Fixed.

svn path=/trunk/; revision=14584
---
 reactos/drivers/net/afd/afd/lock.c | 18 ++++++++----------
 reactos/drivers/net/afd/afd/read.c |  9 +++++----
 2 files changed, 13 insertions(+), 14 deletions(-)

diff --git a/reactos/drivers/net/afd/afd/lock.c b/reactos/drivers/net/afd/afd/lock.c
index c173ead9ab5..3cb8fd81348 100644
--- a/reactos/drivers/net/afd/afd/lock.c
+++ b/reactos/drivers/net/afd/afd/lock.c
@@ -59,7 +59,14 @@ PAFD_WSABUF LockBuffers( PAFD_WSABUF Buf, UINT Count,
 
         _SEH_TRY {
             RtlCopyMemory( NewBuf, Buf, sizeof(AFD_WSABUF) * Count );
-            NewBufferLen = *AddressLen;
+            if( LockAddress ) {
+                NewBuf[Count].buf = AddressBuf;
+                NewBuf[Count].len = NewBufferLen;
+                Count++;
+                NewBuf[Count].buf = (PVOID)AddressLen;
+                NewBuf[Count].len = sizeof(*AddressLen);
+                Count++;
+            }
         } _SEH_HANDLE {
             AFD_DbgPrint(MIN_TRACE,("Access violation copying buffer info "
                                     "from userland (%x %x)\n", 
@@ -68,15 +75,6 @@ PAFD_WSABUF LockBuffers( PAFD_WSABUF Buf, UINT Count,
             return NULL;
         } _SEH_END;
 
-        if( LockAddress ) {
-            NewBuf[Count].buf = AddressBuf;
-            NewBuf[Count].len = NewBufferLen;
-            Count++;
-            NewBuf[Count].buf = (PVOID)AddressLen;
-            NewBuf[Count].len = sizeof(*AddressLen);
-            Count++;
-	}
-
 	for( i = 0; i < Count; i++ ) {
 	    AFD_DbgPrint(MID_TRACE,("Locking buffer %d (%x:%d)\n",
 				    i, NewBuf[i].buf, NewBuf[i].len));
diff --git a/reactos/drivers/net/afd/afd/read.c b/reactos/drivers/net/afd/afd/read.c
index 569da4619f2..179a78e7b4f 100644
--- a/reactos/drivers/net/afd/afd/read.c
+++ b/reactos/drivers/net/afd/afd/read.c
@@ -36,7 +36,7 @@ BOOLEAN CantReadMore( PAFD_FCB FCB ) {
 VOID HandleEOFOnIrp( PAFD_FCB FCB, NTSTATUS Status, UINT Information ) {
     if( Status == STATUS_SUCCESS && Information == 0 ) {
         AFD_DbgPrint(MID_TRACE,("Looks like an EOF\n"));
-        FCB->PollState |= AFD_EVENT_CLOSE /*| AFD_EVENT_DISCONNECT */;
+        FCB->PollState |= AFD_EVENT_DISCONNECT;
         PollReeval( FCB->DeviceExt, FCB->FileObject );
     }
 }
@@ -109,10 +109,11 @@ NTSTATUS TryToSatisfyRecvRequestFromBuffer( PAFD_FCB FCB,
 				 ReceiveComplete,
 				 FCB );
 
-            if( Status == STATUS_SUCCESS ) 
-                FCB->Recv.Content = FCB->ReceiveIrp.Iosb.Information;
-            HandleEOFOnIrp( FCB, Status, FCB->Recv.Content );
 	    SocketCalloutLeave( FCB );
+
+            if( Status == STATUS_SUCCESS )
+                FCB->Recv.Content = FCB->ReceiveIrp.Iosb.Information;
+            HandleEOFOnIrp( FCB, Status, FCB->ReceiveIrp.Iosb.Information );
 	}
     }