FSCTL_READ_FILE_USN_DATA on "SmartScreen" alternate data stream

[Andrew Walker]

On Thu, Nov 10, 2022 at 4:08 PM Jeremy Allison <jra at samba.org> wrote:

> On Thu, Nov 10, 2022 at 04:03:28PM -0500, Andrew Walker via
> samba-technical wrote:
> >> Can you give the entire call stack. Might be easier to just change the
> >upper level code to pass on metadata_fsp(fsp) instead.
> >
> >Yeah, that's not a problem. I'll also attach my WIP torture test at bottom
> >of this email to save you perhaps a little effort. Let me know if
> >formatting gets blown up and I'll email git diff. Torture test against
> >windows server succeeds BTW (STATUS_OK).
>
> Yeah, the formatting got blown up. git diff please :-).
>

See attached. Diff based on v4-17-stable
I've had four reports in the past week of crashes here. Seems like some
Windows clients are doing FSCTL ops on ZoneIdentifier streams as well.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: fsctl-streams.patch
Type: application/octet-stream
Size: 5485 bytes
Desc: not available
URL: <http://lists.samba.org/pipermail/samba-technical/attachments/20221110/96b41856/fsctl-streams.obj>