Bug Patched on 12.50 PS4

/*
 * aio_multi_delete - Delete multiple asynchronous I/O requests.
 *
 * Parameters:
 *   aioCtx          - Pointer to the AIO context structure.
 *   userReqArray    - Pointer to a user-space array with deletion request IDs.
 *   reqCount        - Number of deletion requests (should be less than 129).
 *   userResultsBuf  - Pointer to a user-space buffer for per-request status codes.
 *
 * Returns:
 *   An overall status code (unsigned long).
 */
unsigned long aio_multi_delete(void *aioCtx,
                                 uint64_t userReqArray,
                                 unsigned int reqCount,
                                 uint64_t userResultsBuf)
{
    /* --- Variable Declarations --- */
    AioInternal *internalAio;   // Internal AIO structure pointer.
    uint64_t aioState;          // Internal state value.
    int contextFlag;
    uint32_t localSingleReq = 0, localSingleErr = 0;
    uint32_t *reqBuffer = NULL; // Local copy of the user request array.
    uint32_t *errBuffer = NULL; // Local buffer for per-request error codes.
    size_t bufferSize;
    unsigned int effectiveReqCount;
    unsigned int i, reqValue, reqId;
    int reqIndex;
    short *lookupResult = NULL; // Pointer returned from the lookup function.
    unsigned int currentLookupId = 0;
    uint64_t lookupCookie = 0;  // (Patched) variable to mark lookup state.
    uint64_t stackCookieInitial;

    /* --- Stack Integrity Setup --- */
    // (Patched) Record initial stack cookie to check for stack corruption later.
    stackCookieInitial = GLOBAL_STACK_COOKIE;

    /* --- Get Internal AIO Context --- */
    internalAio = *(AioInternal **)((char *)aioCtx + 8);
    aioState = internalAio->stateField;  // e.g., offset 0xAB8.

    /* --- Determine Context Flag --- */
    contextFlag = (internalAio == globalAioInternal) ? 0 : -1;
    if (internalAio->flagField != -1) {
        contextFlag = internalAio->flagField;
    }

    /* --- Check if Multi-Delete Is Enabled --- */
    if (configMultiDeleteEnabled(contextFlag)) {
multi_delete:
        /* --- Validate Request Count --- */
        // PATCHED: The patched code uses "if (reqCount - 1 < 0x80)" instead of "if (reqCount < 129)".
        if (reqCount - 1 < 0x80) {
            // Save the userResultsBuf for later use.
            // (In the decompiled code, this was stored in a stack slot.)
            uint64_t localResultsBuf = userResultsBuf;

            /* --- Prepare Local Buffers --- */
            if (reqCount < 2) {
                reqBuffer = &localSingleReq;
                errBuffer = &localSingleErr;
                bufferSize = 4;
                effectiveReqCount = 1;
            } else {
                effectiveReqCount = reqCount;
                bufferSize = effectiveReqCount * 4;
                // PATCHED: Align the buffers to a 16-byte boundary.
                size_t alignedSize = (bufferSize + 0xF) & ~0xF;
                // (Original code simply computed an offset; here we simulate that.)
                reqBuffer = (uint32_t *)alloca(alignedSize);
                errBuffer = (uint32_t *)alloca(alignedSize);
                // PATCHED: Write a magic header value for debugging.
                // Original code did not include this extra write.
                ((uint64_t *)errBuffer)[-2] = 0xffffffff8231f7c1;
                // PATCHED: Explicitly clear the error buffer.
                memset(errBuffer, 0, bufferSize);
            }

            /* --- Copy in User-Space Data --- */
            debug_log("copyin", aioState);
            if (copyin_data(userReqArray, reqBuffer, bufferSize) == 0) {
                // Initialize lookup tracking.
                lookupCookie = 0;  // Initially, no active lookup.
                for (i = 0; i < effectiveReqCount; i++) {
                    reqValue = reqBuffer[i];
                    errBuffer[i] = 0;  // Assume success.

                    // Validate request value.
                    if ((reqValue < 0x800000) && ((reqId = reqValue & 0xFFFF) != 0)) {
                        // If we have a new request ID, perform a lookup.
                        if (reqId != currentLookupId) {
                            // PATCHED: If a previous lookup was active, release it.
                            if (lookupCookie != 0) {
                                release_lookup_resource(lookupResult);
                            }
                            // (Original code did not explicitly reset lookupCookie.)
                            lookupResult = lookup_aio_request(aioState, reqId, 0x160, &lookupCookie);
                            if (lookupResult == NULL) {
                                errBuffer[i] = ERROR_NOT_FOUND;  // e.g., 0x80020003.
                                lookupCookie = 0; // PATCHED: Reset lookupCookie.
                                goto next_request;
                            }
                            currentLookupId = reqId;
                            // PATCHED: Mark that lookup is active.
                            lookupCookie = 1;
                        }
                        // If lookupResult is still NULL, error out.
                        if (lookupResult == NULL) {
                            errBuffer[i] = ERROR_NOT_FOUND;
                            log_error("_aio_multi_delete", __LINE__, i, ERROR_NOT_FOUND);
                        } else {
                            // Extract the request index from the high 16 bits.
                            reqIndex = reqValue >> 16;
                            if (reqIndex < lookupResult->numEntries) {
                                // Validate that the AIO request is still valid.
                                if (validate_aio_request(aioState) == 0) {
                                    RequestEntry *entry = lookupResult->entries[reqIndex];
                                    if (entry == NULL) {
                                        errBuffer[i] = ERROR_NOT_FOUND;
                                        log_error("_aio_multi_delete", __LINE__, i, ERROR_NOT_FOUND);
                                    } else {
                                        // Process the deletion for this entry.
                                        if (process_request_entry(entry, lookupResult) != 0) {
                                            errBuffer[i] = ERROR_PROCESSING;
                                            log_error("_aio_multi_delete", __LINE__, i, ERROR_PROCESSING);
                                        }
                                    }
                                } else {
                                    errBuffer[i] = ERROR_INVALID;
                                    log_error("_aio_multi_delete", __LINE__, i, ERROR_INVALID);
                                }
                            } else {
                                errBuffer[i] = ERROR_INVALID_INDEX;
                            }
                        }
                    } else {
                        errBuffer[i] = ERROR_NOT_FOUND;
                    }
next_request:
                    ; // Continue to next request.
                } // End for-loop.

                // PATCHED: Clean up any active lookup resource.
                if (lookupCookie != 0) {
                    release_lookup_resource(lookupResult);
                }

                /* --- Copy out Error Codes to User Space --- */
                debug_log("copyout", aioState);
                int copyoutStatus = copyout_data(errBuffer, localResultsBuf, bufferSize);
                return (unsigned long)copyoutStatus;
            } else {
                // If copyin failed, log the error.
                int copyinErr = copyin_data(userReqArray, reqBuffer, bufferSize);
                log_error("_aio_multi_delete", __LINE__, copyinErr, copyinErr);
                return (unsigned long)copyinErr;
            }
        } else {
            // PATCHED: Return an error if too many requests are provided.
            log_error("_aio_multi_delete", __LINE__, REQUEST_COUNT_ERROR, REQUEST_COUNT_ERROR);
            return REQUEST_COUNT_ERROR;
        }
    } else {
        // Fallback configuration check.
        unsigned int configStatus = get_config_flag(1, baseConfig + ((contextFlag != 0) ? OFFSET_VALUE : 0));
        if (configStatus == 0)
            goto multi_delete;
        log_error("_aio_multi_delete", __LINE__, configStatus, configStatus);
        return configStatus;
    }

    /* --- Check Stack Integrity --- */
    // PATCHED: Verify that the stack cookie has not been altered.
    if (GLOBAL_STACK_COOKIE != stackCookieInitial) {
        panic("Stack integrity violation in aio_multi_delete");
    }

    return 0;
}