Merge branch 'v28-range-hrtimers-for-linus-v2' of git://git.kernel.org/pub/scm/linux...

[linux-2.6-omap-h63xx.git] / fs / cifs / cifssmb.c

diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 7504d1514c7743ba2de1185a7ad7c455b4a2beda..843a85fb8b9ac8a1189016be9ac59f6b0b8767f4 100644 (file)
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -1309,6 +1309,7 @@ OldOpenRetry:
                                cpu_to_le64(le32_to_cpu(pSMBr->EndOfFile));
                        pfile_info->EndOfFile = pfile_info->AllocationSize;
                        pfile_info->NumberOfLinks = cpu_to_le32(1);
+                       pfile_info->DeletePending = 0;
                }
        }
 
@@ -1410,6 +1411,7 @@ openRetry:
                    pfile_info->AllocationSize = pSMBr->AllocationSize;
                    pfile_info->EndOfFile = pSMBr->EndOfFile;
                    pfile_info->NumberOfLinks = cpu_to_le32(1);
+                   pfile_info->DeletePending = 0;
                }
        }
 
@@ -3614,6 +3616,8 @@ findFirstRetry:
                /* BB remember to free buffer if error BB */
                rc = validate_t2((struct smb_t2_rsp *)pSMBr);
                if (rc == 0) {
+                       unsigned int lnoff;
+
                        if (pSMBr->hdr.Flags2 & SMBFLG2_UNICODE)
                                psrch_inf->unicode = true;
                        else
@@ -3636,6 +3640,17 @@ findFirstRetry:
                                        le16_to_cpu(parms->SearchCount);
                        psrch_inf->index_of_last_entry = 2 /* skip . and .. */ +
                                psrch_inf->entries_in_buffer;
+                       lnoff = le16_to_cpu(parms->LastNameOffset);
+                       if (tcon->ses->server->maxBuf - MAX_CIFS_HDR_SIZE <
+                             lnoff) {
+                               cERROR(1, ("ignoring corrupt resume name"));
+                               psrch_inf->last_entry = NULL;
+                               return rc;
+                       }
+
+                       psrch_inf->last_entry = psrch_inf->srch_entries_start +
+                                                       lnoff;
+
                        *pnetfid = parms->SearchHandle;
                } else {
                        cifs_buf_release(pSMB);
@@ -3725,6 +3740,8 @@ int CIFSFindNext(const int xid, struct cifsTconInfo *tcon,
                rc = validate_t2((struct smb_t2_rsp *)pSMBr);
 
                if (rc == 0) {
+                       unsigned int lnoff;
+
                        /* BB fixme add lock for file (srch_info) struct here */
                        if (pSMBr->hdr.Flags2 & SMBFLG2_UNICODE)
                                psrch_inf->unicode = true;
@@ -3751,6 +3768,16 @@ int CIFSFindNext(const int xid, struct cifsTconInfo *tcon,
                                                le16_to_cpu(parms->SearchCount);
                        psrch_inf->index_of_last_entry +=
                                psrch_inf->entries_in_buffer;
+                       lnoff = le16_to_cpu(parms->LastNameOffset);
+                       if (tcon->ses->server->maxBuf - MAX_CIFS_HDR_SIZE <
+                             lnoff) {
+                               cERROR(1, ("ignoring corrupt resume name"));
+                               psrch_inf->last_entry = NULL;
+                               return rc;
+                       } else
+                               psrch_inf->last_entry =
+                                       psrch_inf->srch_entries_start + lnoff;
+
 /*  cFYI(1,("fnxt2 entries in buf %d index_of_last %d",
            psrch_inf->entries_in_buffer, psrch_inf->index_of_last_entry)); */