Signed-off-by: Ronnie Sahlberg <lsahlber@xxxxxxxxxx>
---
fs/cifs/connect.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index c832a8a1970a..4b82cf77da78 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -970,6 +970,17 @@ cifs_demultiplex_thread(void *p)
mids[i]->resp_buf,
server);
+ /*
+ * Only invoke the callback for the last
+ * PDU in a compound chain.
+ * This prevents a bug from triggering a
+ * crash in dequeue_mid()
+ */
+ if (server->ops->next_header &&
+ server->ops->next_header(mids[i]->resp_buf)) {
+ mids[i]->multiRsp = 1;
+ mids[i]->multiEnd = 0;
+ }
if (!mids[i]->multiRsp || mids[i]->multiEnd)
mids[i]->callback(mids[i]);
--
2.13.3
