Hi!
> [ Upstream commit 2485bd7557a7edb4520b4072af464f0a08c8efe0 ]
>
> We only allow sending single credit writes through the SMB2_write() synchronous
> api so split this into smaller chunks.
I'm not sure if this matters, but if len is ever zero, we'll return
uninitialized value from the function.
Best regards,
Pavel
> +++ b/fs/cifs/smb2ops.c
> @@ -3466,7 +3466,7 @@ static int smb3_simple_fallocate_write_range(unsigned int xid,
> char *buf)
> {
> struct cifs_io_parms io_parms = {0};
> - int nbytes;
> + int rc, nbytes;
> struct kvec iov[2];
>
> io_parms.netfid = cfile->fid.netfid;
> @@ -3474,13 +3474,25 @@ static int smb3_simple_fallocate_write_range(unsigned int xid,
> io_parms.tcon = tcon;
> io_parms.persistent_fid = cfile->fid.persistent_fid;
> io_parms.volatile_fid = cfile->fid.volatile_fid;
> - io_parms.offset = off;
> - io_parms.length = len;
>
> - /* iov[0] is reserved for smb header */
> - iov[1].iov_base = buf;
> - iov[1].iov_len = io_parms.length;
> - return SMB2_write(xid, &io_parms, &nbytes, iov, 1);
> + while (len) {
> + io_parms.offset = off;
> + io_parms.length = len;
> + if (io_parms.length > SMB2_MAX_BUFFER_SIZE)
> + io_parms.length = SMB2_MAX_BUFFER_SIZE;
> + /* iov[0] is reserved for smb header */
> + iov[1].iov_base = buf;
> + iov[1].iov_len = io_parms.length;
> + rc = SMB2_write(xid, &io_parms, &nbytes, iov, 1);
> + if (rc)
> + break;
> + if (nbytes > len)
> + return -EINVAL;
> + buf += nbytes;
> + off += nbytes;
> + len -= nbytes;
> + }
> + return rc;
> }
>
> static int smb3_simple_fallocate_range(unsigned int xid,
--
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Attachment:
signature.asc
Description: Digital signature
