cifs: handle errors from coalesce_t2

cifs_demultiplex_thread calls coalesce_t2 to try and merge follow-on t2
responses into the original mid buffer. coalesce_t2 however can return
errors, but the caller doesn't handle that situation properly. Fix the
thread to treat such a case as it would a malformed packet. Mark the
mid as being malformed and issue the callback.

Cc: stable@kernel.org
Acked-by: David Howells <dhowells@redhat.com>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>

diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index bfbf323..05f1dcf 100644 (file)
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -630,12 +630,16 @@ incomplete_rcv:
                                isMultiRsp = true;
                                if (mid_entry->resp_buf) {
                                        /* merge response - fix up 1st*/
-                                       if (coalesce_t2(smb_buffer,
-                                                       mid_entry->resp_buf)) {
+                                       length = coalesce_t2(smb_buffer,
+                                                       mid_entry->resp_buf);
+                                       if (length > 0) {
+                                               length = 0;
                                                mid_entry->multiRsp = true;
                                                break;
                                        } else {
-                                               /* all parts received */
+                                               /* all parts received or
+                                                * packet is malformed
+                                                */
                                                mid_entry->multiEnd = true;
                                                goto multi_t2_fnd;
                                        }