Merge tag '4.15-rc-smb3' of git://git.samba.org/sfrench/cifs-2.6

Pull cifs fixes from Steve French:
 "Small SMB3 fixes for stable and 4.15rc"

* tag '4.15-rc-smb3' of git://git.samba.org/sfrench/cifs-2.6:
  CIFS: don't log STATUS_NOT_FOUND errors for DFS
  cifs: fix NULL deref in SMB2_read

2 files changed, 17 insertions, 16 deletions

diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index e06740436b92..ed88ab8a4774 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -1406,7 +1406,8 @@ smb2_get_dfs_refer(const unsigned int xid, struct cifs_ses *ses,
         } while (rc == -EAGAIN);
 
         if (rc) {
-                cifs_dbg(VFS, "ioctl error in smb2_get_dfs_refer rc=%d\n", rc);
+                if (rc != -ENOENT)
+                        cifs_dbg(VFS, "ioctl error in smb2_get_dfs_refer rc=%d\n", rc);
                 goto out;
         }
 
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 5331631386a2..01346b8b6edb 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -2678,27 +2678,27 @@ SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms,
         cifs_small_buf_release(req);
 
         rsp = (struct smb2_read_rsp *)rsp_iov.iov_base;
-        shdr = get_sync_hdr(rsp);
 
-        if (shdr->Status == STATUS_END_OF_FILE) {
+        if (rc) {
+                if (rc != -ENODATA) {
+                        cifs_stats_fail_inc(io_parms->tcon, SMB2_READ_HE);
+                        cifs_dbg(VFS, "Send error in read = %d\n", rc);
+                }
                 free_rsp_buf(resp_buftype, rsp_iov.iov_base);
-                return 0;
+                return rc == -ENODATA ? 0 : rc;
         }
 
-        if (rc) {
-                cifs_stats_fail_inc(io_parms->tcon, SMB2_READ_HE);
-                cifs_dbg(VFS, "Send error in read = %d\n", rc);
-        } else {
-                *nbytes = le32_to_cpu(rsp->DataLength);
-                if ((*nbytes > CIFS_MAX_MSGSIZE) ||
-                    (*nbytes > io_parms->length)) {
-                        cifs_dbg(FYI, "bad length %d for count %d\n",
-                                 *nbytes, io_parms->length);
-                        rc = -EIO;
-                        *nbytes = 0;
-                }
+        *nbytes = le32_to_cpu(rsp->DataLength);
+        if ((*nbytes > CIFS_MAX_MSGSIZE) ||
+            (*nbytes > io_parms->length)) {
+                cifs_dbg(FYI, "bad length %d for count %d\n",
+                         *nbytes, io_parms->length);
+                rc = -EIO;
+                *nbytes = 0;
         }
 
+        shdr = get_sync_hdr(rsp);
+
         if (*buf) {
                 memcpy(*buf, (char *)shdr + rsp->DataOffset, *nbytes);
                 free_rsp_buf(resp_buftype, rsp_iov.iov_base);