1 files changed, 6 insertions, 2 deletions

diff --git a/fs/cifs/smb2file.c b/fs/cifs/smb2file.c
index 4ed10dd086e6..b204e84b87fb 100644
--- a/fs/cifs/smb2file.c
+++ b/fs/cifs/smb2file.c
@@ -122,12 +122,14 @@ smb2_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock,
 
         /*
          * Accessing maxBuf is racy with cifs_reconnect - need to store value
-         * and check it for zero before using.
+         * and check it before using.
          */
         max_buf = tcon->ses->server->maxBuf;
-        if (!max_buf)
+        if (max_buf < sizeof(struct smb2_lock_element))
                 return -EINVAL;
 
+        BUILD_BUG_ON(sizeof(struct smb2_lock_element) > PAGE_SIZE);
+        max_buf = min_t(unsigned int, max_buf, PAGE_SIZE);
         max_num = max_buf / sizeof(struct smb2_lock_element);
         buf = kcalloc(max_num, sizeof(struct smb2_lock_element), GFP_KERNEL);
         if (!buf)
@@ -264,6 +266,8 @@ smb2_push_mandatory_locks(struct cifsFileInfo *cfile)
                 return -EINVAL;
         }
 
+        BUILD_BUG_ON(sizeof(struct smb2_lock_element) > PAGE_SIZE);
+        max_buf = min_t(unsigned int, max_buf, PAGE_SIZE);
         max_num = max_buf / sizeof(struct smb2_lock_element);
         buf = kcalloc(max_num, sizeof(struct smb2_lock_element), GFP_KERNEL);
         if (!buf) {