Merge branch 'master'

2 files changed, 8 insertions, 1 deletions

diff --git a/fs/smbfs/dir.c b/fs/smbfs/dir.c
index 34c7a11d91f0..70d9c5a37f5a 100644
--- a/fs/smbfs/dir.c
+++ b/fs/smbfs/dir.c
@@ -434,6 +434,11 @@ smb_lookup(struct inode *dir, struct dentry *dentry, struct nameidata *nd)
         if (dentry->d_name.len > SMB_MAXNAMELEN)
                 goto out;
 
+        /* Do not allow lookup of names with backslashes in */
+        error = -EINVAL;
+        if (memchr(dentry->d_name.name, '\\', dentry->d_name.len))
+                goto out;
+
         lock_kernel();
         error = smb_proc_getattr(dentry, &finfo);
 #ifdef SMBFS_PARANOIA
diff --git a/fs/smbfs/request.c b/fs/smbfs/request.c
index c71c375863cc..c71dd2760d32 100644
--- a/fs/smbfs/request.c
+++ b/fs/smbfs/request.c
@@ -339,9 +339,11 @@ int smb_add_request(struct smb_request *req)
                 /*
                  * On timeout or on interrupt we want to try and remove the
                  * request from the recvq/xmitq.
+                 * First check if the request is still part of a queue. (May
+                 * have been removed by some error condition)
                  */
                 smb_lock_server(server);
-                if (!(req->rq_flags & SMB_REQ_RECEIVED)) {
+                if (!list_empty(&req->rq_queue)) {
                         list_del_init(&req->rq_queue);
                         smb_rput(req);
                 }