1 files changed, 17 insertions, 13 deletions

diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 8fecc99be344..da2f5446fa7a 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -3892,13 +3892,12 @@ CIFSSMBSetCIFSACL(const int xid, struct cifs_tcon *tcon, __u16 fid,
         int rc = 0;
         int bytes_returned = 0;
         SET_SEC_DESC_REQ *pSMB = NULL;
-        NTRANSACT_RSP *pSMBr = NULL;
+        void *pSMBr;
 
 setCifsAclRetry:
-        rc = smb_init(SMB_COM_NT_TRANSACT, 19, tcon, (void **) &pSMB,
-                        (void **) &pSMBr);
+        rc = smb_init(SMB_COM_NT_TRANSACT, 19, tcon, (void **) &pSMB, &pSMBr);
         if (rc)
-                        return (rc);
+                return rc;
 
         pSMB->MaxSetupCount = 0;
         pSMB->Reserved = 0;
@@ -3926,9 +3925,8 @@ setCifsAclRetry:
         pSMB->AclFlags = cpu_to_le32(aclflag);
 
         if (pntsd && acllen) {
-                memcpy((char *) &pSMBr->hdr.Protocol + data_offset,
-                        (char *) pntsd,
-                        acllen);
+                memcpy((char *)pSMBr + offsetof(struct smb_hdr, Protocol) +
+                                data_offset, pntsd, acllen);
                 inc_rfc1001_len(pSMB, byte_count + data_count);
         } else
                 inc_rfc1001_len(pSMB, byte_count);
@@ -4846,8 +4844,12 @@ parse_DFS_referrals(TRANSACTION2_GET_DFS_REFER_RSP *pSMBr,
                 max_len = data_end - temp;
                 node->node_name = cifs_strndup_from_utf16(temp, max_len,
                                                 is_unicode, nls_codepage);
-                if (!node->node_name)
+                if (!node->node_name) {
                         rc = -ENOMEM;
+                        goto parse_DFS_referrals_exit;
+                }
+
+                ref++;
         }
 
 parse_DFS_referrals_exit:
@@ -5708,7 +5710,8 @@ CIFSSMBSetFileInfo(const int xid, struct cifs_tcon *tcon,
         param_offset = offsetof(struct smb_com_transaction2_sfi_req, Fid) - 4;
         offset = param_offset + params;
 
-        data_offset = (char *) (&pSMB->hdr.Protocol) + offset;
+        data_offset = (char *)pSMB +
+                        offsetof(struct smb_hdr, Protocol) + offset;
 
         count = sizeof(FILE_BASIC_INFO);
         pSMB->MaxParameterCount = cpu_to_le16(2);
@@ -5977,7 +5980,7 @@ CIFSSMBUnixSetFileInfo(const int xid, struct cifs_tcon *tcon,
                        u16 fid, u32 pid_of_opener)
 {
         struct smb_com_transaction2_sfi_req *pSMB  = NULL;
-        FILE_UNIX_BASIC_INFO *data_offset;
+        char *data_offset;
         int rc = 0;
         u16 params, param_offset, offset, byte_count, count;
 
@@ -5999,8 +6002,9 @@ CIFSSMBUnixSetFileInfo(const int xid, struct cifs_tcon *tcon,
         param_offset = offsetof(struct smb_com_transaction2_sfi_req, Fid) - 4;
         offset = param_offset + params;
 
-        data_offset = (FILE_UNIX_BASIC_INFO *)
-                                ((char *)(&pSMB->hdr.Protocol) + offset);
+        data_offset = (char *)pSMB +
+                        offsetof(struct smb_hdr, Protocol) + offset;
+
         count = sizeof(FILE_UNIX_BASIC_INFO);
 
         pSMB->MaxParameterCount = cpu_to_le16(2);
@@ -6022,7 +6026,7 @@ CIFSSMBUnixSetFileInfo(const int xid, struct cifs_tcon *tcon,
         inc_rfc1001_len(pSMB, byte_count);
         pSMB->ByteCount = cpu_to_le16(byte_count);
 
-        cifs_fill_unix_set_info(data_offset, args);
+        cifs_fill_unix_set_info((FILE_UNIX_BASIC_INFO *)data_offset, args);
 
         rc = SendReceiveNoRsp(xid, tcon->ses, (char *) pSMB, 0);
         if (rc)