5 files changed, 17 insertions, 14 deletions

diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 3539d6ef9611..d04d2f7448d9 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -1,3 +1,7 @@
+Version 1.47
+------------
+Fix oops in list_del during mount caused by unaligned string.
+
 Version 1.46
 ------------
 Support deep tree mounts.  Better support OS/2, Win9x (DOS) time stamps.
diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
index 96abeb738978..6017c465440e 100644
--- a/fs/cifs/cifs_debug.c
+++ b/fs/cifs/cifs_debug.c
@@ -143,8 +143,8 @@ cifs_debug_data_read(char *buf, char **beginBuffer, off_t offset,
                 ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
                 if((ses->serverDomain == NULL) || (ses->serverOS == NULL) ||
                    (ses->serverNOS == NULL)) {
-                        buf += sprintf("\nentry for %s not fully displayed\n\t",
-                                        ses->serverName);
+                        buf += sprintf(buf, "\nentry for %s not fully "
+                                        "displayed\n\t", ses->serverName);
                         
                 } else {
                         length =
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index a243f779b363..8aa66dcf13bd 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -100,5 +100,5 @@ extern ssize_t	cifs_getxattr(struct dentry *, const char *, void *, size_t);
 extern ssize_t  cifs_listxattr(struct dentry *, char *, size_t);
 extern int cifs_ioctl (struct inode * inode, struct file * filep,
                        unsigned int command, unsigned long arg);
-#define CIFS_VERSION   "1.46"
+#define CIFS_VERSION   "1.47"
 #endif                          /* _CIFSFS_H */
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index aedf683f011f..19cc294c7c70 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -71,9 +71,7 @@ sesInfoAlloc(void)
 {
         struct cifsSesInfo *ret_buf;
 
-        ret_buf =
-            (struct cifsSesInfo *) kzalloc(sizeof (struct cifsSesInfo),
-                                           GFP_KERNEL);
+        ret_buf = kzalloc(sizeof (struct cifsSesInfo), GFP_KERNEL);
         if (ret_buf) {
                 write_lock(&GlobalSMBSeslock);
                 atomic_inc(&sesInfoAllocCount);
@@ -109,9 +107,7 @@ struct cifsTconInfo *
 tconInfoAlloc(void)
 {
         struct cifsTconInfo *ret_buf;
-        ret_buf =
-            (struct cifsTconInfo *) kzalloc(sizeof (struct cifsTconInfo),
-                                            GFP_KERNEL);
+        ret_buf = kzalloc(sizeof (struct cifsTconInfo), GFP_KERNEL);
         if (ret_buf) {
                 write_lock(&GlobalSMBSeslock);
                 atomic_inc(&tconInfoAllocCount);
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index bbdda99dce61..758464630893 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -182,11 +182,14 @@ static int decode_unicode_ssetup(char ** pbcc_area, int bleft, struct cifsSesInf
         cFYI(1,("bleft %d",bleft));
 
 
-        /* word align, if bytes remaining is not even */
-        if(bleft % 2) {
-                bleft--;
-                data++;
-        }
+        /* SMB header is unaligned, so cifs servers word align start of
+           Unicode strings */
+        data++;
+        bleft--; /* Windows servers do not always double null terminate
+                    their final Unicode string - in which case we
+                    now will not attempt to decode the byte of junk
+                    which follows it */
+                    
         words_left = bleft / 2;
 
         /* save off server operating system */