4 files changed, 18 insertions, 31 deletions

diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index b7df4bff3aaa..602326fa4a4f 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -453,8 +453,7 @@ CIFSSMBNegotiate(unsigned int xid, struct cifs_ses *ses)
                 }
                 server->sec_mode = (__u8)le16_to_cpu(rsp->SecurityMode);
                 server->maxReq = le16_to_cpu(rsp->MaxMpxCount);
-                server->maxBuf = min((__u32)le16_to_cpu(rsp->MaxBufSize),
-                                (__u32)CIFSMaxBufSize + MAX_CIFS_HDR_SIZE);
+                server->maxBuf = le16_to_cpu(rsp->MaxBufSize);
                 server->max_vcs = le16_to_cpu(rsp->MaxNumberVcs);
                 /* even though we do not use raw we might as well set this
                 accurately, in case we ever find a need for it */
@@ -561,8 +560,7 @@ CIFSSMBNegotiate(unsigned int xid, struct cifs_ses *ses)
            little endian */
         server->maxReq = le16_to_cpu(pSMBr->MaxMpxCount);
         /* probably no need to store and check maxvcs */
-        server->maxBuf = min(le32_to_cpu(pSMBr->MaxBufferSize),
-                        (__u32) CIFSMaxBufSize + MAX_CIFS_HDR_SIZE);
+        server->maxBuf = le32_to_cpu(pSMBr->MaxBufferSize);
         server->max_rw = le32_to_cpu(pSMBr->MaxRawSize);
         cFYI(DBG2, "Max buf = %d", ses->server->maxBuf);
         server->capabilities = le32_to_cpu(pSMBr->Capabilities);
@@ -2812,8 +2810,7 @@ CIFSSMBQueryReparseLinkInfo(const int xid, struct cifs_tcon *tcon,
         pSMB->TotalDataCount = 0;
         pSMB->MaxParameterCount = cpu_to_le32(2);
         /* BB find exact data count max from sess structure BB */
-        pSMB->MaxDataCount = cpu_to_le32((tcon->ses->server->maxBuf -
-                                          MAX_CIFS_HDR_SIZE) & 0xFFFFFF00);
+        pSMB->MaxDataCount = cpu_to_le32(CIFSMaxBufSize & 0xFFFFFF00);
         pSMB->MaxSetupCount = 4;
         pSMB->Reserved = 0;
         pSMB->ParameterOffset = 0;
@@ -3306,8 +3303,7 @@ smb_init_nttransact(const __u16 sub_command, const int setup_count,
         pSMB->Reserved = 0;
         pSMB->TotalParameterCount = cpu_to_le32(parm_len);
         pSMB->TotalDataCount  = 0;
-        pSMB->MaxDataCount = cpu_to_le32((tcon->ses->server->maxBuf -
-                                          MAX_CIFS_HDR_SIZE) & 0xFFFFFF00);
+        pSMB->MaxDataCount = cpu_to_le32(CIFSMaxBufSize & 0xFFFFFF00);
         pSMB->ParameterCount = pSMB->TotalParameterCount;
         pSMB->DataCount  = pSMB->TotalDataCount;
         temp_offset = offsetof(struct smb_com_ntransact_req, Parms) +
@@ -3977,8 +3973,7 @@ findFirstRetry:
         params = 12 + name_len /* includes null */ ;
         pSMB->TotalDataCount = 0;       /* no EAs */
         pSMB->MaxParameterCount = cpu_to_le16(10);
-        pSMB->MaxDataCount = cpu_to_le16((tcon->ses->server->maxBuf -
-                                          MAX_CIFS_HDR_SIZE) & 0xFFFFFF00);
+        pSMB->MaxDataCount = cpu_to_le16(CIFSMaxBufSize & 0xFFFFFF00);
         pSMB->MaxSetupCount = 0;
         pSMB->Reserved = 0;
         pSMB->Flags = 0;
@@ -4052,8 +4047,7 @@ findFirstRetry:
                         psrch_inf->index_of_last_entry = 2 /* skip . and .. */ +
                                 psrch_inf->entries_in_buffer;
                         lnoff = le16_to_cpu(parms->LastNameOffset);
-                        if (tcon->ses->server->maxBuf - MAX_CIFS_HDR_SIZE <
-                              lnoff) {
+                        if (CIFSMaxBufSize < lnoff) {
                                 cERROR(1, "ignoring corrupt resume name");
                                 psrch_inf->last_entry = NULL;
                                 return rc;
@@ -4097,9 +4091,7 @@ int CIFSFindNext(const int xid, struct cifs_tcon *tcon,
         byte_count = 0;
         pSMB->TotalDataCount = 0;       /* no EAs */
         pSMB->MaxParameterCount = cpu_to_le16(8);
-        pSMB->MaxDataCount =
-                cpu_to_le16((tcon->ses->server->maxBuf - MAX_CIFS_HDR_SIZE) &
-                                0xFFFFFF00);
+        pSMB->MaxDataCount = cpu_to_le16(CIFSMaxBufSize & 0xFFFFFF00);
         pSMB->MaxSetupCount = 0;
         pSMB->Reserved = 0;
         pSMB->Flags = 0;
@@ -4181,8 +4173,7 @@ int CIFSFindNext(const int xid, struct cifs_tcon *tcon,
                         psrch_inf->index_of_last_entry +=
                                 psrch_inf->entries_in_buffer;
                         lnoff = le16_to_cpu(parms->LastNameOffset);
-                        if (tcon->ses->server->maxBuf - MAX_CIFS_HDR_SIZE <
-                              lnoff) {
+                        if (CIFSMaxBufSize < lnoff) {
                                 cERROR(1, "ignoring corrupt resume name");
                                 psrch_inf->last_entry = NULL;
                                 return rc;
@@ -6035,12 +6026,7 @@ int CIFSSMBNotify(const int xid, struct cifs_tcon *tcon,
         pSMB->TotalParameterCount = 0 ;
         pSMB->TotalDataCount = 0;
         pSMB->MaxParameterCount = cpu_to_le32(2);
-        /* BB find exact data count max from sess structure BB */
-        pSMB->MaxDataCount = 0; /* same in little endian or be */
-/* BB VERIFY verify which is correct for above BB */
-        pSMB->MaxDataCount = cpu_to_le32((tcon->ses->server->maxBuf -
-                                             MAX_CIFS_HDR_SIZE) & 0xFFFFFF00);
-
+        pSMB->MaxDataCount = cpu_to_le32(CIFSMaxBufSize & 0xFFFFFF00);
         pSMB->MaxSetupCount = 4;
         pSMB->Reserved = 0;
         pSMB->ParameterOffset = 0;
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 71beb0201970..a0077a5e0669 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -181,7 +181,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
                 -EINVAL = invalid transact2
 
  */
-static int check2ndT2(struct smb_hdr *pSMB, unsigned int maxBufSize)
+static int check2ndT2(struct smb_hdr *pSMB)
 {
         struct smb_t2_rsp *pSMBt;
         int remaining;
@@ -214,9 +214,9 @@ static int check2ndT2(struct smb_hdr *pSMB, unsigned int maxBufSize)
 
         cFYI(1, "missing %d bytes from transact2, check next response",
                 remaining);
-        if (total_data_size > maxBufSize) {
+        if (total_data_size > CIFSMaxBufSize) {
                 cERROR(1, "TotalDataSize %d is over maximum buffer %d",
-                        total_data_size, maxBufSize);
+                        total_data_size, CIFSMaxBufSize);
                 return -EINVAL;
         }
         return remaining;
@@ -486,7 +486,7 @@ find_cifs_mid(struct TCP_Server_Info *server, struct smb_hdr *buf,
                     mid->command != buf->Command)
                         continue;
 
-                if (*length == 0 && check2ndT2(buf, server->maxBuf) > 0) {
+                if (*length == 0 && check2ndT2(buf) > 0) {
                         /* We have a multipart transact2 resp */
                         *is_multi_rsp = true;
                         if (mid->resp_buf) {
@@ -3130,8 +3130,7 @@ try_mount_again:
                 cFYI(DBG2, "no very large read support, rsize now 127K");
         }
         if (!(tcon->ses->capabilities & CAP_LARGE_READ_X))
-                cifs_sb->rsize = min(cifs_sb->rsize,
-                               (tcon->ses->server->maxBuf - MAX_CIFS_HDR_SIZE));
+                cifs_sb->rsize = min(cifs_sb->rsize, CIFSMaxBufSize);
 
         cifs_sb->wsize = cifs_negotiate_wsize(tcon, volume_info);
 
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 9f41a10523a1..fd57165f55fa 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -1868,7 +1868,7 @@ static ssize_t cifs_read(struct file *file, char *read_data, size_t read_size,
                 if ((pTcon->ses) &&
                         !(pTcon->ses->capabilities & CAP_LARGE_FILES)) {
                         current_read_size = min_t(const int, current_read_size,
-                                        pTcon->ses->server->maxBuf - 128);
+                                        CIFSMaxBufSize);
                 }
                 rc = -EAGAIN;
                 while (rc == -EAGAIN) {
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index d3e619692ee0..c7d80e24f24e 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -124,7 +124,9 @@ static __u32 cifs_ssetup_hdr(struct cifs_ses *ses, SESSION_SETUP_ANDX *pSMB)
         /*      that we use in next few lines                               */
         /* Note that header is initialized to zero in header_assemble */
         pSMB->req.AndXCommand = 0xFF;
-        pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
+        pSMB->req.MaxBufferSize = cpu_to_le16(min_t(u32,
+                                        CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4,
+                                        USHRT_MAX));
         pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
         pSMB->req.VcNumber = get_next_vcnum(ses);