Hi!

> [ Upstream commit 2485bd7557a7edb4520b4072af464f0a08c8efe0 ]
> 
> We only allow sending single credit writes through the SMB2_write() synchronous
> api so split this into smaller chunks.

I'm not sure if this matters, but if len is ever zero, we'll return
uninitialized value from the function.

Best regards,
								Pavel

> +++ b/fs/cifs/smb2ops.c
> @@ -3466,7 +3466,7 @@ static int smb3_simple_fallocate_write_range(unsigned int xid,
>  					     char *buf)
>  {
>  	struct cifs_io_parms io_parms = {0};
> -	int nbytes;
> +	int rc, nbytes;
>  	struct kvec iov[2];
>  
>  	io_parms.netfid = cfile->fid.netfid;
> @@ -3474,13 +3474,25 @@ static int smb3_simple_fallocate_write_range(unsigned int xid,
>  	io_parms.tcon = tcon;
>  	io_parms.persistent_fid = cfile->fid.persistent_fid;
>  	io_parms.volatile_fid = cfile->fid.volatile_fid;
> -	io_parms.offset = off;
> -	io_parms.length = len;
>  
> -	/* iov[0] is reserved for smb header */
> -	iov[1].iov_base = buf;
> -	iov[1].iov_len = io_parms.length;
> -	return SMB2_write(xid, &io_parms, &nbytes, iov, 1);
> +	while (len) {
> +		io_parms.offset = off;
> +		io_parms.length = len;
> +		if (io_parms.length > SMB2_MAX_BUFFER_SIZE)
> +			io_parms.length = SMB2_MAX_BUFFER_SIZE;
> +		/* iov[0] is reserved for smb header */
> +		iov[1].iov_base = buf;
> +		iov[1].iov_len = io_parms.length;
> +		rc = SMB2_write(xid, &io_parms, &nbytes, iov, 1);
> +		if (rc)
> +			break;
> +		if (nbytes > len)
> +			return -EINVAL;
> +		buf += nbytes;
> +		off += nbytes;
> +		len -= nbytes;
> +	}
> +	return rc;
>  }
>  
>  static int smb3_simple_fallocate_range(unsigned int xid,

-- 
DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany