ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len()

After this commit (e2b76ab8b5c9 "ksmbd: add support for read compound"),
response buffer management was changed to use dynamic iov array.
In the new design, smb2_calc_max_out_buf_len() expects the second
argument (hdr2_len) to be the offset of ->Buffer field in the
response structure, not a hardcoded magic number.
Fix the remaining call sites to use the correct offsetof() value.

Cc: stable@vger.kernel.org
Fixes: e2b76ab8b5c9 ("ksmbd: add support for read compound")
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 24f8d58493d00db6ed4671241a447db563a4d712..f5f1bf5f642e977f673c9423503f2a83eb2b01b9 100644 (file)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -4452,8 +4452,9 @@ int smb2_query_dir(struct ksmbd_work *work)
        d_info.wptr = (char *)rsp->Buffer;
        d_info.rptr = (char *)rsp->Buffer;
        d_info.out_buf_len =
-               smb2_calc_max_out_buf_len(work, 8,
-                                         le32_to_cpu(req->OutputBufferLength));
+               smb2_calc_max_out_buf_len(work,
+                               offsetof(struct smb2_query_directory_rsp, Buffer),
+                               le32_to_cpu(req->OutputBufferLength));
        if (d_info.out_buf_len < 0) {
                rc = -EINVAL;
                goto err_out;
@@ -4720,8 +4721,9 @@ static int smb2_get_ea(struct ksmbd_work *work, struct ksmbd_file *fp,
        }
 
        buf_free_len =
-               smb2_calc_max_out_buf_len(work, 8,
-                                         le32_to_cpu(req->OutputBufferLength));
+               smb2_calc_max_out_buf_len(work,
+                               offsetof(struct smb2_query_info_rsp, Buffer),
+                               le32_to_cpu(req->OutputBufferLength));
        if (buf_free_len < 0)
                return -EINVAL;
 
@@ -5047,8 +5049,9 @@ static int get_file_stream_info(struct ksmbd_work *work,
        file_info = (struct smb2_file_stream_info *)rsp->Buffer;
 
        buf_free_len =
-               smb2_calc_max_out_buf_len(work, 8,
-                                         le32_to_cpu(req->OutputBufferLength));
+               smb2_calc_max_out_buf_len(work,
+                               offsetof(struct smb2_query_info_rsp, Buffer),
+                               le32_to_cpu(req->OutputBufferLength));
        if (buf_free_len < 0)
                goto out;
 
@@ -8206,8 +8209,9 @@ int smb2_ioctl(struct ksmbd_work *work)
        buffer = (char *)req + le32_to_cpu(req->InputOffset);
 
        cnt_code = le32_to_cpu(req->CtlCode);
-       ret = smb2_calc_max_out_buf_len(work, 48,
-                                       le32_to_cpu(req->MaxOutputResponse));
+       ret = smb2_calc_max_out_buf_len(work,
+                       offsetof(struct smb2_ioctl_rsp, Buffer),
+                       le32_to_cpu(req->MaxOutputResponse));
        if (ret < 0) {
                rsp->hdr.Status = STATUS_INVALID_PARAMETER;
                goto out;