---

yaml
---
r: 144691
b: refs/heads/master
c: 968460e
h: refs/heads/master
i:
  144689: 2b8da48
  144687: 981f7c5
v: v3

[refs]

@@ -1,2 +1,2 @@
 ---
-refs/heads/master: ff6945279d45edd8f6b0a5ddb1ef16cecce3ea9c
+refs/heads/master: 968460ebd8006d55661dec0fb86712b40d71c413

trunk/fs/cifs/cifssmb.c

@@ -88,29 +88,29 @@ static struct {
  *	on failure - errno
  */
 static int
-cifs_strncpy_to_host(char **dst, const char *src, const int maxlen,
+cifs_strlcpy_to_host(char **dst, const char *src, const int maxlen,
 		 const bool is_unicode, const struct nls_table *nls_codepage)
 {
 	int plen;
 
 	if (is_unicode) {
 		plen = UniStrnlen((wchar_t *)src, maxlen);
-		*dst = kmalloc(plen + 2, GFP_KERNEL);
+		*dst = kmalloc((4 * plen) + 2, GFP_KERNEL);
 		if (!*dst)
-			goto cifs_strncpy_to_host_ErrExit;
+			goto cifs_strlcpy_to_host_ErrExit;
 		cifs_strfromUCS_le(*dst, (__le16 *)src, plen, nls_codepage);
+		(*dst)[plen] = 0;
+		(*dst)[plen+1] = 0; /* needed for Unicode */
 	} else {
 		plen = strnlen(src, maxlen);
 		*dst = kmalloc(plen + 2, GFP_KERNEL);
 		if (!*dst)
-			goto cifs_strncpy_to_host_ErrExit;
-		strncpy(*dst, src, plen);
+			goto cifs_strlcpy_to_host_ErrExit;
+		strlcpy(*dst, src, plen);
 	}
-	(*dst)[plen] = 0;
-	(*dst)[plen+1] = 0; /* harmless for ASCII case, needed for Unicode */
 	return 0;
 
-cifs_strncpy_to_host_ErrExit:
+cifs_strlcpy_to_host_ErrExit:
 	cERROR(1, ("Failed to allocate buffer for string\n"));
 	return -ENOMEM;
 }
@@ -4029,15 +4029,15 @@ parse_DFS_referrals(TRANSACTION2_GET_DFS_REFER_RSP *pSMBr,
 		/* copy DfsPath */
 		temp = (char *)ref + le16_to_cpu(ref->DfsPathOffset);
 		max_len = data_end - temp;
-		rc = cifs_strncpy_to_host(&(node->path_name), temp,
+		rc = cifs_strlcpy_to_host(&(node->path_name), temp,
 					max_len, is_unicode, nls_codepage);
 		if (rc)
 			goto parse_DFS_referrals_exit;
 
 		/* copy link target UNC */
 		temp = (char *)ref + le16_to_cpu(ref->NetworkAddressOffset);
 		max_len = data_end - temp;
-		rc = cifs_strncpy_to_host(&(node->node_name), temp,
+		rc = cifs_strlcpy_to_host(&(node->node_name), temp,
 					max_len, is_unicode, nls_codepage);
 		if (rc)
 			goto parse_DFS_referrals_exit;