pSMB->ByteCount = cpu_to_le16(byte_count); 
 if(wct == 14) pSMB->ByteCount = cpu_to_le16(byte_count); else { /* old style write has byte count 4 bytes earlier */ struct smb_com_writex_req * pSMBW = (struct smb_com_writex_req *)pSMB; pSMBW->ByteCount = cpu_to_le16(byte_count); } 
CIFSSMBWrite(const int xid, struct cifsTconInfo *tcon,	     const int netfid, const unsigned int count,	     const __u64 offset, unsigned int *nbytes, const char *buf,	     const char __user * ubuf, const int long_op){	int rc = -EACCES;	WRITE_REQ *pSMB = NULL;	WRITE_RSP *pSMBr = NULL;	int bytes_returned;	__u32 bytes_sent;	__u16 byte_count;	/* cFYI(1,("write at %lld %d bytes",offset,count));*/	rc = smb_init(SMB_COM_WRITE_ANDX, 14, tcon, (void **) &pSMB,		      (void **) &pSMBr);	if (rc)		return rc;	/* tcon and ses pointer are checked in smb_init */	if (tcon->ses->server == NULL)		return -ECONNABORTED;	pSMB->AndXCommand = 0xFF;	/* none */	pSMB->Fid = netfid;	pSMB->OffsetLow = cpu_to_le32(offset & 0xFFFFFFFF);	pSMB->OffsetHigh = cpu_to_le32(offset >> 32);	pSMB->Reserved = 0xFFFFFFFF;	pSMB->WriteMode = 0;	pSMB->Remaining = 0;	/* Can increase buffer size if buffer is big enough in some cases - ie we 	can send more if LARGE_WRITE_X capability returned by the server and if	our buffer is big enough or if we convert to iovecs on socket writes	and eliminate the copy to the CIFS buffer */	if(tcon->ses->capabilities & CAP_LARGE_WRITE_X) {		bytes_sent = min_t(const unsigned int, CIFSMaxBufSize, count);	} else {		bytes_sent = (tcon->ses->server->maxBuf - MAX_CIFS_HDR_SIZE)			 & ~0xFF;	}	if (bytes_sent > count)		bytes_sent = count;	pSMB->DataOffset =	    cpu_to_le16(offsetof(struct smb_com_write_req,Data) - 4);	if(buf)	    memcpy(pSMB->Data,buf,bytes_sent);	else if(ubuf) {		if(copy_from_user(pSMB->Data,ubuf,bytes_sent)) {			cifs_buf_release(pSMB);			return -EFAULT;		}	} else {		/* No buffer */		cifs_buf_release(pSMB);		return -EINVAL;	}	byte_count = bytes_sent + 1 /* pad */ ; /* BB fix this for sends > 64K */	pSMB->DataLengthLow = cpu_to_le16(bytes_sent & 0xFFFF);	pSMB->DataLengthHigh = cpu_to_le16(bytes_sent >> 16);	pSMB->hdr.smb_buf_length += bytes_sent+1;	pSMB->ByteCount = cpu_to_le16(byte_count);	rc = SendReceive(xid, tcon->ses, (struct smb_hdr *) pSMB,			 (struct smb_hdr *) pSMBr, &bytes_returned, long_op);	cifs_stats_inc(&tcon->num_writes);	if (rc) {		cFYI(1, ("Send error in write = %d", rc));		*nbytes = 0;	} else {		*nbytes = le16_to_cpu(pSMBr->CountHigh);		*nbytes = (*nbytes) << 16;		*nbytes += le16_to_cpu(pSMBr->Count);	}	cifs_buf_release(pSMB);	/* Note: On -EAGAIN error only caller can retry on handle based calls 		since file handle passed in no longer valid */	return rc;}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/1c9551878c4629ca78dfe12ed23b9dc8d97770cc/cifssmb.c/buggy/fs/cifs/cifssmb.c