tmp_buf = kmalloc(NAME_MAX+1,GFP_KERNEL); 
/* To be safe - for UCS to UTF-8 with strings loaded with the rare long characters alloc more to account for such multibyte target UTF-8 characters. cifs_unicode.c, which actually does the conversion, has the same limit */ tmp_buf = kmalloc((2 * NAME_MAX) + 4, GFP_KERNEL); 
int cifs_readdir(struct file *file, void *direntry, filldir_t filldir){	int rc = 0;	int xid,i;	struct cifs_sb_info *cifs_sb;	struct cifsTconInfo *pTcon;	struct cifsFileInfo *cifsFile = NULL;	char * current_entry;	int num_to_fill = 0;	char * tmp_buf = NULL;	char * end_of_smb;	xid = GetXid();	if(file->f_dentry == NULL) {		FreeXid(xid);		return -EIO;	}/*	dump_cifs_file_struct(file, "Begin rdir "); */	cifs_sb = CIFS_SB(file->f_dentry->d_sb);	pTcon = cifs_sb->tcon;	if(pTcon == NULL)		return -EINVAL;/*	cFYI(1,("readdir2 pos: %lld",file->f_pos)); */	switch ((int) file->f_pos) {	case 0:		/*if (filldir(direntry, ".", 1, file->f_pos,		     file->f_dentry->d_inode->i_ino, DT_DIR) < 0) {			cERROR(1, ("Filldir for current dir failed "));			rc = -ENOMEM;			break;		}		file->f_pos++; */	case 1:		/* if (filldir(direntry, "..", 2, file->f_pos,		     file->f_dentry->d_parent->d_inode->i_ino, DT_DIR) < 0) {			cERROR(1, ("Filldir for parent dir failed "));			rc = -ENOMEM;			break;		}		file->f_pos++; */	case 2:		/* 1) If search is active, 			is in current search buffer? 			if it before then restart search			if after then keep searching till find it */		if(file->private_data == NULL) {			rc = initiate_cifs_search(xid,file);			cFYI(1,("initiate cifs search rc %d",rc));			if(rc) {				FreeXid(xid);				return rc;			}		}	default:		if(file->private_data == NULL) {			rc = -EINVAL;			FreeXid(xid);			return rc;		}		cifsFile = file->private_data;		if (cifsFile->srch_inf.endOfSearch) {			if(cifsFile->srch_inf.emptyDir) {				cFYI(1, ("End of search, empty dir"));				rc = 0;				break;			}		} /* else {			cifsFile->invalidHandle = TRUE;			CIFSFindClose(xid, pTcon, cifsFile->netfid);		} 		kfree(cifsFile->search_resume_name);		cifsFile->search_resume_name = NULL; */		/* BB account for . and .. in f_pos as special case */		/* dump_cifs_file_struct(file, "rdir after default ");*/		rc = find_cifs_entry(xid,pTcon, file,				&current_entry,&num_to_fill);		if(rc) {			cFYI(1,("fce error %d",rc)); 			goto rddir2_exit;		} else if (current_entry != NULL) {			cFYI(1,("entry %lld found",file->f_pos));		} else {			cFYI(1,("could not find entry"));			goto rddir2_exit;		}		cFYI(1,("loop through %d times filling dir for net buf %p",			num_to_fill,cifsFile->srch_inf.ntwrk_buf_start)); 		end_of_smb = cifsFile->srch_inf.ntwrk_buf_start +			smbCalcSize((struct smb_hdr *)				    cifsFile->srch_inf.ntwrk_buf_start);		tmp_buf = kmalloc(NAME_MAX+1,GFP_KERNEL);		for(i=0;(i<num_to_fill) && (rc == 0);i++) {			if(current_entry == NULL) {				/* evaluate whether this case is an error */				cERROR(1,("past end of SMB num to fill %d i %d",					  num_to_fill, i));				break;			}			/* BB FIXME - need to enable the below code BB */		/* if((!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM)) ||			   (cifsFile->srch_inf.info_level != 				   something that supports server inodes)) {				create dentry				create inode				fill in inode new_inode (getting local i_ino)			}			also create local inode for performance reasons (so we 			have a cache of inode metadata) unless this new mount 			parm says otherwise */			rc = cifs_filldir(current_entry, file, 					filldir, direntry,tmp_buf);			file->f_pos++;			if(file->f_pos == cifsFile->srch_inf.index_of_last_entry) {				cFYI(1,("last entry in buf at pos %lld %s",					file->f_pos,tmp_buf)); /* BB removeme BB */				cifs_save_resume_key(current_entry,cifsFile);				break;			} else 				current_entry = nxt_dir_entry(current_entry,end_of_smb);		}		kfree(tmp_buf);		break;	} /* end switch */rddir2_exit:	/* dump_cifs_file_struct(file, "end rdir ");  */	FreeXid(xid);	return rc;}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/6a0b48245a135cd132e747815854e3999967f8a7/readdir.c/buggy/fs/cifs/readdir.c