kclient: fix buffer overrun in parse_reply_info_trace()

Bug introduced by fb882d34c1be8fc7058f0f636bb68b134d638743.

diff --git a/src/kernel/mds_client.c b/src/kernel/mds_client.c
index 3cda5e9b485df5c485b65a85b372cfaf82b84cfd..e1c9013f8f33b4d51d4f79027785a28dc78b63b8 100644 (file)
--- a/src/kernel/mds_client.c
+++ b/src/kernel/mds_client.c
@@ -84,7 +84,8 @@ static int parse_reply_info_trace(void **p, void *end,
        info->trace_in = kmalloc(numi * (sizeof(*info->trace_in) +
                                         sizeof(*info->trace_dir) +
                                         sizeof(*info->trace_dname) +
-                                        sizeof(*info->trace_dname_len)),
+                                        sizeof(*info->trace_dname_len) +
+                                        sizeof(*info->trace_dlease)),
                                 GFP_NOFS);
        if (info->trace_in == NULL) {
                err = -ENOMEM;