From: Sage Weil <sage@newdream.net>
Date: Wed, 7 Jan 2009 18:40:56 +0000 (-0800)
Subject: kclient: fix buffer overrun in parse_reply_info_trace()
X-Git-Tag: v0.6~1^2~148
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=f123d3a578991c11cdc073bb16fa14a30d01992d;p=ceph.git

kclient: fix buffer overrun in parse_reply_info_trace()

Bug introduced by fb882d34c1be8fc7058f0f636bb68b134d638743.
---

diff --git a/src/kernel/mds_client.c b/src/kernel/mds_client.c
index 3cda5e9b485d..e1c9013f8f33 100644
--- a/src/kernel/mds_client.c
+++ b/src/kernel/mds_client.c
@@ -84,7 +84,8 @@ static int parse_reply_info_trace(void **p, void *end,
 	info->trace_in = kmalloc(numi * (sizeof(*info->trace_in) +
 					 sizeof(*info->trace_dir) +
 					 sizeof(*info->trace_dname) +
-					 sizeof(*info->trace_dname_len)),
+					 sizeof(*info->trace_dname_len) +
+					 sizeof(*info->trace_dlease)),
 				 GFP_NOFS);
 	if (info->trace_in == NULL) {
 		err = -ENOMEM;