diff options
| author | Rosen Penev <rosenp@gmail.com> | 2026-07-28 14:27:59 -0700 |
|---|---|---|
| committer | Namjae Jeon <linkinjeon@kernel.org> | 2026-08-17 15:00:57 +0900 |
| commit | 6eac877e0ea53b82fe726ba80bb1a349bd0b592b (patch) | |
| tree | 3ddeda319f4fbe95bd36d92587936b72560986a8 | |
| parent | 16a7f7c2ecf3c893b65f0fb78fa7a7171ae0ba9e (diff) | |
| download | linux-6eac877e0ea53b82fe726ba80bb1a349bd0b592b.tar.gz linux-6eac877e0ea53b82fe726ba80bb1a349bd0b592b.zip | |
ksmbd: remove extra byte from ipc_msg_alloc() size calculations
Three ipc_msg_alloc() calls in transport_ipc.c allocate
sizeof(struct) + payload_len + 1, but the extra byte is
unnecessary. The payload data is binary and copied with
memcpy() to the exact size; no null terminator is needed.
This was present in the original commit that introduced the
file, where the structs already used [0] zero-length arrays,
so the +1 was never correct.
Assisted-by: Opencode:Big-Pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
| -rw-r--r-- | fs/smb/server/transport_ipc.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/fs/smb/server/transport_ipc.c b/fs/smb/server/transport_ipc.c index 2584b162415b..4b0b572a3e1b 100644 --- a/fs/smb/server/transport_ipc.c +++ b/fs/smb/server/transport_ipc.c @@ -679,7 +679,7 @@ ksmbd_ipc_spnego_authen_request(const char *spnego_blob, int blob_len) return NULL; msg = ipc_msg_alloc(sizeof(struct ksmbd_spnego_authen_request) + - blob_len + 1); + blob_len); if (!msg) return NULL; @@ -860,7 +860,7 @@ struct ksmbd_rpc_command *ksmbd_rpc_write(struct ksmbd_session *sess, int handle if (payload_sz > KSMBD_IPC_MAX_PAYLOAD) return NULL; - msg = ipc_msg_alloc(sizeof(struct ksmbd_rpc_command) + payload_sz + 1); + msg = ipc_msg_alloc(sizeof(struct ksmbd_rpc_command) + payload_sz); if (!msg) return NULL; @@ -919,7 +919,7 @@ struct ksmbd_rpc_command *ksmbd_rpc_ioctl(struct ksmbd_session *sess, int handle if (payload_sz > KSMBD_IPC_MAX_PAYLOAD) return NULL; - msg = ipc_msg_alloc(sizeof(struct ksmbd_rpc_command) + payload_sz + 1); + msg = ipc_msg_alloc(sizeof(struct ksmbd_rpc_command) + payload_sz); if (!msg) return NULL; |