The struct validate_negotiate_info_req change from variable-length array to reguler array, but the message length check is unchanged. The fsctl_validate_negotiate_info() already check the message length, so remove it from smb2_ioctl(). Fixes: c7803b05f74b ("smb3: fix ksmbd bigendian bug in oplock break, and move its struct to smbfs_common") Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@xxxxxxxxxx> Cc: <stable@xxxxxxxxxxxxxxx> --- fs/ksmbd/smb2pdu.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index c49f65146ab3..c9f400bbb814 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -7640,9 +7640,6 @@ int smb2_ioctl(struct ksmbd_work *work) goto out; } - if (in_buf_len < sizeof(struct validate_negotiate_info_req)) - return -EINVAL; - if (out_buf_len < sizeof(struct validate_negotiate_info_rsp)) return -EINVAL; -- 2.31.1