s390 keyboard: Avoid off-by-one when using strnlen_user()

Quoted 9 lines · Martin Schwidefsky

Quoted 6 lines · On Tue, 2 Jun 2015 17:07:33 +0200 Jan Kara <[email protected]> wrote:

strnlen_user() returns the length of the string including terminating 0. So avoid counting it again and unnecessarily reducing maximum string size by 1.

CC Heiko Carstens <[email protected]>

Signed-off-by Jan Kara <[email protected]>

Quoted 7 lines

The simplification with the string length is nice but removing the explicit NUL termination is imho a mistake. Who guarantees you that the string in user space is still the same after the initial strnlen_user? It might have changed before the copy_from_user call and then we end up with an unterminated string in the kernel. Not good.

Ah, that's a good point. Thanks for catching this. But it would deserve a comment in the code. Attached is an updated patch.