mailbox: Off by one in mbox_test_message_read()

PATCH New Dan Carpenter 1 participant 1 message Oct 22, 2015

Subsystems (2)

Kernel janitors Mailbox API

lore

Share & tools

lore

Dan Carpenter

author

2015-10-22 19:51 UTC #0 lore raw

PATCH 1/1 mailbox: Off by one in mbox_test_message_read()

We need to leave space for the NUL char.

Fixes 8ea4484d0c2b ('mailbox: Add generic mechanism for testing Mailbox Controllers')

Signed-off-by Dan Carpenter <[email protected]>

---
Btw, if we fill up the entire buffer then we don't copy the last NUL to the user.

drivers/mailbox/mailbox-test.c +1 -1

index 22f2e40..feff8fb 100644
@@ -142,7 +142,7 @@ static ssize_t mbox_test_message_read(struct file *filp, char __user *userbuf,
 	int l = 0;
 	int ret;
 
-	touser = kzalloc(MBOX_HEXDUMP_MAX_LEN, GFP_KERNEL);
+	touser = kzalloc(MBOX_HEXDUMP_MAX_LEN + 1, GFP_KERNEL);
 	if (!touser)
 		return -ENOMEM;