From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S965683AbbJVTvi (ORCPT ); Thu, 22 Oct 2015 15:51:38 -0400 Received: from aserp1040.oracle.com ([141.146.126.69]:37348 "EHLO aserp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S965372AbbJVTvf (ORCPT ); Thu, 22 Oct 2015 15:51:35 -0400 Date: Thu, 22 Oct 2015 22:51:27 +0300 From: Dan Carpenter To: Jassi Brar , Lee Jones Cc: linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: [patch] mailbox: Off by one in mbox_test_message_read() Message-ID: <20151022195127.GA24439@mwanda> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.23 (2014-03-12) X-Source-IP: aserv0022.oracle.com [141.146.126.234] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org We need to leave space for the NUL char. Fixes: 8ea4484d0c2b ('mailbox: Add generic mechanism for testing Mailbox Controllers') Signed-off-by: Dan Carpenter --- Btw, if we fill up the entire buffer then we don't copy the last NUL to the user. diff --git a/drivers/mailbox/mailbox-test.c b/drivers/mailbox/mailbox-test.c index 22f2e40..feff8fb 100644 --- a/drivers/mailbox/mailbox-test.c +++ b/drivers/mailbox/mailbox-test.c @@ -142,7 +142,7 @@ static ssize_t mbox_test_message_read(struct file *filp, char __user *userbuf, int l = 0; int ret; - touser = kzalloc(MBOX_HEXDUMP_MAX_LEN, GFP_KERNEL); + touser = kzalloc(MBOX_HEXDUMP_MAX_LEN + 1, GFP_KERNEL); if (!touser) return -ENOMEM;