public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
* off by one in sysfs
@ 2005-06-12  3:00 Jon Smirl
  2005-06-12 15:41 ` Jon Smirl
  2005-06-14 21:07 ` Greg KH
  0 siblings, 2 replies; 6+ messages in thread
From: Jon Smirl @ 2005-06-12  3:00 UTC (permalink / raw)
  To: lkml, Greg KH

sysfs/file.c

static int 
fill_write_buffer(struct sysfs_buffer * buffer, const char __user *
buf, size_t count)
{
	int error;

	if (!buffer->page)
		buffer->page = (char *)get_zeroed_page(GFP_KERNEL);
	if (!buffer->page)
		return -ENOMEM;

	if (count >= PAGE_SIZE)
		count = PAGE_SIZE - 1;
	error = copy_from_user(buffer->page,buf,count);
	buffer->needs_read_fill = 1;
	return error ? -EFAULT : count;
}

count = PAGE_SIZE - 1;
should be 
count = PAGE_SIZE;

Even if your are trying to zero terminate which is unneeded when there
is a count, the count still needs to include the zero otherwise it is
inconsistent when count is less than PAGE_SIZE. Why get a zero page
too?

My attribute is a color_map described by 255 lines of 15 chars plus \n.

-- 
Jon Smirl
jonsmirl@gmail.com

^ permalink raw reply	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2005-06-14 21:28 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2005-06-12  3:00 off by one in sysfs Jon Smirl
2005-06-12 15:41 ` Jon Smirl
2005-06-14 21:06   ` Greg KH
2005-06-14 21:07 ` Greg KH
2005-06-14 21:21   ` Jon Smirl
2005-06-14 21:27     ` Greg KH

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox