off by one in sysfs

[Jon Smirl <jonsmirl@gmail.com>]

sysfs/file.c

static int 
fill_write_buffer(struct sysfs_buffer * buffer, const char __user *
buf, size_t count)
{
	int error;

	if (!buffer->page)
		buffer->page = (char *)get_zeroed_page(GFP_KERNEL);
	if (!buffer->page)
		return -ENOMEM;

	if (count >= PAGE_SIZE)
		count = PAGE_SIZE - 1;
	error = copy_from_user(buffer->page,buf,count);
	buffer->needs_read_fill = 1;
	return error ? -EFAULT : count;
}

count = PAGE_SIZE - 1;
should be 
count = PAGE_SIZE;

Even if your are trying to zero terminate which is unneeded when there
is a count, the count still needs to include the zero otherwise it is
inconsistent when count is less than PAGE_SIZE. Why get a zero page
too?

My attribute is a color_map described by 255 lines of 15 chars plus \n.

-- 
Jon Smirl
jonsmirl@gmail.com
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/