For dgrp, the buffer length of 'nd->nd_ps_desc' is 'MAX_DESC_LEN + 1', so the buffer length of 'getnode.nd_ps_desc' also need be 'MAX_DESC_LEN + 1', then can fully copy from 'nd->nd_ps_desc' to 'getnode.nd_ps_desc'.
Signed-off-by: Chen Gang <[email protected]> --- drivers/staging/dgrp/dgrp_dpa_ops.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/staging/dgrp/dgrp_dpa_ops.c b/drivers/staging/dgrp/dgrp_dpa_ops.c index d99c227..adf655e 100644 --- a/drivers/staging/dgrp/dgrp_dpa_ops.c +++ b/drivers/staging/dgrp/dgrp_dpa_ops.c @@ -66,7 +66,7 @@ struct digi_node { uint nd_chan_count; /* Number of channels found */ uint nd_tx_byte; /* Tx data count */ uint nd_rx_byte; /* RX data count */ - u8 nd_ps_desc[MAX_DESC_LEN]; /* Description from PS */ + u8 nd_ps_desc[MAX_DESC_LEN + 1]; /* Description from PS */ }; #define DIGI_GETNODE (('d'<<8) | 249) /* get board info */ @@ -390,7 +390,7 @@ static long dgrp_dpa_ioctl(struct file *file, unsigned int cmd, getnode.nd_tx_byte = nd->nd_tx_byte; getnode.nd_rx_byte = nd->nd_rx_byte; - memset(&getnode.nd_ps_desc, 0, MAX_DESC_LEN); + memset(&getnode.nd_ps_desc, 0, MAX_DESC_LEN + 1); strncpy(getnode.nd_ps_desc, nd->nd_ps_desc, MAX_DESC_LEN); if (copy_to_user(uarg, &getnode, sizeof(struct digi_node))) -- 1.7.7.6 _______________________________________________ devel mailing list [email protected] http://driverdev.linuxdriverproject.org/mailman/listinfo/devel
