The "buf" buffer is a PAGE_SIZE and allocated with kzalloc(). We store a string from the user in it and then pass it to sscanf() in the write functions such as shm32write__write_file(). Only a few numbers are stored in the buffer so it never comes close to filling up the whole PAGE_SIZE. Reserve the last character of the page for a NUL terminator. This is debugfs so it's root only. Fixes: 75388acd0cd8 ("[B43LEGACY]: add mac80211-based driver for legacy BCM43xx devices") Signed-off-by: Dan Carpenter --- drivers/net/wireless/broadcom/b43/debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/broadcom/b43/debugfs.c b/drivers/net/wireless/broadcom/b43/debugfs.c index 31a1ff00c1a4..173ef5db90fc 100644 --- a/drivers/net/wireless/broadcom/b43/debugfs.c +++ b/drivers/net/wireless/broadcom/b43/debugfs.c @@ -557,7 +557,7 @@ static ssize_t b43_debugfs_write(struct file *file, if (!count) return 0; - if (count > PAGE_SIZE) + if (count >= PAGE_SIZE) return -E2BIG; dev = file->private_data; if (!dev) -- 2.53.0