There is an off-by-one issue when checking if there is enough space in the output buffer, because we must keep some place for a final '\0'. While at it: - Use 'scnprintf' instead of 'snprintf' in order to avoid a superfluous 'strlen' - avoid some useless initializations - avoida hard coded buffer size that can be computed at built time. Fixes: a51f06e1679e ("RDMA/ocrdma: Query controller information") Signed-off-by: Christophe JAILLET <christophe.jaillet@xxxxxxxxxx> --- The '\0' comes from memset(..., 0, ...) in all callers. This could be also avoided if needed. --- drivers/infiniband/hw/ocrdma/ocrdma_stats.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_stats.c b/drivers/infiniband/hw/ocrdma/ocrdma_stats.c index 5f831e3bdbad..614a449e6b87 100644 --- a/drivers/infiniband/hw/ocrdma/ocrdma_stats.c +++ b/drivers/infiniband/hw/ocrdma/ocrdma_stats.c @@ -49,13 +49,12 @@ static struct dentry *ocrdma_dbgfs_dir; static int ocrdma_add_stat(char *start, char *pcur, char *name, u64 count) { - char buff[128] = {0}; - int cpy_len = 0; + char buff[128]; + int cpy_len; - snprintf(buff, 128, "%s: %llu\n", name, count); - cpy_len = strlen(buff); + cpy_len = scnprintf(buff, sizeof(buff), "%s: %llu\n", name, count); - if (pcur + cpy_len > start + OCRDMA_MAX_DBGFS_MEM) { + if (pcur + cpy_len >= start + OCRDMA_MAX_DBGFS_MEM) { pr_err("%s: No space in stats buff\n", __func__); return 0; } -- 2.20.1