From: Guillaume Morin , Arnd Bergmann For strlcpy(), both the buffer and the `len' arg to strlcpy() need to be one greater than the string which you wish to copy. 25-akpm/drivers/s390/net/cu3088.c | 2 +- 1 files changed, 1 insertion(+), 1 deletion(-) diff -puN drivers/s390/net/cu3088.c~cu3088-string-null-termination-fix drivers/s390/net/cu3088.c --- 25/drivers/s390/net/cu3088.c~cu3088-string-null-termination-fix Tue Aug 26 14:31:21 2003 +++ 25-akpm/drivers/s390/net/cu3088.c Tue Aug 26 14:32:00 2003 @@ -79,7 +79,7 @@ group_write(struct device_driver *drv, c if (!(end = strchr(start, delim[i]))) return count; - len = min_t(ptrdiff_t, BUS_ID_SIZE, end - start); + len = min_t(ptrdiff_t, BUS_ID_SIZE, end - start + 1); strlcpy (bus_ids[i], start, len); argv[i] = bus_ids[i]; start = end + 1; _