From: Sean Anderson <sean.anderson@linux•dev>
To: Dan Carpenter <error27@gmail•com>
Cc: Laurent Pinchart <laurent.pinchart@ideasonboard•com>,
Tomi Valkeinen <tomi.valkeinen@ideasonboard•com>,
Maarten Lankhorst <maarten.lankhorst@linux•intel.com>,
Maxime Ripard <mripard@kernel•org>,
Thomas Zimmermann <tzimmermann@suse•de>,
David Airlie <airlied@gmail•com>, Simona Vetter <simona@ffwll•ch>,
Michal Simek <michal.simek@amd•com>,
dri-devel@lists•freedesktop.org,
linux-arm-kernel@lists•infradead.org,
linux-kernel@vger•kernel.org, kernel-janitors@vger•kernel.org
Subject: Re: [PATCH] drm: zynqmp_dp: Fix uninitialized variable in debugfs()
Date: Thu, 28 May 2026 04:00:53 -0400 [thread overview]
Message-ID: <9189701d-168e-1e63-8a6c-f6926029c336@linux.dev> (raw)
In-Reply-To: <ahfeOh091V3BuuaB@stanley.mountain>
On 5/28/26 02:18, Dan Carpenter wrote:
> On Wed, May 27, 2026 at 08:31:59PM -0400, Sean Anderson wrote:
>> On 5/25/26 03:16, Dan Carpenter wrote:
>>> If the *ppos is non-zero then simple_write_to_buffer() will not
>>> initialize the start of the buf[] buffer. It doesn't really make sense
>>> to allow non-zero values for *ppos, so check for that at the start and
>>> return -EINVAL.
>>
>> non-zero ppos seems to be handled properly by simple_write_to_buffer.
>>
>
> It's not an overflow bug, it's an uninitialized variable bug.
>
> The simple_write_to_buffer() is designed to handle partial writes so it
> leaves the first "written" (scare quotes) part of the string as is. But
> in this case, we can't handle a partial write and the first part of
> buf[] is left uninitialized.
>
> https://staticthinking.wordpress.com/2026/05/23/simple_write_to_buffer-is-complicated/
OK, that's a bit strange. Can you add this to the doc comment? I certainly
missed it when looking around for appropriate functions.
And I like the explicit copy_from_user variant better, especially since
we are setting the nul-terminator anyway.
> Also this appears to be dead code since fops_zynqmp_dp_pattern is never
> used.
It's of course used in zynqmp_dp_bridge_debugfs_init.
--Sean
next prev parent reply other threads:[~2026-05-28 8:01 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-25 7:16 [PATCH] drm: zynqmp_dp: Fix uninitialized variable in debugfs() Dan Carpenter
2026-05-28 0:31 ` Sean Anderson
2026-05-28 6:18 ` Dan Carpenter
2026-05-28 8:00 ` Sean Anderson [this message]
2026-05-28 8:59 ` Dan Carpenter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=9189701d-168e-1e63-8a6c-f6926029c336@linux.dev \
--to=sean.anderson@linux$(echo .)dev \
--cc=airlied@gmail$(echo .)com \
--cc=dri-devel@lists$(echo .)freedesktop.org \
--cc=error27@gmail$(echo .)com \
--cc=kernel-janitors@vger$(echo .)kernel.org \
--cc=laurent.pinchart@ideasonboard$(echo .)com \
--cc=linux-arm-kernel@lists$(echo .)infradead.org \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=maarten.lankhorst@linux$(echo .)intel.com \
--cc=michal.simek@amd$(echo .)com \
--cc=mripard@kernel$(echo .)org \
--cc=simona@ffwll$(echo .)ch \
--cc=tomi.valkeinen@ideasonboard$(echo .)com \
--cc=tzimmermann@suse$(echo .)de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox