From: Dan Carpenter <error27@gmail•com>
To: Sean Anderson <sean.anderson@linux•dev>
Cc: Laurent Pinchart <laurent.pinchart@ideasonboard•com>,
Tomi Valkeinen <tomi.valkeinen@ideasonboard•com>,
Maarten Lankhorst <maarten.lankhorst@linux•intel.com>,
Maxime Ripard <mripard@kernel•org>,
Thomas Zimmermann <tzimmermann@suse•de>,
David Airlie <airlied@gmail•com>, Simona Vetter <simona@ffwll•ch>,
Michal Simek <michal.simek@amd•com>,
dri-devel@lists•freedesktop.org,
linux-arm-kernel@lists•infradead.org,
linux-kernel@vger•kernel.org, kernel-janitors@vger•kernel.org
Subject: Re: [PATCH] drm: zynqmp_dp: Fix uninitialized variable in debugfs()
Date: Thu, 28 May 2026 11:59:53 +0300 [thread overview]
Message-ID: <ahgECVKG-djR9_l3@stanley.mountain> (raw)
In-Reply-To: <9189701d-168e-1e63-8a6c-f6926029c336@linux.dev>
On Thu, May 28, 2026 at 04:00:53AM -0400, Sean Anderson wrote:
> On 5/28/26 02:18, Dan Carpenter wrote:
> > On Wed, May 27, 2026 at 08:31:59PM -0400, Sean Anderson wrote:
> > > On 5/25/26 03:16, Dan Carpenter wrote:
> > > > If the *ppos is non-zero then simple_write_to_buffer() will not
> > > > initialize the start of the buf[] buffer. It doesn't really make sense
> > > > to allow non-zero values for *ppos, so check for that at the start and
> > > > return -EINVAL.
> > >
> > > non-zero ppos seems to be handled properly by simple_write_to_buffer.
> > >
> >
> > It's not an overflow bug, it's an uninitialized variable bug.
> >
> > The simple_write_to_buffer() is designed to handle partial writes so it
> > leaves the first "written" (scare quotes) part of the string as is. But
> > in this case, we can't handle a partial write and the first part of
> > buf[] is left uninitialized.
> >
> > https://staticthinking.wordpress.com/2026/05/23/simple_write_to_buffer-is-complicated/
>
> OK, that's a bit strange. Can you add this to the doc comment? I certainly
> missed it when looking around for appropriate functions.
>
> And I like the explicit copy_from_user variant better, especially since
> we are setting the nul-terminator anyway.
>
> > Also this appears to be dead code since fops_zynqmp_dp_pattern is never
> > used.
>
> It's of course used in zynqmp_dp_bridge_debugfs_init.
Ah, yes. I just did a git grep and the CREATE_FILE() macro confused me.
But obviously this wouldn't compile if we had an unused local variable.
Duh...
regards,
dan carpenter
prev parent reply other threads:[~2026-05-28 9:00 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-25 7:16 [PATCH] drm: zynqmp_dp: Fix uninitialized variable in debugfs() Dan Carpenter
2026-05-28 0:31 ` Sean Anderson
2026-05-28 6:18 ` Dan Carpenter
2026-05-28 8:00 ` Sean Anderson
2026-05-28 8:59 ` Dan Carpenter [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ahgECVKG-djR9_l3@stanley.mountain \
--to=error27@gmail$(echo .)com \
--cc=airlied@gmail$(echo .)com \
--cc=dri-devel@lists$(echo .)freedesktop.org \
--cc=kernel-janitors@vger$(echo .)kernel.org \
--cc=laurent.pinchart@ideasonboard$(echo .)com \
--cc=linux-arm-kernel@lists$(echo .)infradead.org \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=maarten.lankhorst@linux$(echo .)intel.com \
--cc=michal.simek@amd$(echo .)com \
--cc=mripard@kernel$(echo .)org \
--cc=sean.anderson@linux$(echo .)dev \
--cc=simona@ffwll$(echo .)ch \
--cc=tomi.valkeinen@ideasonboard$(echo .)com \
--cc=tzimmermann@suse$(echo .)de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox