* [PATCH] accel/ivpu: prevent uninitialized data bug in debugfs
@ 2026-05-25 7:14 Dan Carpenter
2026-05-25 7:25 ` Wachowski, Karol
0 siblings, 1 reply; 3+ messages in thread
From: Dan Carpenter @ 2026-05-25 7:14 UTC (permalink / raw)
To: Karol Wachowski
Cc: Karol Wachowski, Andrzej Kacprowski, Oded Gabbay,
Jacek Lawrynowicz, dri-devel, linux-kernel, kernel-janitors
The simple_write_to_buffer() will only initialize data starting from
the *pos offset so if it's non-zero then the first part of the buffer
uninitialized. Really, if *pos is non-zero then this code won't work
so just check for that at the start of the function.
Fixes: 320323d2e545 ("accel/ivpu: Add debugfs interface for setting HWS priority bands")
Signed-off-by: Dan Carpenter <error27@gmail.com>
---
drivers/accel/ivpu/ivpu_debugfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/accel/ivpu/ivpu_debugfs.c b/drivers/accel/ivpu/ivpu_debugfs.c
index 189dbe94cf14..dc20bc73c6ed 100644
--- a/drivers/accel/ivpu/ivpu_debugfs.c
+++ b/drivers/accel/ivpu/ivpu_debugfs.c
@@ -450,7 +450,7 @@ priority_bands_fops_write(struct file *file, const char __user *user_buf, size_t
u32 band;
int ret;
- if (size >= sizeof(buf))
+ if (*pos != 0 || size >= sizeof(buf))
return -EINVAL;
ret = simple_write_to_buffer(buf, sizeof(buf) - 1, pos, user_buf, size);
--
2.53.0
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] accel/ivpu: prevent uninitialized data bug in debugfs
2026-05-25 7:14 [PATCH] accel/ivpu: prevent uninitialized data bug in debugfs Dan Carpenter
@ 2026-05-25 7:25 ` Wachowski, Karol
2026-05-26 6:06 ` Wachowski, Karol
0 siblings, 1 reply; 3+ messages in thread
From: Wachowski, Karol @ 2026-05-25 7:25 UTC (permalink / raw)
To: Dan Carpenter, Karol Wachowski
Cc: Andrzej Kacprowski, Oded Gabbay, Jacek Lawrynowicz, dri-devel,
linux-kernel, kernel-janitors
On 25-May-26 9:14, Dan Carpenter wrote:
> The simple_write_to_buffer() will only initialize data starting from
> the *pos offset so if it's non-zero then the first part of the buffer
> uninitialized. Really, if *pos is non-zero then this code won't work
> so just check for that at the start of the function.
>
> Fixes: 320323d2e545 ("accel/ivpu: Add debugfs interface for setting HWS priority bands")
> Signed-off-by: Dan Carpenter <error27@gmail.com>
> ---
> drivers/accel/ivpu/ivpu_debugfs.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/accel/ivpu/ivpu_debugfs.c b/drivers/accel/ivpu/ivpu_debugfs.c
> index 189dbe94cf14..dc20bc73c6ed 100644
> --- a/drivers/accel/ivpu/ivpu_debugfs.c
> +++ b/drivers/accel/ivpu/ivpu_debugfs.c
> @@ -450,7 +450,7 @@ priority_bands_fops_write(struct file *file, const char __user *user_buf, size_t
> u32 band;
> int ret;
>
> - if (size >= sizeof(buf))
> + if (*pos != 0 || size >= sizeof(buf))
> return -EINVAL;
>
> ret = simple_write_to_buffer(buf, sizeof(buf) - 1, pos, user_buf, size);
Thanks for submission.
Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] accel/ivpu: prevent uninitialized data bug in debugfs
2026-05-25 7:25 ` Wachowski, Karol
@ 2026-05-26 6:06 ` Wachowski, Karol
0 siblings, 0 replies; 3+ messages in thread
From: Wachowski, Karol @ 2026-05-26 6:06 UTC (permalink / raw)
To: Dan Carpenter, Karol Wachowski
Cc: Andrzej Kacprowski, Oded Gabbay, Jacek Lawrynowicz, dri-devel,
linux-kernel, kernel-janitors
On 25-May-26 9:25, Wachowski, Karol wrote:
> On 25-May-26 9:14, Dan Carpenter wrote:
>> The simple_write_to_buffer() will only initialize data starting from
>> the *pos offset so if it's non-zero then the first part of the buffer
>> uninitialized. Really, if *pos is non-zero then this code won't work
>> so just check for that at the start of the function.
>>
>> Fixes: 320323d2e545 ("accel/ivpu: Add debugfs interface for setting
>> HWS priority bands")
>> Signed-off-by: Dan Carpenter <error27@gmail.com>
>> ---
>> drivers/accel/ivpu/ivpu_debugfs.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/accel/ivpu/ivpu_debugfs.c b/drivers/accel/ivpu/
>> ivpu_debugfs.c
>> index 189dbe94cf14..dc20bc73c6ed 100644
>> --- a/drivers/accel/ivpu/ivpu_debugfs.c
>> +++ b/drivers/accel/ivpu/ivpu_debugfs.c
>> @@ -450,7 +450,7 @@ priority_bands_fops_write(struct file *file, const
>> char __user *user_buf, size_t
>> u32 band;
>> int ret;
>> - if (size >= sizeof(buf))
>> + if (*pos != 0 || size >= sizeof(buf))
>> return -EINVAL;
>> ret = simple_write_to_buffer(buf, sizeof(buf) - 1, pos,
>> user_buf, size);
>
> Thanks for submission.
>
> Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Applied to drm-misc-fixes.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-05-26 6:06 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-05-25 7:14 [PATCH] accel/ivpu: prevent uninitialized data bug in debugfs Dan Carpenter
2026-05-25 7:25 ` Wachowski, Karol
2026-05-26 6:06 ` Wachowski, Karol
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®