Re: [PATCH] staging: greybus: uart: fix heap buffer overflow in gb_tty->buffer

[Johan Hovold <johan@kernel.org>]

On Tue, Nov 03, 2026 at 11:44:55AM +0300, Dan Carpenter wrote:
> On Mon, Nov 02, 2026 at 03:33:58PM -0600, Alex Elder wrote:
> > On 11/2/26 1:53 PM, Maritu Hone wrote:
> > > gb_tty->buffer is allocated once in gb_uart_probe() and reused for
> > > every outgoing chunk as the backing store for a
> > > struct gb_uart_send_data_request:
> > > 
> > > 	struct gb_uart_send_data_request {
> > > 		__le16	size;
> > > 		__u8	data[];
> > > 	} __packed;
> > > 
> > > In gb_uart_tx_write_work():
> > > 
> > > 	request = gb_tty->buffer;
> > > 	...
> > > 	send_size = gb_tty->buffer_payload_max;
> > > 	if (send_size > gb_tty->credits)
> > > 		send_size = gb_tty->credits;
> > > 	send_size = kfifo_out_peek(&gb_tty->write_fifo,
> > > 				   &request->data[0], send_size);

> Wow..  Heh...  I have read both the original message and your
> message and I still have no idea which function contains the
> actual memcpy() overflow.  :P

It's the kfifo_out_peek() in gb_uart_tx_write_work() that may write 2
bytes beyond gb_tty->buffer (as its size is currently just
gb_tty->buffer_payload_max).

Johan