Re: [PATCH v2] firmware: tegra: bpmp: reject truncated debugfs entries

On Fri, Aug 14, 2026 at 04:05:48PM +0800, Pengpeng Hou wrote:
> The BPMP debugfs parser reads fixed-width values and bounded strings
> from a size-delimited reply. Its fixed-width helper currently treats a
> short copy as success, while the string helper advances past the range
> when no NUL terminator is present. The status helper also uses an
> unsigned return type for negative errors.
> 
> Require complete fixed-width reads and a terminator within the remaining
> range before moving the cursor. Use a signed status result so errors
> reach callers unchanged.
> 
> Fixes: f2381f652266 ("firmware: tegra: Add BPMP debugfs support")
> 
> Assisted-by: Codex:gpt-5
> Signed-off-by: Pengpeng Hou <[email protected]>
> ---
> Changes since v1: https://lore.kernel.org/all/[email protected]/
> - no source-code changes
> - rebase on the current Tegra firmware sources and tighten the commit message
> - add the coding-assistant disclosure
> 
> The bounded parser helpers and callers were reviewed statically; no
> malformed BPMP response was injected.
> 
>  drivers/firmware/tegra/bpmp-debugfs.c | 17 +++++++++++++----
>  1 file changed, 13 insertions(+), 4 deletions(-)

This doesn't make sense to me. The seqbuf_read*() helpers already use
seqbuf_avail() to make sure they never read past the end of the buffer.
We also leave scope immediately anytime we see an overflow.

Worst case we'll see memcpy() copy 0 bytes, as far as I can tell, and
that's harmless (even though not entirely free).

Thierry

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEiOrDCAFJzPfAjcif3SOs138+s6EFAmqEQkYACgkQ3SOs138+
s6H62w/+IjauN+ojTmNxphSm9842XN0w8yIvS4QB+29wH+S6H8x3g9fcGRbx1oIq
RNMDjnW8QFUPK1c9YtAuB9BLrdcgFMDBYk50F64xQH0VLkj9/siEcMMjGLIZJxVj
iKTq+OSxtvM6EWr7pIXAuTFuyaOl7UmAydTB4UR6mQtzRE30a1R8jUjABBkccP5M
OZjbqmkw6zLoYn1syTPpYpxWe1IKABSrZvKR4dQLf0LCk9gmIohjpWWtXa4Ca1U+
Fm3ste3ZK5E4Cd8k8Yurtr51k8v0DSDbLyv7QNXh1IbkxFcu6tlpKTLoIInn6KHC
GgDnFiETEPl4IIVaeo0bbDWP0hYRaDZvf6sOHvtnPJFeoG0Oj08PWm1GFNjnDQd8
l715ADwmXBaIWsuaCVrYx5KjsQwPFHkgLReKqZ6JZRZmOOcJ3YxxWQolRRHBbZsP
WDaCoz66BN/qOWc1+2UpxwQaMSAVTeLQNCNNypQsSniKBp8gu8nBjJranUJO5yPP
iQzDcf3cvaVoVtOFIjABEXc1bjrqcX9iQe/rJyVBEuHBAhamqY5Q3biUE8harYGG
/W1Q6ApuO1n0VY0TfukGykFUjZrGKGKL1dyy78Mv9O2bxfcdNKlhk9B8cGMyD2lf
N+yC1oM6cOcTvK7Ulj09NIUkP4+vf5kY9rD7Nu+vsjgulcTcu5c=
=qqHM
-----END PGP SIGNATURE-----