On Tue, Nov 03, 2026 at 12:28:19PM +0300, Dan Carpenter wrote:
On Tue, Nov 03, 2026 at 10:12:50AM +0100, Johan Hovold wrote:
It's the kfifo_out_peek() in gb_uart_tx_write_work() that may write 2 bytes beyond gb_tty->buffer (as its size is currently just gb_tty->buffer_payload_max).
Ah, right.
The right way to fix this is to have a commit message that says. "The gb_tty->buffer pointer is supposed to hold a struct with a flex array at the end, but gb_uart_probe() only allocates enough space for the flex array so it's two bytes too small.
Part of the reason for this bug is because it uses a void pointer instead of a struct pointer. Clean that up as well to prevent future bugs."
Please send something like this in v2. (Send exactly this code but edit the commit message if you want or leave it as-is).
Looks good, but since kzalloc_flex() was introduced in 7.0 (and this bugs goes back to 4.9 it may be better to do that conversion in a follow-up patch to assist the backporters.
Johan