On Tue, Nov 03, 2026 at 11:44:55AM +0300, Dan Carpenter wrote:

On Mon, Nov 02, 2026 at 03:33:58PM -0600, Alex Elder wrote:

...

On 11/2/26 1:53 PM, Maritu Hone wrote:

...

gb_tty->buffer is allocated once in gb_uart_probe() and reused for every outgoing chunk as the backing store for a struct gb_uart_send_data_request:

struct gb_uart_send_data_request { __le16 size; __u8 data[]; } __packed;

In gb_uart_tx_write_work():

request = gb_tty->buffer; ... send_size = gb_tty->buffer_payload_max; if (send_size > gb_tty->credits) send_size = gb_tty->credits; send_size = kfifo_out_peek(&gb_tty->write_fifo, &request->data[0], send_size);

Wow.. Heh... I have read both the original message and your message and I still have no idea which function contains the actual memcpy() overflow. :P

It's the kfifo_out_peek() in gb_uart_tx_write_work() that may write 2 bytes beyond gb_tty->buffer (as its size is currently just gb_tty->buffer_payload_max).

Johan