Re: [PATCH v2] params: bound array element output to the caller's page buffer

[Kees Cook]

On Thu, May 07, 2026 at 04:21:03PM +0800, Pengpeng Hou wrote:
> param_array_get() appends each element's string representation into the
> shared sysfs page buffer by passing buffer + off to the element getter.
> 
> That works for getters that only write a small bounded string, but
> param_get_charp() and similar helpers format against PAGE_SIZE from the
> pointer they receive. Once off is non-zero, an element getter can
> therefore write past the end of the original sysfs page buffer.
> 
> Collect each element into a temporary PAGE_SIZE buffer first and then
> copy only the remaining space into the caller's page buffer.
> 
> Cc: stable@xxxxxxxxxxxxxxx
> Reviewed-by: Petr Pavlu <petr.pavlu@xxxxxxxx>
> Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>

Yeah, this is a good first step. I'd really like to change all these
get/set ops here and for sysfs, etc, to use seq_buf, but that's a much
larger change. In the meantime, let's do this.

Reviewed-by: Kees Cook <kees@xxxxxxxxxx>

-Kees

-- 
Kees Cook