Re: [PATCH] staging: greybus: uart: fix heap buffer overflow in gb_tty->buffer

[Johan Hovold]

On Tue, Nov 03, 2026 at 12:28:19PM +0300, Dan Carpenter wrote:
> On Tue, Nov 03, 2026 at 10:12:50AM +0100, Johan Hovold wrote:

> > It's the kfifo_out_peek() in gb_uart_tx_write_work() that may write 2
> > bytes beyond gb_tty->buffer (as its size is currently just
> > gb_tty->buffer_payload_max).
> 
> Ah, right.
> 
> The right way to fix this is to have a commit message that
> says.  "The gb_tty->buffer pointer is supposed to hold a struct with
> a flex array at the end, but gb_uart_probe() only allocates enough
> space for the flex array so it's two bytes too small.
> 
> Part of the reason for this bug is because it uses a void pointer
> instead of a struct pointer.  Clean that up as well to prevent
> future bugs."
> 
> Please send something like this in v2.  (Send exactly this code
> but edit the commit message if you want or leave it as-is).

Looks good, but since kzalloc_flex() was introduced in 7.0 (and this
bugs goes back to 4.9 it may be better to do that conversion in a
follow-up patch to assist the backporters.

Johan