Re: [PATCH 02/15] drm/xe/configfs: Fix out-of-bounds read in parse_wa_bb_lines()

[Rodrigo Vivi <rodrigo.vivi@intel.com>]

On Mon, Oct 05, 2026 at 10:06:38PM +0000, Stuart Summers wrote:
> The outer loop advances the cursor unconditionally at the end of each
> iteration. When the last token of a line is terminated by the NUL rather
> than by whitespace, e.g. "echo -n 'rcs cmd 1'", the cursor is already on
> the NUL and the increment steps past the end of the buffer, so the loop
> condition reads out of bounds. The leading strspn(p, " \t\n") already
> skips the line separators, and every iteration consumes at least the
> engine class token, so dropping the increment keeps the loop making
> progress.
> 
> Fixes: 39ac06f70062 ("drm/xe/configfs: Add post context restore bb")
> 
> Signed-off-by: Stuart Summers <stuart.summers@intel.com>
> Assisted-by: LLM

Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>

> ---
>  drivers/gpu/drm/xe/xe_configfs.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/xe/xe_configfs.c b/drivers/gpu/drm/xe/xe_configfs.c
> index e1cf5af958bc..1c7a096aa046 100644
> --- a/drivers/gpu/drm/xe/xe_configfs.c
> +++ b/drivers/gpu/drm/xe/xe_configfs.c
> @@ -820,7 +820,11 @@ static ssize_t parse_wa_bb_lines(const char *lines,
>  	ssize_t dwords = 0, ret;
>  	const char *p;
>  
> -	for (p = lines; *p; p++) {
> +	/*
> +	 * Each iteration consumes at least the engine class token if it doesn't
> +	 * error out, so the loop always makes progress without advancing @p.
> +	 */
> +	for (p = lines; *p;) {
>  		const struct engine_info *info = NULL;
>  		u32 val, val2;
>  
> -- 
> 2.43.0
>