[PATCH v2] block: partitions: Use seq_buf_putc() at 24 places

[PATCH v2] block: partitions: Use seq_buf_putc() at 24 places

[Markus Elfring]

From: Markus Elfring <elfring@users.sourceforge.net>
Date: Mon, 29 Jun 2026 08:10:24 +0200

Single line breaks should occasionally be put into a sequence buffer.
Thus use the seq_buf_putc() function in these implementations.

The source code was transformed by using the Coccinelle software.

Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
---

v2:
* Andy Shevchenko requested to preserve two blank lines.

* The source code transformation was extended to all affected places
  for this software area.


 block/partitions/acorn.c   |  8 ++++----
 block/partitions/amiga.c   |  2 +-
 block/partitions/atari.c   |  2 +-
 block/partitions/cmdline.c |  2 +-
 block/partitions/efi.c     |  2 +-
 block/partitions/ibm.c     | 10 +++++-----
 block/partitions/karma.c   |  2 +-
 block/partitions/ldm.c     |  2 +-
 block/partitions/mac.c     |  2 +-
 block/partitions/msdos.c   |  4 ++--
 block/partitions/of.c      |  2 +-
 block/partitions/osf.c     |  2 +-
 block/partitions/sgi.c     |  2 +-
 block/partitions/sun.c     |  2 +-
 block/partitions/sysv68.c  |  2 +-
 block/partitions/ultrix.c  |  2 +-
 16 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/block/partitions/acorn.c b/block/partitions/acorn.c
index 067d6a27a3bd..c48250517448 100644
--- a/block/partitions/acorn.c
+++ b/block/partitions/acorn.c
@@ -290,7 +290,7 @@ int adfspart_check_ADFS(struct parsed_partitions *state)
 			break;
 		}
 	}
-	seq_buf_puts(&state->pp_buf, "\n");
+	seq_buf_putc(&state->pp_buf, '\n');
 	return 1;
 }
 #endif
@@ -397,7 +397,7 @@ int adfspart_check_ICS(struct parsed_partitions *state)
 	}
 
 	put_dev_sector(sect);
-	seq_buf_puts(&state->pp_buf, "\n");
+	seq_buf_putc(&state->pp_buf, '\n');
 	return 1;
 }
 #endif
@@ -468,7 +468,7 @@ int adfspart_check_POWERTEC(struct parsed_partitions *state)
 	}
 
 	put_dev_sector(sect);
-	seq_buf_puts(&state->pp_buf, "\n");
+	seq_buf_putc(&state->pp_buf, '\n');
 	return 1;
 }
 #endif
@@ -539,7 +539,7 @@ int adfspart_check_EESOX(struct parsed_partitions *state)
 
 		size = get_capacity(state->disk);
 		put_partition(state, slot++, start, size - start);
-		seq_buf_puts(&state->pp_buf, "\n");
+		seq_buf_putc(&state->pp_buf, '\n');
 	}
 
 	return i ? 1 : 0;
diff --git a/block/partitions/amiga.c b/block/partitions/amiga.c
index 8325046a14eb..a272f64450ec 100644
--- a/block/partitions/amiga.c
+++ b/block/partitions/amiga.c
@@ -194,7 +194,7 @@ int amiga_partition(struct parsed_partitions *state)
 		}
 		res = 1;
 	}
-	seq_buf_puts(&state->pp_buf, "\n");
+	seq_buf_putc(&state->pp_buf, '\n');
 
 rdb_done:
 	return res;
diff --git a/block/partitions/atari.c b/block/partitions/atari.c
index 2438d1448f38..58863c1a2723 100644
--- a/block/partitions/atari.c
+++ b/block/partitions/atari.c
@@ -150,7 +150,7 @@ int atari_partition(struct parsed_partitions *state)
 #endif
 	put_dev_sector(sect);
 
-	seq_buf_puts(&state->pp_buf, "\n");
+	seq_buf_putc(&state->pp_buf, '\n');
 
 	return 1;
 }
diff --git a/block/partitions/cmdline.c b/block/partitions/cmdline.c
index 4fd52ed154b4..50075eccaade 100644
--- a/block/partitions/cmdline.c
+++ b/block/partitions/cmdline.c
@@ -377,7 +377,7 @@ int cmdline_partition(struct parsed_partitions *state)
 	cmdline_parts_set(parts, disk_size, state);
 	cmdline_parts_verifier(1, state);
 
-	seq_buf_puts(&state->pp_buf, "\n");
+	seq_buf_putc(&state->pp_buf, '\n');
 
 	return 1;
 }
diff --git a/block/partitions/efi.c b/block/partitions/efi.c
index 9865d59093fa..650b91efc832 100644
--- a/block/partitions/efi.c
+++ b/block/partitions/efi.c
@@ -751,6 +751,6 @@ int efi_partition(struct parsed_partitions *state)
 	}
 	kfree(ptes);
 	kfree(gpt);
-	seq_buf_puts(&state->pp_buf, "\n");
+	seq_buf_putc(&state->pp_buf, '\n');
 	return 1;
 }
diff --git a/block/partitions/ibm.c b/block/partitions/ibm.c
index 54047e722a9d..a57de3b192fc 100644
--- a/block/partitions/ibm.c
+++ b/block/partitions/ibm.c
@@ -217,7 +217,7 @@ static int find_vol1_partitions(struct parsed_partitions *state,
 		blk++;
 		data = read_part_sector(state, blk * secperblk, &sect);
 	}
-	seq_buf_puts(&state->pp_buf, "\n");
+	seq_buf_putc(&state->pp_buf, '\n');
 
 	if (!data)
 		return -1;
@@ -254,7 +254,7 @@ static int find_lnx1_partitions(struct parsed_partitions *state,
 		size = nr_sectors;
 		if (size != geo_size) {
 			if (!info) {
-				seq_buf_puts(&state->pp_buf, "\n");
+				seq_buf_putc(&state->pp_buf, '\n');
 				return 1;
 			}
 			if (!strcmp(info->type, "ECKD"))
@@ -266,7 +266,7 @@ static int find_lnx1_partitions(struct parsed_partitions *state,
 	/* first and only partition starts in the first block after the label */
 	offset = labelsect + secperblk;
 	put_partition(state, 1, offset, size - offset);
-	seq_buf_puts(&state->pp_buf, "\n");
+	seq_buf_putc(&state->pp_buf, '\n');
 	return 1;
 }
 
@@ -307,7 +307,7 @@ static int find_cms1_partitions(struct parsed_partitions *state,
 	}
 
 	put_partition(state, 1, offset, size-offset);
-	seq_buf_puts(&state->pp_buf, "\n");
+	seq_buf_putc(&state->pp_buf, '\n');
 	return 1;
 }
 
@@ -388,7 +388,7 @@ int ibm_partition(struct parsed_partitions *state)
 			size = nr_sectors;
 			offset = (info->label_block + 1) * (blocksize >> 9);
 			put_partition(state, 1, offset, size-offset);
-			seq_buf_puts(&state->pp_buf, "\n");
+			seq_buf_putc(&state->pp_buf, '\n');
 		}
 	} else
 		res = 0;
diff --git a/block/partitions/karma.c b/block/partitions/karma.c
index a4e3c5050177..b0ab84169538 100644
--- a/block/partitions/karma.c
+++ b/block/partitions/karma.c
@@ -53,7 +53,7 @@ int karma_partition(struct parsed_partitions *state)
 		}
 		slot++;
 	}
-	seq_buf_puts(&state->pp_buf, "\n");
+	seq_buf_putc(&state->pp_buf, '\n');
 	put_dev_sector(sect);
 	return 1;
 }
diff --git a/block/partitions/ldm.c b/block/partitions/ldm.c
index c0bdcae58a3e..d1bbc9fb09f9 100644
--- a/block/partitions/ldm.c
+++ b/block/partitions/ldm.c
@@ -597,7 +597,7 @@ static bool ldm_create_data_partitions (struct parsed_partitions *pp,
 		part_num++;
 	}
 
-	seq_buf_puts(&pp->pp_buf, "\n");
+	seq_buf_putc(&pp->pp_buf, '\n');
 	return true;
 }
 
diff --git a/block/partitions/mac.c b/block/partitions/mac.c
index df03ca428e15..bb570b5a6eaa 100644
--- a/block/partitions/mac.c
+++ b/block/partitions/mac.c
@@ -152,6 +152,6 @@ int mac_partition(struct parsed_partitions *state)
 #endif
 
 	put_dev_sector(sect);
-	seq_buf_puts(&state->pp_buf, "\n");
+	seq_buf_putc(&state->pp_buf, '\n');
 	return 1;
 }
diff --git a/block/partitions/msdos.c b/block/partitions/msdos.c
index 200ea53ea6a2..4a96541f5351 100644
--- a/block/partitions/msdos.c
+++ b/block/partitions/msdos.c
@@ -608,7 +608,7 @@ int msdos_partition(struct parsed_partitions *state)
 			fb = (struct fat_boot_sector *) data;
 			if (slot == 1 && fb->reserved && fb->fats
 				&& fat_valid_media(fb->media)) {
-				seq_buf_puts(&state->pp_buf, "\n");
+				seq_buf_putc(&state->pp_buf, '\n');
 				put_dev_sector(sect);
 				return 1;
 			} else {
@@ -672,7 +672,7 @@ int msdos_partition(struct parsed_partitions *state)
 			seq_buf_puts(&state->pp_buf, "[EZD]");
 	}
 
-	seq_buf_puts(&state->pp_buf, "\n");
+	seq_buf_putc(&state->pp_buf, '\n');
 
 	/* second pass - output for each on a separate line */
 	p = (struct msdos_partition *) (0x1be + data);
diff --git a/block/partitions/of.c b/block/partitions/of.c
index 53664ea06b65..7803e6f4ecdd 100644
--- a/block/partitions/of.c
+++ b/block/partitions/of.c
@@ -104,7 +104,7 @@ int of_partition(struct parsed_partitions *state)
 		slot++;
 	}
 
-	seq_buf_puts(&state->pp_buf, "\n");
+	seq_buf_putc(&state->pp_buf, '\n');
 
 	of_node_put(partitions_np);
 	return 1;
diff --git a/block/partitions/osf.c b/block/partitions/osf.c
index 2a692584dba9..6f83d4759a5d 100644
--- a/block/partitions/osf.c
+++ b/block/partitions/osf.c
@@ -81,7 +81,7 @@ int osf_partition(struct parsed_partitions *state)
 				le32_to_cpu(partition->p_size));
 		slot++;
 	}
-	seq_buf_puts(&state->pp_buf, "\n");
+	seq_buf_putc(&state->pp_buf, '\n');
 	put_dev_sector(sect);
 	return 1;
 }
diff --git a/block/partitions/sgi.c b/block/partitions/sgi.c
index 2383ca63cd66..f743e3583417 100644
--- a/block/partitions/sgi.c
+++ b/block/partitions/sgi.c
@@ -79,7 +79,7 @@ int sgi_partition(struct parsed_partitions *state)
 		}
 		slot++;
 	}
-	seq_buf_puts(&state->pp_buf, "\n");
+	seq_buf_putc(&state->pp_buf, '\n');
 	put_dev_sector(sect);
 	return 1;
 }
diff --git a/block/partitions/sun.c b/block/partitions/sun.c
index 92c645fcd2e0..c71bad78f34a 100644
--- a/block/partitions/sun.c
+++ b/block/partitions/sun.c
@@ -121,7 +121,7 @@ int sun_partition(struct parsed_partitions *state)
 		}
 		slot++;
 	}
-	seq_buf_puts(&state->pp_buf, "\n");
+	seq_buf_putc(&state->pp_buf, '\n');
 	put_dev_sector(sect);
 	return 1;
 }
diff --git a/block/partitions/sysv68.c b/block/partitions/sysv68.c
index 470e0f9de7be..31d348ac2dfb 100644
--- a/block/partitions/sysv68.c
+++ b/block/partitions/sysv68.c
@@ -86,7 +86,7 @@ int sysv68_partition(struct parsed_partitions *state)
 		}
 		slot++;
 	}
-	seq_buf_puts(&state->pp_buf, "\n");
+	seq_buf_putc(&state->pp_buf, '\n');
 	put_dev_sector(sect);
 	return 1;
 }
diff --git a/block/partitions/ultrix.c b/block/partitions/ultrix.c
index b4b9ddc57a5d..8ac42fda25d1 100644
--- a/block/partitions/ultrix.c
+++ b/block/partitions/ultrix.c
@@ -39,7 +39,7 @@ int ultrix_partition(struct parsed_partitions *state)
 					      label->pt_part[i].pi_blkoff,
 					      label->pt_part[i].pi_nblocks);
 		put_dev_sector(sect);
-		seq_buf_puts(&state->pp_buf, "\n");
+		seq_buf_putc(&state->pp_buf, '\n');
 		return 1;
 	} else {
 		put_dev_sector(sect);
-- 
2.54.0

Re: [PATCH v2] block: partitions: Use seq_buf_putc() at 24 places

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] Out-of-bounds read in sysv68 partition parser leading to a kernel memory leak.
- [Medium] Uninitialized variable 'len' may lead to a NULL pointer dereference or undefined behavior.
--

commit 350b3ea7021ee2238b49cf91963fe54906868307
Author: Markus Elfring <elfring@users.sourceforge.net>

block: partitions: Use seq_buf_putc() at 24 places

Single line breaks should occasionally be put into a sequence buffer.
Thus use the seq_buf_putc() function in these implementations.

The source code was transformed by using the Coccinelle software.

[ ... ]

> diff --git a/block/partitions/of.c b/block/partitions/of.c
> index 53664ea06b654..7803e6f4ecdd9 100644
> --- a/block/partitions/of.c
> +++ b/block/partitions/of.c
> @@ -104,7 +104,7 @@ int of_partition(struct parsed_partitions *state)
>  		slot++;
>  	}
>  
> -	seq_buf_puts(&state->pp_buf, "\n");
> +	seq_buf_putc(&state->pp_buf, '\n');

[Severity: Medium]
This is a pre-existing issue, but I noticed a potential uninitialized
variable bug when looking at the partition validation called just before
this in of_partition().

If a device tree partition node is missing the 'reg' property:

block/partitions/of.c:validate_of_partition() {
    ...
	int len;

	const __be32 *reg = of_get_property(np, "reg", &len);
	int a_cells = of_n_addr_cells(np);
	int s_cells = of_n_size_cells(np);

	/* Make sure reg len match the expected addr and size cells */
	if (len / sizeof(*reg) != a_cells + s_cells)
    ...
}

of_get_property() returns NULL and leaves len uninitialized. The code then
divides this uninitialized len by 4 and compares it to expected cell counts.

If the uninitialized stack garbage happens to match, could this proceed to
add_of_partition() where it directly passes the NULL reg pointer to
of_read_number(), unconditionally dereferencing it?

block/partitions/of.c:add_of_partition() {
    ...
	int len;

	const __be32 *reg = of_get_property(np, "reg", &len);
	int a_cells = of_n_addr_cells(np);
	int s_cells = of_n_size_cells(np);

	/* Convert bytes to sector size */
	u64 offset = of_read_number(reg, a_cells) / SECTOR_SIZE;
    ...
}

[ ... ]

> diff --git a/block/partitions/sysv68.c b/block/partitions/sysv68.c
> index 470e0f9de7be3..31d348ac2dfb3 100644
> --- a/block/partitions/sysv68.c
> +++ b/block/partitions/sysv68.c
> @@ -86,7 +86,7 @@ int sysv68_partition(struct parsed_partitions *state)
>  		}
>  		slot++;
>  	}
> -	seq_buf_puts(&state->pp_buf, "\n");
> +	seq_buf_putc(&state->pp_buf, '\n');

[Severity: High]
This isn't a bug introduced by this patch, but does the loop immediately
preceding this code have an out-of-bounds read issue?

sysv68_partition() reads the number of slices from the untrusted disk
label without validating it against the 512-byte sector buffer bounds:

block/partitions/sysv68.c:sysv68_partition() {
    ...
	slice = (struct slice *)data;
	for (i = 0; i < slices; i++, slice++) {
		if (slot == state->limit)
			break;
		if (be32_to_cpu(slice->nblocks)) {
			put_partition(state, slot,
				be32_to_cpu(slice->blkoff),
				be32_to_cpu(slice->nblocks));
    ...
}

It then iterates up to state->limit (typically 256) times, advancing the
slice pointer. Reading 256 struct slice entries takes 2048 bytes out of a
guaranteed 512-byte sector buffer.

If the 512-byte sector is located near the end of a mapped page, could
reading beyond 512 bytes cross into adjacent physical kernel memory and
leak it via the partition table?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/7360cab3-7a2f-4903-85f1-0f03387b0d88@web.de?part=1

Re: [PATCH v2] block: partitions: Use seq_buf_putc() at 24 places

[Andy Shevchenko]

On Mon, Jun 29, 2026 at 09:16:09AM +0200, Markus Elfring wrote:
> From: Markus Elfring <elfring@users.sourceforge.net>
> Date: Mon, 29 Jun 2026 08:10:24 +0200
> 
> Single line breaks should occasionally be put into a sequence buffer.
> Thus use the seq_buf_putc() function in these implementations.
> 
> The source code was transformed by using the Coccinelle software.
> 
> Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
> ---
> 
> v2:
> * Andy Shevchenko requested to preserve two blank lines.

This comment in the context of the given commit message may be odd.
The blank lines mentioned were in the code that previous coccinelle
script removed, id est the code

	...blank line...
	seq_buf_puts()
	...blank line...

the script transformed to a single line

	seq_buf_putc()

So my request is to keep the original blank line(s) as is.

> * The source code transformation was extended to all affected places
>   for this software area.

-- 
With Best Regards,
Andy Shevchenko