On Fri, Aug 14, 2026 at 04:05:48PM +0800, Pengpeng Hou wrote:
> The BPMP debugfs parser reads fixed-width values and bounded strings
> from a size-delimited reply. Its fixed-width helper currently treats a
> short copy as success, while the string helper advances past the range
> when no NUL terminator is present. The status helper also uses an
> unsigned return type for negative errors.
> 
> Require complete fixed-width reads and a terminator within the remaining
> range before moving the cursor. Use a signed status result so errors
> reach callers unchanged.
> 
> Fixes: f2381f652266 ("firmware: tegra: Add BPMP debugfs support")
> 
> Assisted-by: Codex:gpt-5
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
> Changes since v1: https://lore.kernel.org/all/20260715083726.30740-1-pengpeng@iscas.ac.cn/
> - no source-code changes
> - rebase on the current Tegra firmware sources and tighten the commit message
> - add the coding-assistant disclosure
> 
> The bounded parser helpers and callers were reviewed statically; no
> malformed BPMP response was injected.
> 
>  drivers/firmware/tegra/bpmp-debugfs.c | 17 +++++++++++++----
>  1 file changed, 13 insertions(+), 4 deletions(-)

This doesn't make sense to me. The seqbuf_read*() helpers already use
seqbuf_avail() to make sure they never read past the end of the buffer.
We also leave scope immediately anytime we see an overflow.

Worst case we'll see memcpy() copy 0 bytes, as far as I can tell, and
that's harmless (even though not entirely free).

Thierry