FAILED: patch "[PATCH] cpu: hotplug: Bound hotplug states sysfs output" failed to apply to 5.10-stable tree

FAILED: patch "[PATCH] cpu: hotplug: Bound hotplug states sysfs output" failed to apply to 5.10-stable tree

[gregkh]

The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x 86f436567f2516a0083b210bedc933544826a2c3
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2026072036-pentagon-armory-48cd@gregkh' --subject-prefix 'PATCH 5.10.y' 'HEAD^..'

Possible dependencies:



thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 86f436567f2516a0083b210bedc933544826a2c3 Mon Sep 17 00:00:00 2001
From: Bradley Morgan <include@grrlz.net>
Date: Fri, 19 Jun 2026 16:37:18 +0000
Subject: [PATCH] cpu: hotplug: Bound hotplug states sysfs output

states_show() adds CPU hotplug state names into a single sysfs buffer
using sprintf(). With enough registered states, this can write past the
end of the PAGE_SIZE buffer.

Use sysfs_emit_at() so output is bounded.

Fixes: 98f8cdce1db5 ("cpu/hotplug: Add sysfs state interface")
Signed-off-by: Bradley Morgan <include@grrlz.net>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260619163719.12103-2-include@grrlz.net

diff --git a/kernel/cpu.c b/kernel/cpu.c
index 3ed24c711e3f..77fdb2013ab8 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -2865,21 +2865,17 @@ static const struct attribute_group cpuhp_cpu_attr_group = {
 	.name = "hotplug",
 };
 
-static ssize_t states_show(struct device *dev,
-				 struct device_attribute *attr, char *buf)
+static ssize_t states_show(struct device *dev, struct device_attribute *attr, char *buf)
 {
-	ssize_t cur, res = 0;
+	ssize_t res = 0;
 	int i;
 
 	mutex_lock(&cpuhp_state_mutex);
 	for (i = CPUHP_OFFLINE; i <= CPUHP_ONLINE; i++) {
 		struct cpuhp_step *sp = cpuhp_get_step(i);
 
-		if (sp->name) {
-			cur = sprintf(buf, "%3d: %s\n", i, sp->name);
-			buf += cur;
-			res += cur;
-		}
+		if (sp->name)
+			res += sysfs_emit_at(buf, res, "%3d: %s\n", i, sp->name);
 	}
 	mutex_unlock(&cpuhp_state_mutex);
 	return res;

[PATCH 5.10.y] cpu: hotplug: Bound hotplug states sysfs output

[Thomas Gleixner]

From: Bradley Morgan <include@grrlz.net>

commit 86f436567f2516a0083b210bedc933544826a2c3 upstream.

states_show() adds CPU hotplug state names into a single sysfs buffer
using sprintf(). With enough registered states, this can write past the
end of the PAGE_SIZE buffer.

Use sysfs_emit_at() so output is bounded.

Fixes: 98f8cdce1db5 ("cpu/hotplug: Add sysfs state interface")
Signed-off-by: Bradley Morgan <include@grrlz.net>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260619163719.12103-2-include@grrlz.net
---
 kernel/cpu.c |    9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)
---
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -2319,18 +2319,15 @@ static const struct attribute_group cpuh
 static ssize_t show_cpuhp_states(struct device *dev,
 				 struct device_attribute *attr, char *buf)
 {
-	ssize_t cur, res = 0;
+	ssize_t res = 0;
 	int i;
 
 	mutex_lock(&cpuhp_state_mutex);
 	for (i = CPUHP_OFFLINE; i <= CPUHP_ONLINE; i++) {
 		struct cpuhp_step *sp = cpuhp_get_step(i);
 
-		if (sp->name) {
-			cur = sprintf(buf, "%3d: %s\n", i, sp->name);
-			buf += cur;
-			res += cur;
-		}
+		if (sp->name)
+			res += sysfs_emit_at(buf, res, "%3d: %s\n", i, sp->name);
 	}
 	mutex_unlock(&cpuhp_state_mutex);
 	return res;

Re: [PATCH 5.10.y] cpu: hotplug: Bound hotplug states sysfs output

[Bradley Morgan]

On July 22, 2026 7:38:51 PM GMT+01:00, Thomas Gleixner <tglx@kernel.org>
wrote:
>From: Bradley Morgan <include@grrlz.net>
>
>commit 86f436567f2516a0083b210bedc933544826a2c3 upstream.
>
>states_show() adds CPU hotplug state names into a single sysfs buffer
>using sprintf(). With enough registered states, this can write past the
>end of the PAGE_SIZE buffer.
>
>Use sysfs_emit_at() so output is bounded.
>
>Fixes: 98f8cdce1db5 ("cpu/hotplug: Add sysfs state interface")
>Signed-off-by: Bradley Morgan <include@grrlz.net>
>Signed-off-by: Thomas Gleixner <tglx@kernel.org>
>Cc: stable@vger.kernel.org
>Link: https://patch.msgid.link/20260619163719.12103-2-include@grrlz.net
>---
> kernel/cpu.c |    9 +++------
> 1 file changed, 3 insertions(+), 6 deletions(-)
>---
>--- a/kernel/cpu.c
>+++ b/kernel/cpu.c
>@@ -2319,18 +2319,15 @@ static const struct attribute_group cpuh
> static ssize_t show_cpuhp_states(struct device *dev,
> 				 struct device_attribute *attr, char *buf)
> {
>-	ssize_t cur, res = 0;
>+	ssize_t res = 0;
> 	int i;
> 
> 	mutex_lock(&cpuhp_state_mutex);
> 	for (i = CPUHP_OFFLINE; i <= CPUHP_ONLINE; i++) {
> 		struct cpuhp_step *sp = cpuhp_get_step(i);
> 
>-		if (sp->name) {
>-			cur = sprintf(buf, "%3d: %s\n", i, sp->name);
>-			buf += cur;
>-			res += cur;
>-		}
>+		if (sp->name)
>+			res += sysfs_emit_at(buf, res, "%3d: %s\n", i, sp->name);
> 	}
> 	mutex_unlock(&cpuhp_state_mutex);
> 	return res;
>


Cheers Thomas! :)

Thanks!

Re: [PATCH 5.10.y] cpu: hotplug: Bound hotplug states sysfs output

[Sasha Levin]

> states_show() adds CPU hotplug state names into a single sysfs buffer
> using sprintf(). With enough registered states, this can write past the
> end of the PAGE_SIZE buffer.
>
> Use sysfs_emit_at() so output is bounded.

Queued for 5.10, thanks.

-- 
Thanks,
Sasha