Re: [PATCH v2] params: bound array element output to the caller's page buffer

[Petr Pavlu <petr.pavlu@suse.com>]

On 5/7/26 10:21 AM, Pengpeng Hou wrote:
> param_array_get() appends each element's string representation into the
> shared sysfs page buffer by passing buffer + off to the element getter.
> 
> That works for getters that only write a small bounded string, but
> param_get_charp() and similar helpers format against PAGE_SIZE from the
> pointer they receive. Once off is non-zero, an element getter can
> therefore write past the end of the original sysfs page buffer.
> 
> Collect each element into a temporary PAGE_SIZE buffer first and then
> copy only the remaining space into the caller's page buffer.
> 
> Cc: stable@vger.kernel.org
> Reviewed-by: Petr Pavlu <petr.pavlu@suse.com>
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
> Changes since v1:
> - drop the incorrect Fixes tag; as Petr pointed out, the issue appears
>   to predate mainline git history
> - add Petr's Reviewed-by
> - avoid rewriting the previous separator if the page buffer has no room
>   to copy any bytes from the next element

I'm confused by this change. Didn't the simpler v1 already have this
behavior?

-- 
Thanks,
Petr