[PATCH] drm: zynqmp_dp: Fix uninitialized variable in debugfs()

[PATCH] drm: zynqmp_dp: Fix uninitialized variable in debugfs()

[Dan Carpenter]

If the *ppos is non-zero then simple_write_to_buffer() will not
initialize the start of the buf[] buffer.  It doesn't really make sense
to allow non-zero values for *ppos, so check for that at the start and
return -EINVAL.

Fixes: 28edaacb821c ("drm: zynqmp_dp: Add debugfs interface for compliance testing")
Signed-off-by: Dan Carpenter <error27@gmail.com>
---
 drivers/gpu/drm/xlnx/zynqmp_dp.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/gpu/drm/xlnx/zynqmp_dp.c b/drivers/gpu/drm/xlnx/zynqmp_dp.c
index 7fb11b0a44f0..847179476041 100644
--- a/drivers/gpu/drm/xlnx/zynqmp_dp.c
+++ b/drivers/gpu/drm/xlnx/zynqmp_dp.c
@@ -1888,6 +1888,9 @@ static ssize_t zynqmp_dp_pattern_write(struct file *file,
 	ssize_t ret;
 	int pattern;
 
+	if (*ppos != 0)
+		return -EINVAL;
+
 	ret = simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, user_buf,
 				     count);
 	if (ret < 0)
@@ -2028,6 +2031,9 @@ static ssize_t zynqmp_dp_custom_write(struct file *file,
 	ssize_t ret;
 	char buf[sizeof(dp->test.custom)];
 
+	if (*ppos != 0)
+		return -EINVAL;
+
 	ret = simple_write_to_buffer(buf, sizeof(buf), ppos, user_buf, count);
 	if (ret < 0)
 		return ret;
-- 
2.53.0

Claude review: drm: zynqmp_dp: Fix uninitialized variable in debugfs()

[Claude Code Review Bot]

Overall Series Review

Subject: drm: zynqmp_dp: Fix uninitialized variable in debugfs()
Author: Dan Carpenter <error27@gmail.com>
Patches: 1
Reviewed: 2026-05-26T07:37:39.738381

---

This is a single-patch series from Dan Carpenter fixing an uninitialized stack buffer issue in two debugfs write handlers in the zynqmp DisplayPort driver. The fix is correct, minimal, and well-targeted. The commit message clearly explains the root cause: `simple_write_to_buffer()` copies user data at offset `*ppos` into the destination buffer, leaving bytes `0` through `*ppos-1` uninitialized when `*ppos` is non-zero.

**Verdict: Looks good to merge.**

---

---
Generated by Claude Code Patch Reviewer

Claude review: drm: zynqmp_dp: Fix uninitialized variable in debugfs()

[Claude Code Review Bot]

Patch Review

**Analysis of the bug:**

`simple_write_to_buffer()` writes to `to + pos` where `pos = *ppos`. If `*ppos` is non-zero, the beginning of the stack-allocated buffer is never initialized. This affects both functions:

1. **`zynqmp_dp_pattern_write()`** — the uninitialized prefix bytes in `buf` are followed by `buf[ret] = '\0'` and then `sysfs_match_string()`. The match would operate on garbage bytes at the start of the string.

2. **`zynqmp_dp_custom_write()`** — `memcpy(dp->test.custom, buf, ret)` copies from the beginning of `buf`, which includes uninitialized bytes when `*ppos` was non-zero. This leaks stack contents into `dp->test.custom`, which is then written to hardware via `zynqmp_dp_set_test_pattern()`.

**The fix:**

```c
if (*ppos != 0)
    return -EINVAL;
```

Added at the top of both write functions. This is the standard kernel pattern for debugfs write handlers that expect a single complete write. Both `file_operations` structs use `noop_llseek`, confirming these are not designed for seekable I/O.

**Review comments:**

- **Correct and complete.** Both affected write handlers are fixed.
- **Appropriate error code.** `-EINVAL` is the right choice for rejecting an invalid ppos.
- **Behavioral note:** After a successful write, `simple_write_to_buffer()` advances `*ppos`, so a second `write()` on the same fd will now return `-EINVAL` instead of the previous behavior (returning `0` when `*ppos >= available`). This is actually an improvement — `-EINVAL` is more informative than a silent zero-length write.
- **Fixes tag** correctly references the commit that introduced the debugfs interface.

**No issues found.** 

Reviewed-by worthy as-is.

---
Generated by Claude Code Patch Reviewer