[PATCH] accel/ivpu: prevent uninitialized data bug in debugfs

[PATCH] accel/ivpu: prevent uninitialized data bug in debugfs

[Dan Carpenter]

The simple_write_to_buffer() will only initialize data starting from
the *pos offset so if it's non-zero then the first part of the buffer
uninitialized.  Really, if *pos is non-zero then this code won't work
so just check for that at the start of the function.

Fixes: 320323d2e545 ("accel/ivpu: Add debugfs interface for setting HWS priority bands")
Signed-off-by: Dan Carpenter <error27@gmail.com>
---
 drivers/accel/ivpu/ivpu_debugfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/accel/ivpu/ivpu_debugfs.c b/drivers/accel/ivpu/ivpu_debugfs.c
index 189dbe94cf14..dc20bc73c6ed 100644
--- a/drivers/accel/ivpu/ivpu_debugfs.c
+++ b/drivers/accel/ivpu/ivpu_debugfs.c
@@ -450,7 +450,7 @@ priority_bands_fops_write(struct file *file, const char __user *user_buf, size_t
 	u32 band;
 	int ret;
 
-	if (size >= sizeof(buf))
+	if (*pos != 0 || size >= sizeof(buf))
 		return -EINVAL;
 
 	ret = simple_write_to_buffer(buf, sizeof(buf) - 1, pos, user_buf, size);
-- 
2.53.0

Re: [PATCH] accel/ivpu: prevent uninitialized data bug in debugfs

[Wachowski, Karol]

On 25-May-26 9:14, Dan Carpenter wrote:
> The simple_write_to_buffer() will only initialize data starting from
> the *pos offset so if it's non-zero then the first part of the buffer
> uninitialized.  Really, if *pos is non-zero then this code won't work
> so just check for that at the start of the function.
> 
> Fixes: 320323d2e545 ("accel/ivpu: Add debugfs interface for setting HWS priority bands")
> Signed-off-by: Dan Carpenter <error27@gmail.com>
> ---
>   drivers/accel/ivpu/ivpu_debugfs.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/accel/ivpu/ivpu_debugfs.c b/drivers/accel/ivpu/ivpu_debugfs.c
> index 189dbe94cf14..dc20bc73c6ed 100644
> --- a/drivers/accel/ivpu/ivpu_debugfs.c
> +++ b/drivers/accel/ivpu/ivpu_debugfs.c
> @@ -450,7 +450,7 @@ priority_bands_fops_write(struct file *file, const char __user *user_buf, size_t
>   	u32 band;
>   	int ret;
>   
> -	if (size >= sizeof(buf))
> +	if (*pos != 0 || size >= sizeof(buf))
>   		return -EINVAL;
>   
>   	ret = simple_write_to_buffer(buf, sizeof(buf) - 1, pos, user_buf, size);

Thanks for submission.

Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>

Claude review: accel/ivpu: prevent uninitialized data bug in debugfs

[Claude Code Review Bot]

Overall Series Review

Subject: accel/ivpu: prevent uninitialized data bug in debugfs
Author: Dan Carpenter <error27@gmail.com>
Patches: 2
Reviewed: 2026-05-26T07:38:50.251194

---

This is a single-patch fix from Dan Carpenter addressing an uninitialized data bug in the IVPU debugfs `priority_bands_fops_write` handler. The analysis is correct and the fix is appropriate.

The core issue: `simple_write_to_buffer()` writes into `buf` starting at offset `*pos` (line 1190 of `fs/libfs.c`: `copy_from_user(to + pos, from, count)`). If `*pos` is non-zero, the bytes in `buf[0..*pos-1]` are left uninitialized on the stack. The subsequent `buf[ret] = '\0'` and `sscanf()` would then operate on partially uninitialized data, which is both a correctness bug and a potential information leak.

---
Generated by Claude Code Patch Reviewer

Claude review: accel/ivpu: prevent uninitialized data bug in debugfs

[Claude Code Review Bot]

Patch Review

**Verdict: Looks good.**

The fix adds a `*pos != 0` check to the existing early-return guard:

```c
-	if (size >= sizeof(buf))
+	if (*pos != 0 || size >= sizeof(buf))
 		return -EINVAL;
```

This is the right approach. The function expects a single complete write containing a formatted string like `"%u %u %u %u"` — partial/resumed writes at a non-zero offset would never produce correct results even if the buffer were properly initialized, since the `sscanf` on line 461 needs the full string from the beginning.

The pattern of rejecting `*pos != 0` is well-established in the kernel for debugfs write handlers that parse a complete user-space string in one shot (e.g., `dvfs_mode_fops_write` and similar handlers throughout the tree).

One minor observation: `simple_write_to_buffer` returns the number of bytes actually written (not necessarily equal to `size`), and that return value is used on line 460 as `buf[ret] = '\0'`. With the `*pos != 0` check in place, `ret` will always reflect bytes written starting from offset 0, so this is now fully correct.

**No issues found.** Clean, minimal, well-targeted fix with a proper Fixes tag.

---
Generated by Claude Code Patch Reviewer