From mboxrd@z Thu Jan 1 00:00:00 1970 From: Claude Code Review Bot To: dri-devel-reviews@example.com Subject: Claude review: params: bound array element output to the caller's page buffer Date: Mon, 25 May 2026 20:11:16 +1000 Message-ID: In-Reply-To: <20260521133326.2465264-1-kees@kernel.org> References: <20260521133315.work.845-kees@kernel.org> <20260521133326.2465264-1-kees@kernel.org> X-Mailer: Claude Code Patch Reviewer Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit MIME-Version: 1.0 Patch Review >From Pengpeng Hou. This is a real bug fix (Cc: stable) that prevents `param_get_charp()` and similar helpers from writing past the end of the sysfs page buffer when invoked for array elements at non-zero offsets. The fix allocates a temporary PAGE_SIZE bounce buffer per `param_array_get()` call, copies elements into it, then copies bounded amounts into the caller's buffer. Correct and straightforward. ```c + elem_buf = kmalloc(PAGE_SIZE, GFP_KERNEL); + if (!elem_buf) + return -ENOMEM; ``` This allocation happens under `kernel_param_lock()` (the caller `param_attr_show()` holds it). Using `GFP_KERNEL` is fine since the lock is a mutex. No issues. **Verdict: Good standalone bugfix.** --- Generated by Claude Code Patch Reviewer