On Tue, Sep 15, 2026 at 08:18:44AM +0000, Bill Wendling wrote:
> diff --git a/drivers/gpu/drm/xe/xe_gt_sriov_pf_debugfs.c
> b/drivers/gpu/drm/xe/xe_gt_sriov_pf_debugfs.c
> index 0f242db775e1..5db7fc067c4d 100644
> --- a/drivers/gpu/drm/xe/xe_gt_sriov_pf_debugfs.c
> +++ b/drivers/gpu/drm/xe/xe_gt_sriov_pf_debugfs.c
> @@ -4,6 +4,7 @@
> */
>
> #include <linux/debugfs.h>
> +#include <linux/seq_buf.h>
>
> #include <drm/drm_print.h>
> #include <drm/drm_debugfs.h>
> @@ -663,15 +664,15 @@ static ssize_t control_write(struct file *file, const
> char __user *buf, size_t c
> static ssize_t control_read(struct file *file, char __user *buf, size_t
> count, loff_t *ppos)
> {
> char help[128];
> + struct seq_buf s;
> size_t n;
>
> - help[0] = '\0';
> + seq_buf_init(&s, help, sizeof(help));
> for (n = 0; n < ARRAY_SIZE(control_cmds); n++) {
> - strlcat(help, control_cmds[n].cmd, sizeof(help));
> - strlcat(help, "\n", sizeof(help));
> + seq_buf_printf(&s, "%s\n", control_cmds[n].cmd);
> }
Yay seq_buf! I would tweak the 3 init stack variable lines into just
using the single DECLARE_SEQ_BUF:
DECLARE_SEQ_BUF(s, 128);
>
> - return simple_read_from_buffer(buf, count, ppos, help, strlen(help));
> + return simple_read_from_buffer(buf, count, ppos, help,
> seq_buf_used(&s));
seq_buf_used() isn't correct in the case of full-buffer use. e.g. if
the help buffer ends up filled with 127 chars and a NUL terminator,
seq_buf_used() returns 128, but you want 127 here. Using strlen() ends up
being redundant, though. I think we need to add seq_buf_strlen() which
handles the same logic that seq_buf_str() does.
-Kees
--
Kees Cook
