Commit fb442a6673ff for kernel

commit fb442a6673ff1046bf67754957d95880fdb394b5
Author: George Wilson <gcwilson@linux.ibm.com>
Date:   Fri Aug 7 11:59:00 2026 -0500

    powerpc/pseries: lparcfg - fix kbuf[] underflow

    In lparcfg_write(), a count of 0 results in kbuf[] being indexed at -1.
    Check for count == 0 in the existing check for count > sizeof(kbuf) and
    return -EINVAL if true.

    Fixes: 74422e2b1939 ("powerpc/pseries: Remove VLA from lparcfg_write()")
    Acked-by: Nayna Jain <nayna@linux.ibm.com>
    Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
    Cc: stable@vger.kernel.org # 4.20
    Signed-off-by: George Wilson <gcwilson@linux.ibm.com>
    Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>

diff --git a/arch/powerpc/platforms/pseries/lparcfg.c b/arch/powerpc/platforms/pseries/lparcfg.c
index 54b7ecf375b5..3280b7968cab 100644
--- a/arch/powerpc/platforms/pseries/lparcfg.c
+++ b/arch/powerpc/platforms/pseries/lparcfg.c
@@ -699,7 +699,7 @@ static ssize_t lparcfg_write(struct file *file, const char __user * buf,
 	if (!firmware_has_feature(FW_FEATURE_SPLPAR))
 		return -EINVAL;

-	if (count > sizeof(kbuf))
+	if (count == 0 || count > sizeof(kbuf))
 		return -EINVAL;

 	if (copy_from_user(kbuf, buf, count))