[PATCH v4 01/14] drm/panic: Do not use un-escaped URL as format string
From: Thomas Zimmermann <tzimmermann@suse.de>
Date: 2026-09-09 08:58:44
Also in:
amd-gfx, dri-devel, imx, intel-gfx, intel-xe, linux-doc, linux-hyperv, linux-renesas-soc, nouveau, rust-for-linux, sashiko-reviews, stable, virtualization
Subsystem:
drm drivers, drm drivers and misc gpu patches, drm panic, the rest · Maintainers:
David Airlie, Simona Vetter, Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann, Jocelyn Falempe, Javier Martinez Canillas, Linus Torvalds
Replace the direct use of DRM_PANIC_SCREEN_QR_CODE_URL in snprintf()
with a %s conversion specifier. Avoids a possible vulnerabilty from
a crafted URL string.
As the attacker needs to control the kernel at the Kconfig level, the
potential for an exploit is likely low.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>
Fixes: cb5164ac43d0 ("drm/panic: Add a QR code panic screen")
Cc: Javier Martinez Canillas <javierm@redhat.com>
Cc: Jocelyn Falempe <jfalempe@redhat.com>
Cc: dri-devel@lists.freedesktop.org
Cc: <redacted> # v6.12+
---
drivers/gpu/drm/drm_panic.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_panic.c b/drivers/gpu/drm/drm_panic.c
index e576c4791861..ba21df4be338 100644
--- a/drivers/gpu/drm/drm_panic.c
+++ b/drivers/gpu/drm/drm_panic.c@@ -658,7 +658,8 @@ static int drm_panic_get_qr_code_url(u8 **qr_image) char *kmsg; int max_qr_data_size, url_len; - url_len = snprintf(url, sizeof(url), CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL "?a=%s&v=%s&z=", + url_len = snprintf(url, sizeof(url), "%s?a=%s&v=%s&z=", + CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL, utsname()->machine, utsname()->release); max_qr_data_size = drm_panic_qr_max_data_size(panic_qr_version, url_len);
--
2.55.0