Re: [PATCH v3 01/14] drm/panic: Do not use un-escaped URL as format string
From: Jocelyn Falempe <jfalempe@redhat.com>
Date: 2026-09-07 21:01:06
Also in:
amd-gfx, dri-devel, imx, intel-gfx, intel-xe, linux-arm-kernel, linux-doc, linux-renesas-soc, nouveau, rust-for-linux, sashiko-reviews, stable, virtualization
On 9/2/26 14:13, Thomas Zimmermann wrote:
Replace the direct use of DRM_PANIC_SCREEN_QR_CODE_URL in snprintf() with a %s conversion specifier. Avoids a possible vulnerabilty from a crafted URL string. As the attacker needs to control the kernel at the Kconfig level, the potential for an exploit is likely low.
Thanks, it looks good to me. Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>
quoted hunk ↗ jump to hunk
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Fixes: cb5164ac43d0 ("drm/panic: Add a QR code panic screen") Cc: Javier Martinez Canillas <javierm@redhat.com> Cc: Jocelyn Falempe <jfalempe@redhat.com> Cc: dri-devel@lists.freedesktop.org Cc: <redacted> # v6.12+ --- drivers/gpu/drm/drm_panic.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)diff --git a/drivers/gpu/drm/drm_panic.c b/drivers/gpu/drm/drm_panic.c index e576c4791861..ba21df4be338 100644 --- a/drivers/gpu/drm/drm_panic.c +++ b/drivers/gpu/drm/drm_panic.c@@ -658,7 +658,8 @@ static int drm_panic_get_qr_code_url(u8 **qr_image) char *kmsg; int max_qr_data_size, url_len; - url_len = snprintf(url, sizeof(url), CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL "?a=%s&v=%s&z=", + url_len = snprintf(url, sizeof(url), "%s?a=%s&v=%s&z=", + CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL, utsname()->machine, utsname()->release); max_qr_data_size = drm_panic_qr_max_data_size(panic_qr_version, url_len);