On 06/01/2026 06:19, Nathan Chancellor wrote:
If a user has set an invalid CONFIG_DRM_PANIC_SCREEN value (such as
"qr_code" without CONFIG_DRM_PANIC_SCREEN_QR_CODE=y due to missing or
incorrect Rust dependencies), there is a panic when accessing
/sys/module/drm/parameters/panic_screen:
[ 12.218375] BUG: unable to handle page fault for address: 0000000796dd8818
[ 12.219737] #PF: supervisor read access in kernel mode
...
[ 12.227167] RIP: 0010:drm_panic_type_get+0x1b/0x30
If drm_panic_type_set() does not find a valid drm_panic_type enumeration
in drm_panic_type_map based on the provided value, it does not change
drm_panic_type from the default -1 value, which is not a valid index for
accessing drm_panic_type_map in drm_panic_type_get(), resulting in the
crash.
Validate the value of CONFIG_DRM_PANIC_SCREEN at boot time via the
return value of drm_panic_type_set() in drm_panic_init() and explicitly
fall back to the default of "user" with a message to the user so that
they can adjust their configuration or fix missing dependencies.
[ 0.800697] Unsupported value for CONFIG_DRM_PANIC_SCREEN ('qr_code'),
falling back to 'user'...
Fixes: e85e9ccf3f84 ("drm/panic: Report invalid or unsupported panic modes")
Signed-off-by: Nathan Chancellor <[email protected]>
---
drivers/gpu/drm/drm_panic.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/drm_panic.c b/drivers/gpu/drm/drm_panic.c
index eb7ef17b9c71..0cd574dd9d88 100644
--- a/drivers/gpu/drm/drm_panic.c
+++ b/drivers/gpu/drm/drm_panic.c
@@ -1072,8 +1072,11 @@ void drm_panic_unregister(struct drm_device *dev)
*/
void __init drm_panic_init(void)
{
- if (drm_panic_type == -1)
- drm_panic_type_set(CONFIG_DRM_PANIC_SCREEN, NULL);
+ if (drm_panic_type == -1 && drm_panic_type_set(CONFIG_DRM_PANIC_SCREEN,
NULL)) {
+ pr_warn("Unsupported value for CONFIG_DRM_PANIC_SCREEN ('%s'),
falling back to 'user'...\n",
+ CONFIG_DRM_PANIC_SCREEN);
+ drm_panic_type = DRM_PANIC_TYPE_USER;
+ }
drm_panic_qr_init();
}
I actually tested bad string on the kernel command line but did not
think to test a bad string in CONFIG_DRM_PANIC_SCREEN. :( And that is
despite the fact I saw that the kconfig is a free-form input so again my
bad. Even worse is, I briefly considered converting kconfig to a
mutually exclusive fixed list but then gave up not wanting to think
about kconfig backward compatibility issues. We should probably tackle
that problem since free form inputs are bad. We have another one in DRM
as well for the fbdev client IIRC.
Reviewed-by: Tvrtko Ursulin <[email protected]>
Regards,
Tvrtko
