OK I'll fix it in v3
<[email protected]> 于2026年10月3日周六 09:34写道： > > Thank you for your contribution! Sashiko AI review found 1 potential issue(s) > to consider: > - [Medium] drm/panic: OOB read due to missing null-termination on panic_qr_url > -- > > commit 4020ffafa052ada60c700fa2d64b78e9eb01e839 > Author: 纳西妲 · Nahida <[email protected]> > > drm/panic: allow overriding panic QR code URL > > This patch adds a module parameter to override the DRM panic QR code base URL > at boot or module load time. It exposes a getter function for the DRM panic > helper to retrieve and format the configured URL when generating the QR code. > > > diff --git a/drivers/gpu/drm/drm_panic.c b/drivers/gpu/drm/drm_panic.c > > index 9fe97c4eda6c8..463544f71c537 100644 > > --- a/drivers/gpu/drm/drm_panic.c > > +++ b/drivers/gpu/drm/drm_panic.c > [ ... ] > > @@ -49,6 +49,15 @@ MODULE_LICENSE("GPL"); > > static uint panic_qr_version = CONFIG_DRM_PANIC_SCREEN_QR_VERSION; > > module_param(panic_qr_version, uint, 0644); > > MODULE_PARM_DESC(panic_qr_version, "maximum version (size) of the QR > > code"); > > +static char panic_qr_url[256] = CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL; > > [Severity: Medium] > Will this array be null-terminated if CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL is > exactly 256 bytes or longer? > > In C, initializing a fixed-size character array with a string literal of equal > or greater length does not append a null terminator. > > [ ... ] > > diff --git a/drivers/gpu/drm/drm_panic_helper.c > > b/drivers/gpu/drm/drm_panic_helper.c > > index 8913c3d22e8d3..b0ea0b4e8edef 100644 > > --- a/drivers/gpu/drm/drm_panic_helper.c > > +++ b/drivers/gpu/drm/drm_panic_helper.c > [ ... ] > > @@ -609,17 +609,20 @@ static void drm_panic_helper_qr_exit(void) > > stream.workspace = NULL; > > } > > > > -static int drm_panic_helper_get_qr_code_url(u8 **qr_image, unsigned int > > qr_version) > > +static int drm_panic_helper_get_qr_code_url(u8 **qr_image, unsigned int > > qr_version, > > + const char *qr_url) > > { > > struct kmsg_dump_iter iter; > > - char url[256]; > > + char url[512]; > > size_t kmsg_len, max_kmsg_size; > > char *kmsg; > > int max_qr_data_size, url_len; > > > > url_len = snprintf(url, sizeof(url), "%s?a=%s&v=%s&z=", > > - CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL, > > - utsname()->machine, utsname()->release); > > + qr_url, utsname()->machine, utsname()->release); > > [Severity: Medium] > Could this lead to an out-of-bounds memory read during a kernel panic? > > If qr_url points to a panic_qr_url array that lacks a null terminator, > snprintf() will read past the end of the array until it encounters a null > byte in adjacent memory. This could potentially leak adjacent memory into the > QR code URL or cause a secondary crash that prevents the panic screen from > displaying. > > -- > Sashiko AI review · > https://sashiko.dev/#/patchset/[email protected]?part=1
