linux-kernel - Re: [PATCH] drm: Fix the length of event_string in drm_dev_wedged

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Z_TCzOg2Q7Aeh-G1@black.fi.intel.com>
Date: Tue, 8 Apr 2025 09:31:40 +0300
From: Raag Jadav <raag.jadav@...el.com>
To: jiangfeng@...inos.cn
Cc: maarten.lankhorst@...ux.intel.com, mripard@...nel.org,
	tzimmermann@...e.de, airlied@...il.com, simona@...ll.ch,
	rodrigo.vivi@...el.com, andrealmeid@...lia.com,
	christian.koenig@....com, dri-devel@...ts.freedesktop.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] drm: Fix the length of event_string in
 drm_dev_wedged_event()

On Tue, Apr 08, 2025 at 09:32:19AM +0800, jiangfeng@...inos.cn wrote:
> From: Feng Jiang <jiangfeng@...inos.cn>
> 
> The format of the event_string value is `WEDGED=<method1>[,..,<methodN>]`,
> so method should be appended after 'WEDGED=' rather than overwriting it.

It's already appending it, the fix is rather for the potential array
overflow. So please update this in commit message.

> Fixes: b7cf9f4ac1b8 ("drm: Introduce device wedged event")
> Signed-off-by: Feng Jiang <jiangfeng@...inos.cn>
> ---
>  drivers/gpu/drm/drm_drv.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
> index 17fc5dc708f4..58babdab9e66 100644
> --- a/drivers/gpu/drm/drm_drv.c
> +++ b/drivers/gpu/drm/drm_drv.c
> @@ -549,7 +549,8 @@ int drm_dev_wedged_event(struct drm_device *dev, unsigned long method)
>  		if (drm_WARN_ONCE(dev, !recovery, "invalid recovery method %u\n", opt))
>  			break;
>  
> -		len += scnprintf(event_string + len, sizeof(event_string), "%s,", recovery);
> +		len += scnprintf(event_string + len,
> +				sizeof(event_string) - len, "%s,", recovery);

Now that we allow 100 characters, you can keep this as a single line.

Raag