Replace the direct use of DRM_PANIC_SCREEN_QR_CODE_URL in snprintf() with a %s conversion specifier. Avoids a possible vulnerabilty from a crafted URL string.
As the attacker needs to control the kernel at the Kconfig level, the potential for an exploit is likely low. Signed-off-by: Thomas Zimmermann <[email protected]> Fixes: cb5164ac43d0 ("drm/panic: Add a QR code panic screen") Cc: Javier Martinez Canillas <[email protected]> Cc: Jocelyn Falempe <[email protected]> Cc: [email protected] Cc: <[email protected]> # v6.12+ --- drivers/gpu/drm/drm_panic.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_panic.c b/drivers/gpu/drm/drm_panic.c index e576c4791861..ba21df4be338 100644 --- a/drivers/gpu/drm/drm_panic.c +++ b/drivers/gpu/drm/drm_panic.c @@ -658,7 +658,8 @@ static int drm_panic_get_qr_code_url(u8 **qr_image) char *kmsg; int max_qr_data_size, url_len; - url_len = snprintf(url, sizeof(url), CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL "?a=%s&v=%s&z=", + url_len = snprintf(url, sizeof(url), "%s?a=%s&v=%s&z=", + CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL, utsname()->machine, utsname()->release); max_qr_data_size = drm_panic_qr_max_data_size(panic_qr_version, url_len); -- 2.55.0
