Re: [PATCH v5 18/38] drm/vkms: Introduce config for plane color encoding

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Type mismatch and format string vulnerabilities in show_bitfield causing build failures and KCFI panics
--

commit 2751d72859c546f6b3eb551641e51316a31f2b9f
Author: Louis Chauvet <louis.chauvet@bootlin.com>

drm/vkms: Introduce config for plane color encoding

VKMS driver supports all the color encoding on planes, but for testing it
can be useful to only advertise few of them. This new configuration
interface will allow configuring the color encoding per planes.

> diff --git a/drivers/gpu/drm/vkms/vkms_config.c b/drivers/gpu/drm/vkms/vkms_config.c
> index ca3ee3aa2c41f..2fa467f5e17ed 100644
> --- a/drivers/gpu/drm/vkms/vkms_config.c
> +++ b/drivers/gpu/drm/vkms/vkms_config.c
[ ... ]
> @@ -373,6 +395,22 @@ bool vkms_config_is_valid(const struct vkms_config *config)
>  }
>  EXPORT_SYMBOL_IF_KUNIT(vkms_config_is_valid);
>  
> +static void show_bitfield(struct seq_file *m, uint32_t value, const char *callback(unsigned int))
> +{
> +	u32 offset = 0;
> +	bool first = true;
> +
> +	while (value >= BIT(offset) && offset < 32) {
> +		if (value & BIT(offset)) {
> +			if (!first)
> +				seq_puts(m, ",");
> +			seq_printf(m, callback(offset));

[Severity: High]
Does this trigger a format-security build error? 

Passing the result of callback() directly to seq_printf() without a format
string literal can cause format string vulnerabilities and typically breaks
the build under -Werror=format-security.

Should this use seq_printf(m, "%s", callback(offset)) instead?

> +			first = false;
> +		}
> +		offset += 1;
> +	}
> +}
> +
>  static int vkms_config_show(struct seq_file *m, void *data)
>  {
[ ... ]
> @@ -398,6 +436,12 @@ static int vkms_config_show(struct seq_file *m, void *data)
>  			   DRM_ROTATION_FMT_ARGS(vkms_config_plane_get_supported_rotations(plane_cfg)));
>  		seq_printf(m, "\tdefault rotation=" DRM_ROTATION_FMT "\n",
>  			   DRM_ROTATION_FMT_ARGS(vkms_config_plane_get_default_rotation(plane_cfg)));
> +		seq_puts(m, "\tsupported color encoding=");
> +		show_bitfield(m, vkms_config_plane_get_supported_color_encodings(plane_cfg),
> +			      drm_get_color_encoding_name);

[Severity: High]
Can this mismatch cause a KCFI kernel panic and compiler warnings?

The show_bitfield() function expects a callback taking an unsigned int, but
drm_get_color_encoding_name() takes an enum drm_color_encoding. Because C
treats enums and unsigned ints as distinct types for function signatures,
this mismatch triggers a -Wincompatible-pointer-types warning.

If executed on a kernel with Kernel Control-Flow Integrity (KCFI) enabled,
this indirect call mismatch will result in a kernel panic when a user reads
the debugfs endpoint.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260627-vkms-all-config-v5-0-854aa0840926@bootlin.com?part=18