Re: [PATCH v5 13/38] drm/vkms: Introduce config for plane name

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] The user-configurable plane name is passed directly as a format string to `drmm_universal_plane_alloc()`, leading to a format string injection vulnerability.
- [Medium] `drm_get_rotation_name` incorrectly expects an array index rather than a rotation bitmask, causing it to return wrong strings for valid rotation masks.
--

commit ecb2a628cbf8a89c520eb57344c9fb30aaf1876c
Author: Louis Chauvet <louis.chauvet@bootlin.com>

drm/vkms: Introduce config for plane name
    
This commit introduces a configuration option for setting a plane's name in
the VKMS driver using ConfigFS.

> diff --git a/drivers/gpu/drm/vkms/vkms_plane.c b/drivers/gpu/drm/vkms/vkms_plane.c
> index 68cb2a3335e64..f351202031244 100644
> --- a/drivers/gpu/drm/vkms/vkms_plane.c
> +++ b/drivers/gpu/drm/vkms/vkms_plane.c
[ ... ]
> @@ -228,7 +229,7 @@ struct vkms_plane *vkms_plane_init(struct vkms_device *vkmsdev,
>  					   &vkms_plane_funcs,
>  					   vkms_formats, ARRAY_SIZE(vkms_formats),
>  					   NULL, vkms_config_plane_get_type(plane_cfg),
> -					   NULL);
> +					   vkms_config_plane_get_name(plane_cfg));

[Severity: High]
Can this cause a format string injection vulnerability?

Since the plane name is user-configurable via ConfigFS, a user could provide a
name containing format specifiers like "plane-%px". When this is passed directly
as the format string argument to drmm_universal_plane_alloc(), it could lead to
out-of-bounds memory reads or a kernel panic. 

Should this be passed as "%s", vkms_config_plane_get_name(plane_cfg) instead?

>  	if (IS_ERR(plane))
>  		return plane;
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260627-vkms-all-config-v5-0-854aa0840926@bootlin.com?part=13