[PATCH] drm/panic: allow overriding panic QR code URL

[PATCH] drm/panic: allow overriding panic QR code URL

[纳西妲 · Nahida]

The base URL used for the panic QR code is currently fixed at build time
by CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL. Changing the panic report
endpoint therefore requires rebuilding the kernel.

Add a drm.panic_qr_url module parameter to allow overriding the URL at
boot or module load time, while keeping the Kconfig value as the
default.

Keep the parameter read-only after initialization so the panic path can
access it without additional synchronization.

Expose the configured URL to the DRM panic helper through an internal
getter so the helper can use the runtime value when generating the QR
code.

Assisted-by: LLM
Signed-off-by: 纳西妲 · Nahida <me@nahida.im>
---
Tested on x86_64:
- Full modular build with DRM=m and DRM_KMS_HELPER=m.
- QEMU/virtio-gpu runtime override with a non-empty Kconfig default URL.
- QEMU/virtio-gpu runtime fallback to the Kconfig default URL.
- QEMU/virtio-gpu runtime override with an empty Kconfig default URL.
- QEMU/virtio-gpu raw kmsg QR fallback with no configured URL.

 drivers/gpu/drm/Kconfig              |  9 +++++----
 drivers/gpu/drm/drm_panic.c          |  9 +++++++++
 drivers/gpu/drm/drm_panic_helper.c   | 12 +++++++-----
 drivers/gpu/drm/drm_panic_internal.h |  4 ++++
 4 files changed, 25 insertions(+), 9 deletions(-)

diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
index 61111d50b..3d9d421f0 100644
--- a/drivers/gpu/drm/Kconfig
+++ b/drivers/gpu/drm/Kconfig
@@ -111,10 +111,11 @@ config DRM_PANIC_SCREEN_QR_CODE_URL
 	string "Base URL of the QR code in the panic screen"
 	depends on DRM_PANIC_SCREEN_QR_CODE
 	help
-	  This option sets the base URL to report the kernel panic. If it's set
-	  the QR code will contain the URL and the kmsg compressed with zlib as
-	  a URL parameter. If it's empty, the QR code will contain the kmsg as
-	  uncompressed text only.
+	  This option sets the default base URL to report the kernel panic. If
+	  it's set the QR code will contain the URL and the kmsg compressed with
+	  zlib as a URL parameter. If it's empty, the QR code will contain the
+	  kmsg as uncompressed text only. It can be overridden with the
+	  drm.panic_qr_url=<url> kernel parameter.
 	  There is a demo code in javascript, to decode and uncompress the kmsg
 	  data from the URL parameter at https://github.com/kdj0c/panic_report
 
diff --git a/drivers/gpu/drm/drm_panic.c b/drivers/gpu/drm/drm_panic.c
index 9fe97c4ed..463544f71 100644
--- a/drivers/gpu/drm/drm_panic.c
+++ b/drivers/gpu/drm/drm_panic.c
@@ -49,6 +49,15 @@ MODULE_LICENSE("GPL");
 static uint panic_qr_version = CONFIG_DRM_PANIC_SCREEN_QR_VERSION;
 module_param(panic_qr_version, uint, 0644);
 MODULE_PARM_DESC(panic_qr_version, "maximum version (size) of the QR code");
+static char panic_qr_url[256] = CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL;
+module_param_string(panic_qr_url, panic_qr_url, sizeof(panic_qr_url), 0444);
+MODULE_PARM_DESC(panic_qr_url, "base URL of the QR code in the panic screen");
+
+const char *drm_panic_get_qr_url(void)
+{
+	return panic_qr_url;
+}
+EXPORT_SYMBOL_GPL(drm_panic_get_qr_url);
 #endif
 
 static enum drm_panic_type drm_panic_type = -1;
diff --git a/drivers/gpu/drm/drm_panic_helper.c b/drivers/gpu/drm/drm_panic_helper.c
index 8913c3d22..f98ffe564 100644
--- a/drivers/gpu/drm/drm_panic_helper.c
+++ b/drivers/gpu/drm/drm_panic_helper.c
@@ -609,7 +609,8 @@ static void drm_panic_helper_qr_exit(void)
 	stream.workspace = NULL;
 }
 
-static int drm_panic_helper_get_qr_code_url(u8 **qr_image, unsigned int qr_version)
+static int drm_panic_helper_get_qr_code_url(u8 **qr_image, unsigned int qr_version,
+					    const char *qr_url)
 {
 	struct kmsg_dump_iter iter;
 	char url[256];
@@ -618,8 +619,7 @@ static int drm_panic_helper_get_qr_code_url(u8 **qr_image, unsigned int qr_versi
 	int max_qr_data_size, url_len;
 
 	url_len = snprintf(url, sizeof(url), "%s?a=%s&v=%s&z=",
-			   CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL,
-			   utsname()->machine, utsname()->release);
+			   qr_url, utsname()->machine, utsname()->release);
 
 	max_qr_data_size = drm_panic_helper_qr_max_data_size(qr_version, url_len);
 	max_kmsg_size = min(MAX_ZLIB_RATIO * max_qr_data_size, QR_BUFFER1_SIZE);
@@ -686,8 +686,10 @@ static int drm_panic_helper_get_qr_code_raw(u8 **qr_image, unsigned int qr_versi
 
 static int drm_panic_helper_get_qr_code(u8 **qr_image, unsigned int qr_version)
 {
-	if (strlen(CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL) > 0)
-		return drm_panic_helper_get_qr_code_url(qr_image, qr_version);
+	const char *qr_url = drm_panic_get_qr_url();
+
+	if (qr_url[0])
+		return drm_panic_helper_get_qr_code_url(qr_image, qr_version, qr_url);
 	else
 		return drm_panic_helper_get_qr_code_raw(qr_image, qr_version);
 }
diff --git a/drivers/gpu/drm/drm_panic_internal.h b/drivers/gpu/drm/drm_panic_internal.h
index fe6d514a0..f33552265 100644
--- a/drivers/gpu/drm/drm_panic_internal.h
+++ b/drivers/gpu/drm/drm_panic_internal.h
@@ -14,6 +14,10 @@ struct drm_device;
 
 #ifdef CONFIG_DRM_PANIC
 
+#if IS_ENABLED(CONFIG_DRM_PANIC_SCREEN_QR_CODE)
+const char *drm_panic_get_qr_url(void);
+#endif
+
 /**
  * drm_panic_lock - protect panic printing relevant state
  * @dev: struct drm_device

base-commit: 54e61ea6c492d69a1717018826d8340810c812eb
-- 
2.55.0

[PATCH v2] drm/panic: allow overriding panic QR code URL

[纳西妲 · Nahida]

The base URL used for the panic QR code is currently fixed at build time
by CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL. Changing the panic report
endpoint therefore requires rebuilding the kernel.

Add a drm.panic_qr_url module parameter to allow overriding the URL at
boot or module load time, while keeping the Kconfig value as the
default.

Keep the parameter read-only after initialization so the panic path can
access it without additional synchronization.

Expose the configured URL to the DRM panic helper through an internal
getter so the helper can use the runtime value when generating the QR
code.

Assisted-by: LLM
Signed-off-by: 纳西妲 · Nahida <me@nahida.im>
---
v2:
- Grow the formatted URL buffer to accommodate the maximum 255-byte
  runtime base URL.
- Reject unexpectedly truncated formatted URLs.
- Test the maximum-length runtime URL.

v1: https://lore.kernel.org/r/20261002203140.121165-1-me@nahida.im

Tested on x86_64:
- Full modular build with DRM=m and DRM_KMS_HELPER=m.
- QEMU/virtio-gpu runtime override with a non-empty Kconfig default URL.
- QEMU/virtio-gpu runtime fallback to the Kconfig default URL.
- QEMU/virtio-gpu runtime override with an empty Kconfig default URL.
- QEMU/virtio-gpu raw kmsg QR fallback with no configured URL.
- QEMU/virtio-gpu runtime override with a 255-byte base URL.

 drivers/gpu/drm/Kconfig              |  9 +++++----
 drivers/gpu/drm/drm_panic.c          |  9 +++++++++
 drivers/gpu/drm/drm_panic_helper.c   | 17 +++++++++++------
 drivers/gpu/drm/drm_panic_internal.h |  4 ++++
 4 files changed, 29 insertions(+), 10 deletions(-)

diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
index 61111d50b..3d9d421f0 100644
--- a/drivers/gpu/drm/Kconfig
+++ b/drivers/gpu/drm/Kconfig
@@ -111,10 +111,11 @@ config DRM_PANIC_SCREEN_QR_CODE_URL
 	string "Base URL of the QR code in the panic screen"
 	depends on DRM_PANIC_SCREEN_QR_CODE
 	help
-	  This option sets the base URL to report the kernel panic. If it's set
-	  the QR code will contain the URL and the kmsg compressed with zlib as
-	  a URL parameter. If it's empty, the QR code will contain the kmsg as
-	  uncompressed text only.
+	  This option sets the default base URL to report the kernel panic. If
+	  it's set the QR code will contain the URL and the kmsg compressed with
+	  zlib as a URL parameter. If it's empty, the QR code will contain the
+	  kmsg as uncompressed text only. It can be overridden with the
+	  drm.panic_qr_url=<url> kernel parameter.
 	  There is a demo code in javascript, to decode and uncompress the kmsg
 	  data from the URL parameter at https://github.com/kdj0c/panic_report
 
diff --git a/drivers/gpu/drm/drm_panic.c b/drivers/gpu/drm/drm_panic.c
index 9fe97c4ed..463544f71 100644
--- a/drivers/gpu/drm/drm_panic.c
+++ b/drivers/gpu/drm/drm_panic.c
@@ -49,6 +49,15 @@ MODULE_LICENSE("GPL");
 static uint panic_qr_version = CONFIG_DRM_PANIC_SCREEN_QR_VERSION;
 module_param(panic_qr_version, uint, 0644);
 MODULE_PARM_DESC(panic_qr_version, "maximum version (size) of the QR code");
+static char panic_qr_url[256] = CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL;
+module_param_string(panic_qr_url, panic_qr_url, sizeof(panic_qr_url), 0444);
+MODULE_PARM_DESC(panic_qr_url, "base URL of the QR code in the panic screen");
+
+const char *drm_panic_get_qr_url(void)
+{
+	return panic_qr_url;
+}
+EXPORT_SYMBOL_GPL(drm_panic_get_qr_url);
 #endif
 
 static enum drm_panic_type drm_panic_type = -1;
diff --git a/drivers/gpu/drm/drm_panic_helper.c b/drivers/gpu/drm/drm_panic_helper.c
index 8913c3d22..b0ea0b4e8 100644
--- a/drivers/gpu/drm/drm_panic_helper.c
+++ b/drivers/gpu/drm/drm_panic_helper.c
@@ -609,17 +609,20 @@ static void drm_panic_helper_qr_exit(void)
 	stream.workspace = NULL;
 }
 
-static int drm_panic_helper_get_qr_code_url(u8 **qr_image, unsigned int qr_version)
+static int drm_panic_helper_get_qr_code_url(u8 **qr_image, unsigned int qr_version,
+					    const char *qr_url)
 {
 	struct kmsg_dump_iter iter;
-	char url[256];
+	char url[512];
 	size_t kmsg_len, max_kmsg_size;
 	char *kmsg;
 	int max_qr_data_size, url_len;
 
 	url_len = snprintf(url, sizeof(url), "%s?a=%s&v=%s&z=",
-			   CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL,
-			   utsname()->machine, utsname()->release);
+			   qr_url, utsname()->machine, utsname()->release);
+
+	if (url_len >= (int)sizeof(url))
+		return -E2BIG;
 
 	max_qr_data_size = drm_panic_helper_qr_max_data_size(qr_version, url_len);
 	max_kmsg_size = min(MAX_ZLIB_RATIO * max_qr_data_size, QR_BUFFER1_SIZE);
@@ -686,8 +689,10 @@ static int drm_panic_helper_get_qr_code_raw(u8 **qr_image, unsigned int qr_versi
 
 static int drm_panic_helper_get_qr_code(u8 **qr_image, unsigned int qr_version)
 {
-	if (strlen(CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL) > 0)
-		return drm_panic_helper_get_qr_code_url(qr_image, qr_version);
+	const char *qr_url = drm_panic_get_qr_url();
+
+	if (qr_url[0])
+		return drm_panic_helper_get_qr_code_url(qr_image, qr_version, qr_url);
 	else
 		return drm_panic_helper_get_qr_code_raw(qr_image, qr_version);
 }
diff --git a/drivers/gpu/drm/drm_panic_internal.h b/drivers/gpu/drm/drm_panic_internal.h
index fe6d514a0..f33552265 100644
--- a/drivers/gpu/drm/drm_panic_internal.h
+++ b/drivers/gpu/drm/drm_panic_internal.h
@@ -14,6 +14,10 @@ struct drm_device;
 
 #ifdef CONFIG_DRM_PANIC
 
+#if IS_ENABLED(CONFIG_DRM_PANIC_SCREEN_QR_CODE)
+const char *drm_panic_get_qr_url(void);
+#endif
+
 /**
  * drm_panic_lock - protect panic printing relevant state
  * @dev: struct drm_device

base-commit: 54e61ea6c492d69a1717018826d8340810c812eb
-- 
2.55.0

Re: [PATCH v2] drm/panic: allow overriding panic QR code URL

[Jocelyn Falempe]

On 10/3/26 00:20, 纳西妲 · Nahida wrote:
> The base URL used for the panic QR code is currently fixed at build time
> by CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL. Changing the panic report
> endpoint therefore requires rebuilding the kernel.
> 
> Add a drm.panic_qr_url module parameter to allow overriding the URL at
> boot or module load time, while keeping the Kconfig value as the
> default.
> 
> Keep the parameter read-only after initialization so the panic path can
> access it without additional synchronization.
> 
> Expose the configured URL to the DRM panic helper through an internal
> getter so the helper can use the runtime value when generating the QR
> code.

The code looks good, but I think it shouldn't be allowed to change this 
setting at boot time.
You can already set the drm_panic screen to "user" or "kmsg" in the 
kernel command line if you don't trust the default URL, or if the URL is 
no more reachable.
It introduces some complexity, and I don't really see the benefit.

Best regards,

-- 

Jocelyn>
> Assisted-by: LLM
> Signed-off-by: 纳西妲 · Nahida <me@nahida.im>
> ---
> v2:
> - Grow the formatted URL buffer to accommodate the maximum 255-byte
>    runtime base URL.
> - Reject unexpectedly truncated formatted URLs.
> - Test the maximum-length runtime URL.
> 
> v1: https://lore.kernel.org/r/20261002203140.121165-1-me@nahida.im
> 
> Tested on x86_64:
> - Full modular build with DRM=m and DRM_KMS_HELPER=m.
> - QEMU/virtio-gpu runtime override with a non-empty Kconfig default URL.
> - QEMU/virtio-gpu runtime fallback to the Kconfig default URL.
> - QEMU/virtio-gpu runtime override with an empty Kconfig default URL.
> - QEMU/virtio-gpu raw kmsg QR fallback with no configured URL.
> - QEMU/virtio-gpu runtime override with a 255-byte base URL.
> 
>   drivers/gpu/drm/Kconfig              |  9 +++++----
>   drivers/gpu/drm/drm_panic.c          |  9 +++++++++
>   drivers/gpu/drm/drm_panic_helper.c   | 17 +++++++++++------
>   drivers/gpu/drm/drm_panic_internal.h |  4 ++++
>   4 files changed, 29 insertions(+), 10 deletions(-)
> 
> diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
> index 61111d50b..3d9d421f0 100644
> --- a/drivers/gpu/drm/Kconfig
> +++ b/drivers/gpu/drm/Kconfig
> @@ -111,10 +111,11 @@ config DRM_PANIC_SCREEN_QR_CODE_URL
>   	string "Base URL of the QR code in the panic screen"
>   	depends on DRM_PANIC_SCREEN_QR_CODE
>   	help
> -	  This option sets the base URL to report the kernel panic. If it's set
> -	  the QR code will contain the URL and the kmsg compressed with zlib as
> -	  a URL parameter. If it's empty, the QR code will contain the kmsg as
> -	  uncompressed text only.
> +	  This option sets the default base URL to report the kernel panic. If
> +	  it's set the QR code will contain the URL and the kmsg compressed with
> +	  zlib as a URL parameter. If it's empty, the QR code will contain the
> +	  kmsg as uncompressed text only. It can be overridden with the
> +	  drm.panic_qr_url=<url> kernel parameter.
>   	  There is a demo code in javascript, to decode and uncompress the kmsg
>   	  data from the URL parameter at https://github.com/kdj0c/panic_report
>   
> diff --git a/drivers/gpu/drm/drm_panic.c b/drivers/gpu/drm/drm_panic.c
> index 9fe97c4ed..463544f71 100644
> --- a/drivers/gpu/drm/drm_panic.c
> +++ b/drivers/gpu/drm/drm_panic.c
> @@ -49,6 +49,15 @@ MODULE_LICENSE("GPL");
>   static uint panic_qr_version = CONFIG_DRM_PANIC_SCREEN_QR_VERSION;
>   module_param(panic_qr_version, uint, 0644);
>   MODULE_PARM_DESC(panic_qr_version, "maximum version (size) of the QR code");
> +static char panic_qr_url[256] = CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL;
> +module_param_string(panic_qr_url, panic_qr_url, sizeof(panic_qr_url), 0444);
> +MODULE_PARM_DESC(panic_qr_url, "base URL of the QR code in the panic screen");
> +
> +const char *drm_panic_get_qr_url(void)
> +{
> +	return panic_qr_url;
> +}
> +EXPORT_SYMBOL_GPL(drm_panic_get_qr_url);
>   #endif
>   
>   static enum drm_panic_type drm_panic_type = -1;
> diff --git a/drivers/gpu/drm/drm_panic_helper.c b/drivers/gpu/drm/drm_panic_helper.c
> index 8913c3d22..b0ea0b4e8 100644
> --- a/drivers/gpu/drm/drm_panic_helper.c
> +++ b/drivers/gpu/drm/drm_panic_helper.c
> @@ -609,17 +609,20 @@ static void drm_panic_helper_qr_exit(void)
>   	stream.workspace = NULL;
>   }
>   
> -static int drm_panic_helper_get_qr_code_url(u8 **qr_image, unsigned int qr_version)
> +static int drm_panic_helper_get_qr_code_url(u8 **qr_image, unsigned int qr_version,
> +					    const char *qr_url)
>   {
>   	struct kmsg_dump_iter iter;
> -	char url[256];
> +	char url[512];
>   	size_t kmsg_len, max_kmsg_size;
>   	char *kmsg;
>   	int max_qr_data_size, url_len;
>   
>   	url_len = snprintf(url, sizeof(url), "%s?a=%s&v=%s&z=",
> -			   CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL,
> -			   utsname()->machine, utsname()->release);
> +			   qr_url, utsname()->machine, utsname()->release);
> +
> +	if (url_len >= (int)sizeof(url))
> +		return -E2BIG;
>   
>   	max_qr_data_size = drm_panic_helper_qr_max_data_size(qr_version, url_len);
>   	max_kmsg_size = min(MAX_ZLIB_RATIO * max_qr_data_size, QR_BUFFER1_SIZE);
> @@ -686,8 +689,10 @@ static int drm_panic_helper_get_qr_code_raw(u8 **qr_image, unsigned int qr_versi
>   
>   static int drm_panic_helper_get_qr_code(u8 **qr_image, unsigned int qr_version)
>   {
> -	if (strlen(CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL) > 0)
> -		return drm_panic_helper_get_qr_code_url(qr_image, qr_version);
> +	const char *qr_url = drm_panic_get_qr_url();
> +
> +	if (qr_url[0])
> +		return drm_panic_helper_get_qr_code_url(qr_image, qr_version, qr_url);
>   	else
>   		return drm_panic_helper_get_qr_code_raw(qr_image, qr_version);
>   }
> diff --git a/drivers/gpu/drm/drm_panic_internal.h b/drivers/gpu/drm/drm_panic_internal.h
> index fe6d514a0..f33552265 100644
> --- a/drivers/gpu/drm/drm_panic_internal.h
> +++ b/drivers/gpu/drm/drm_panic_internal.h
> @@ -14,6 +14,10 @@ struct drm_device;
>   
>   #ifdef CONFIG_DRM_PANIC
>   
> +#if IS_ENABLED(CONFIG_DRM_PANIC_SCREEN_QR_CODE)
> +const char *drm_panic_get_qr_url(void);
> +#endif
> +
>   /**
>    * drm_panic_lock - protect panic printing relevant state
>    * @dev: struct drm_device
> 
> base-commit: 54e61ea6c492d69a1717018826d8340810c812eb

Re: [PATCH v2] drm/panic: allow overriding panic QR code URL

[Nahida Buer]

Thanks for the review.

My motivation was slightly different from disabling the URL when the
configured endpoint is untrusted or unavailable. I wanted to keep the
URL QR mode while allowing the same kernel image to use a different
reporting endpoint depending on the deployment.

It also allows enabling the compressed URL mode without rebuilding the
kernel. With an empty CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL, the QR code
contains the raw kmsg. Supplying drm.panic_qr_url= at boot instead
switches it to the URL format, where the kmsg is compressed with zlib.

This could be useful for a distribution or a locally built kernel image
used on multiple systems: the image can keep a neutral/default
configuration, while individual systems can opt into a specific panic
report collector and compressed QR payload at boot time.

panic_screen=user or panic_screen=kmsg only disables the URL QR mode;
it does not provide a way to keep that mode while changing or enabling
the reporting endpoint.

The parameter is read-only after initialization, so it only selects the
endpoint at boot/module load time.

If keeping the URL fixed at build time is intentional policy for DRM
panic, though, I'm fine with dropping the patch.

Jocelyn Falempe <jfalempe@redhat.com> 于2026年10月3日周六 06:56写道：
>
> On 10/3/26 00:20, 纳西妲 · Nahida wrote:
> > The base URL used for the panic QR code is currently fixed at build time
> > by CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL. Changing the panic report
> > endpoint therefore requires rebuilding the kernel.
> >
> > Add a drm.panic_qr_url module parameter to allow overriding the URL at
> > boot or module load time, while keeping the Kconfig value as the
> > default.
> >
> > Keep the parameter read-only after initialization so the panic path can
> > access it without additional synchronization.
> >
> > Expose the configured URL to the DRM panic helper through an internal
> > getter so the helper can use the runtime value when generating the QR
> > code.
>
> The code looks good, but I think it shouldn't be allowed to change this
> setting at boot time.
> You can already set the drm_panic screen to "user" or "kmsg" in the
> kernel command line if you don't trust the default URL, or if the URL is
> no more reachable.
> It introduces some complexity, and I don't really see the benefit.
>
> Best regards,
>
> --
>
> Jocelyn>
> > Assisted-by: LLM
> > Signed-off-by: 纳西妲 · Nahida <me@nahida.im>
> > ---
> > v2:
> > - Grow the formatted URL buffer to accommodate the maximum 255-byte
> >    runtime base URL.
> > - Reject unexpectedly truncated formatted URLs.
> > - Test the maximum-length runtime URL.
> >
> > v1: https://lore.kernel.org/r/20261002203140.121165-1-me@nahida.im
> >
> > Tested on x86_64:
> > - Full modular build with DRM=m and DRM_KMS_HELPER=m.
> > - QEMU/virtio-gpu runtime override with a non-empty Kconfig default URL.
> > - QEMU/virtio-gpu runtime fallback to the Kconfig default URL.
> > - QEMU/virtio-gpu runtime override with an empty Kconfig default URL.
> > - QEMU/virtio-gpu raw kmsg QR fallback with no configured URL.
> > - QEMU/virtio-gpu runtime override with a 255-byte base URL.
> >
> >   drivers/gpu/drm/Kconfig              |  9 +++++----
> >   drivers/gpu/drm/drm_panic.c          |  9 +++++++++
> >   drivers/gpu/drm/drm_panic_helper.c   | 17 +++++++++++------
> >   drivers/gpu/drm/drm_panic_internal.h |  4 ++++
> >   4 files changed, 29 insertions(+), 10 deletions(-)
> >
> > diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
> > index 61111d50b..3d9d421f0 100644
> > --- a/drivers/gpu/drm/Kconfig
> > +++ b/drivers/gpu/drm/Kconfig
> > @@ -111,10 +111,11 @@ config DRM_PANIC_SCREEN_QR_CODE_URL
> >       string "Base URL of the QR code in the panic screen"
> >       depends on DRM_PANIC_SCREEN_QR_CODE
> >       help
> > -       This option sets the base URL to report the kernel panic. If it's set
> > -       the QR code will contain the URL and the kmsg compressed with zlib as
> > -       a URL parameter. If it's empty, the QR code will contain the kmsg as
> > -       uncompressed text only.
> > +       This option sets the default base URL to report the kernel panic. If
> > +       it's set the QR code will contain the URL and the kmsg compressed with
> > +       zlib as a URL parameter. If it's empty, the QR code will contain the
> > +       kmsg as uncompressed text only. It can be overridden with the
> > +       drm.panic_qr_url=<url> kernel parameter.
> >         There is a demo code in javascript, to decode and uncompress the kmsg
> >         data from the URL parameter at https://github.com/kdj0c/panic_report
> >
> > diff --git a/drivers/gpu/drm/drm_panic.c b/drivers/gpu/drm/drm_panic.c
> > index 9fe97c4ed..463544f71 100644
> > --- a/drivers/gpu/drm/drm_panic.c
> > +++ b/drivers/gpu/drm/drm_panic.c
> > @@ -49,6 +49,15 @@ MODULE_LICENSE("GPL");
> >   static uint panic_qr_version = CONFIG_DRM_PANIC_SCREEN_QR_VERSION;
> >   module_param(panic_qr_version, uint, 0644);
> >   MODULE_PARM_DESC(panic_qr_version, "maximum version (size) of the QR code");
> > +static char panic_qr_url[256] = CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL;
> > +module_param_string(panic_qr_url, panic_qr_url, sizeof(panic_qr_url), 0444);
> > +MODULE_PARM_DESC(panic_qr_url, "base URL of the QR code in the panic screen");
> > +
> > +const char *drm_panic_get_qr_url(void)
> > +{
> > +     return panic_qr_url;
> > +}
> > +EXPORT_SYMBOL_GPL(drm_panic_get_qr_url);
> >   #endif
> >
> >   static enum drm_panic_type drm_panic_type = -1;
> > diff --git a/drivers/gpu/drm/drm_panic_helper.c b/drivers/gpu/drm/drm_panic_helper.c
> > index 8913c3d22..b0ea0b4e8 100644
> > --- a/drivers/gpu/drm/drm_panic_helper.c
> > +++ b/drivers/gpu/drm/drm_panic_helper.c
> > @@ -609,17 +609,20 @@ static void drm_panic_helper_qr_exit(void)
> >       stream.workspace = NULL;
> >   }
> >
> > -static int drm_panic_helper_get_qr_code_url(u8 **qr_image, unsigned int qr_version)
> > +static int drm_panic_helper_get_qr_code_url(u8 **qr_image, unsigned int qr_version,
> > +                                         const char *qr_url)
> >   {
> >       struct kmsg_dump_iter iter;
> > -     char url[256];
> > +     char url[512];
> >       size_t kmsg_len, max_kmsg_size;
> >       char *kmsg;
> >       int max_qr_data_size, url_len;
> >
> >       url_len = snprintf(url, sizeof(url), "%s?a=%s&v=%s&z=",
> > -                        CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL,
> > -                        utsname()->machine, utsname()->release);
> > +                        qr_url, utsname()->machine, utsname()->release);
> > +
> > +     if (url_len >= (int)sizeof(url))
> > +             return -E2BIG;
> >
> >       max_qr_data_size = drm_panic_helper_qr_max_data_size(qr_version, url_len);
> >       max_kmsg_size = min(MAX_ZLIB_RATIO * max_qr_data_size, QR_BUFFER1_SIZE);
> > @@ -686,8 +689,10 @@ static int drm_panic_helper_get_qr_code_raw(u8 **qr_image, unsigned int qr_versi
> >
> >   static int drm_panic_helper_get_qr_code(u8 **qr_image, unsigned int qr_version)
> >   {
> > -     if (strlen(CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL) > 0)
> > -             return drm_panic_helper_get_qr_code_url(qr_image, qr_version);
> > +     const char *qr_url = drm_panic_get_qr_url();
> > +
> > +     if (qr_url[0])
> > +             return drm_panic_helper_get_qr_code_url(qr_image, qr_version, qr_url);
> >       else
> >               return drm_panic_helper_get_qr_code_raw(qr_image, qr_version);
> >   }
> > diff --git a/drivers/gpu/drm/drm_panic_internal.h b/drivers/gpu/drm/drm_panic_internal.h
> > index fe6d514a0..f33552265 100644
> > --- a/drivers/gpu/drm/drm_panic_internal.h
> > +++ b/drivers/gpu/drm/drm_panic_internal.h
> > @@ -14,6 +14,10 @@ struct drm_device;
> >
> >   #ifdef CONFIG_DRM_PANIC
> >
> > +#if IS_ENABLED(CONFIG_DRM_PANIC_SCREEN_QR_CODE)
> > +const char *drm_panic_get_qr_url(void);
> > +#endif
> > +
> >   /**
> >    * drm_panic_lock - protect panic printing relevant state
> >    * @dev: struct drm_device
> >
> > base-commit: 54e61ea6c492d69a1717018826d8340810c812eb
>

Re: [PATCH v2] drm/panic: allow overriding panic QR code URL

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] drm/panic: OOB read due to missing null-termination on panic_qr_url
--

commit 4020ffafa052ada60c700fa2d64b78e9eb01e839
Author: 纳西妲 · Nahida <me@nahida.im>

drm/panic: allow overriding panic QR code URL

This patch adds a module parameter to override the DRM panic QR code base URL
at boot or module load time. It exposes a getter function for the DRM panic
helper to retrieve and format the configured URL when generating the QR code.

> diff --git a/drivers/gpu/drm/drm_panic.c b/drivers/gpu/drm/drm_panic.c
> index 9fe97c4eda6c8..463544f71c537 100644
> --- a/drivers/gpu/drm/drm_panic.c
> +++ b/drivers/gpu/drm/drm_panic.c
[ ... ]
> @@ -49,6 +49,15 @@ MODULE_LICENSE("GPL");
>  static uint panic_qr_version = CONFIG_DRM_PANIC_SCREEN_QR_VERSION;
>  module_param(panic_qr_version, uint, 0644);
>  MODULE_PARM_DESC(panic_qr_version, "maximum version (size) of the QR code");
> +static char panic_qr_url[256] = CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL;

[Severity: Medium]
Will this array be null-terminated if CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL is
exactly 256 bytes or longer?

In C, initializing a fixed-size character array with a string literal of equal
or greater length does not append a null terminator.

[ ... ]
> diff --git a/drivers/gpu/drm/drm_panic_helper.c b/drivers/gpu/drm/drm_panic_helper.c
> index 8913c3d22e8d3..b0ea0b4e8edef 100644
> --- a/drivers/gpu/drm/drm_panic_helper.c
> +++ b/drivers/gpu/drm/drm_panic_helper.c
[ ... ]
> @@ -609,17 +609,20 @@ static void drm_panic_helper_qr_exit(void)
>  	stream.workspace = NULL;
>  }
>  
> -static int drm_panic_helper_get_qr_code_url(u8 **qr_image, unsigned int qr_version)
> +static int drm_panic_helper_get_qr_code_url(u8 **qr_image, unsigned int qr_version,
> +					    const char *qr_url)
>  {
>  	struct kmsg_dump_iter iter;
> -	char url[256];
> +	char url[512];
>  	size_t kmsg_len, max_kmsg_size;
>  	char *kmsg;
>  	int max_qr_data_size, url_len;
>  
>  	url_len = snprintf(url, sizeof(url), "%s?a=%s&v=%s&z=",
> -			   CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL,
> -			   utsname()->machine, utsname()->release);
> +			   qr_url, utsname()->machine, utsname()->release);

[Severity: Medium]
Could this lead to an out-of-bounds memory read during a kernel panic?

If qr_url points to a panic_qr_url array that lacks a null terminator,
snprintf() will read past the end of the array until it encounters a null
byte in adjacent memory. This could potentially leak adjacent memory into the
QR code URL or cause a secondary crash that prevents the panic screen from
displaying.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261002222021.149450-1-me@nahida.im?part=1

Re: [PATCH v2] drm/panic: allow overriding panic QR code URL

[纳西妲 · Nahida]

OK I'll fix it in v3

<sashiko-bot@kernel.org> 于2026年10月3日周六 09:34写道：
>
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] drm/panic: OOB read due to missing null-termination on panic_qr_url
> --
>
> commit 4020ffafa052ada60c700fa2d64b78e9eb01e839
> Author: 纳西妲 · Nahida <me@nahida.im>
>
> drm/panic: allow overriding panic QR code URL
>
> This patch adds a module parameter to override the DRM panic QR code base URL
> at boot or module load time. It exposes a getter function for the DRM panic
> helper to retrieve and format the configured URL when generating the QR code.
>
> > diff --git a/drivers/gpu/drm/drm_panic.c b/drivers/gpu/drm/drm_panic.c
> > index 9fe97c4eda6c8..463544f71c537 100644
> > --- a/drivers/gpu/drm/drm_panic.c
> > +++ b/drivers/gpu/drm/drm_panic.c
> [ ... ]
> > @@ -49,6 +49,15 @@ MODULE_LICENSE("GPL");
> >  static uint panic_qr_version = CONFIG_DRM_PANIC_SCREEN_QR_VERSION;
> >  module_param(panic_qr_version, uint, 0644);
> >  MODULE_PARM_DESC(panic_qr_version, "maximum version (size) of the QR code");
> > +static char panic_qr_url[256] = CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL;
>
> [Severity: Medium]
> Will this array be null-terminated if CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL is
> exactly 256 bytes or longer?
>
> In C, initializing a fixed-size character array with a string literal of equal
> or greater length does not append a null terminator.
>
> [ ... ]
> > diff --git a/drivers/gpu/drm/drm_panic_helper.c b/drivers/gpu/drm/drm_panic_helper.c
> > index 8913c3d22e8d3..b0ea0b4e8edef 100644
> > --- a/drivers/gpu/drm/drm_panic_helper.c
> > +++ b/drivers/gpu/drm/drm_panic_helper.c
> [ ... ]
> > @@ -609,17 +609,20 @@ static void drm_panic_helper_qr_exit(void)
> >       stream.workspace = NULL;
> >  }
> >
> > -static int drm_panic_helper_get_qr_code_url(u8 **qr_image, unsigned int qr_version)
> > +static int drm_panic_helper_get_qr_code_url(u8 **qr_image, unsigned int qr_version,
> > +                                         const char *qr_url)
> >  {
> >       struct kmsg_dump_iter iter;
> > -     char url[256];
> > +     char url[512];
> >       size_t kmsg_len, max_kmsg_size;
> >       char *kmsg;
> >       int max_qr_data_size, url_len;
> >
> >       url_len = snprintf(url, sizeof(url), "%s?a=%s&v=%s&z=",
> > -                        CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL,
> > -                        utsname()->machine, utsname()->release);
> > +                        qr_url, utsname()->machine, utsname()->release);
>
> [Severity: Medium]
> Could this lead to an out-of-bounds memory read during a kernel panic?
>
> If qr_url points to a panic_qr_url array that lacks a null terminator,
> snprintf() will read past the end of the array until it encounters a null
> byte in adjacent memory. This could potentially leak adjacent memory into the
> QR code URL or cause a secondary crash that prevents the panic screen from
> displaying.
>
> --
> Sashiko AI review · https://sashiko.dev/#/patchset/20261002222021.149450-1-me@nahida.im?part=1

Re: [PATCH v2] drm/panic: allow overriding panic QR code URL

[Jocelyn Falempe]

On 10/3/26 01:03, Nahida Buer wrote:
> Thanks for the review.
> 
> My motivation was slightly different from disabling the URL when the
> configured endpoint is untrusted or unavailable. I wanted to keep the
> URL QR mode while allowing the same kernel image to use a different
> reporting endpoint depending on the deployment.
> 
> It also allows enabling the compressed URL mode without rebuilding the
> kernel. With an empty CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL, the QR code
> contains the raw kmsg. Supplying drm.panic_qr_url= at boot instead
> switches it to the URL format, where the kmsg is compressed with zlib.
> 
> This could be useful for a distribution or a locally built kernel image
> used on multiple systems: the image can keep a neutral/default
> configuration, while individual systems can opt into a specific panic
> report collector and compressed QR payload at boot time.
> 
> panic_screen=user or panic_screen=kmsg only disables the URL QR mode;
> it does not provide a way to keep that mode while changing or enabling
> the reporting endpoint.
> 
> The parameter is read-only after initialization, so it only selects the
> endpoint at boot/module load time.
> 
> If keeping the URL fixed at build time is intentional policy for DRM
> panic, though, I'm fine with dropping the patch.

After thinking more about this, I prefer to keep the URL fixed at build 
time.
I hope it won't refrain you from contributing again.

Best regards,

-- 

Jocelyn
> 
> Jocelyn Falempe <jfalempe@redhat.com> 于2026年10月3日周六 06:56写道：
>>
>> On 10/3/26 00:20, 纳西妲 · Nahida wrote:
>>> The base URL used for the panic QR code is currently fixed at build time
>>> by CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL. Changing the panic report
>>> endpoint therefore requires rebuilding the kernel.
>>>
>>> Add a drm.panic_qr_url module parameter to allow overriding the URL at
>>> boot or module load time, while keeping the Kconfig value as the
>>> default.
>>>
>>> Keep the parameter read-only after initialization so the panic path can
>>> access it without additional synchronization.
>>>
>>> Expose the configured URL to the DRM panic helper through an internal
>>> getter so the helper can use the runtime value when generating the QR
>>> code.
>>
>> The code looks good, but I think it shouldn't be allowed to change this
>> setting at boot time.
>> You can already set the drm_panic screen to "user" or "kmsg" in the
>> kernel command line if you don't trust the default URL, or if the URL is
>> no more reachable.
>> It introduces some complexity, and I don't really see the benefit.
>>
>> Best regards,
>>
>> --
>>
>> Jocelyn>
>>> Assisted-by: LLM
>>> Signed-off-by: 纳西妲 · Nahida <me@nahida.im>
>>> ---
>>> v2:
>>> - Grow the formatted URL buffer to accommodate the maximum 255-byte
>>>     runtime base URL.
>>> - Reject unexpectedly truncated formatted URLs.
>>> - Test the maximum-length runtime URL.
>>>
>>> v1: https://lore.kernel.org/r/20261002203140.121165-1-me@nahida.im
>>>
>>> Tested on x86_64:
>>> - Full modular build with DRM=m and DRM_KMS_HELPER=m.
>>> - QEMU/virtio-gpu runtime override with a non-empty Kconfig default URL.
>>> - QEMU/virtio-gpu runtime fallback to the Kconfig default URL.
>>> - QEMU/virtio-gpu runtime override with an empty Kconfig default URL.
>>> - QEMU/virtio-gpu raw kmsg QR fallback with no configured URL.
>>> - QEMU/virtio-gpu runtime override with a 255-byte base URL.
>>>
>>>    drivers/gpu/drm/Kconfig              |  9 +++++----
>>>    drivers/gpu/drm/drm_panic.c          |  9 +++++++++
>>>    drivers/gpu/drm/drm_panic_helper.c   | 17 +++++++++++------
>>>    drivers/gpu/drm/drm_panic_internal.h |  4 ++++
>>>    4 files changed, 29 insertions(+), 10 deletions(-)
>>>
>>> diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
>>> index 61111d50b..3d9d421f0 100644
>>> --- a/drivers/gpu/drm/Kconfig
>>> +++ b/drivers/gpu/drm/Kconfig
>>> @@ -111,10 +111,11 @@ config DRM_PANIC_SCREEN_QR_CODE_URL
>>>        string "Base URL of the QR code in the panic screen"
>>>        depends on DRM_PANIC_SCREEN_QR_CODE
>>>        help
>>> -       This option sets the base URL to report the kernel panic. If it's set
>>> -       the QR code will contain the URL and the kmsg compressed with zlib as
>>> -       a URL parameter. If it's empty, the QR code will contain the kmsg as
>>> -       uncompressed text only.
>>> +       This option sets the default base URL to report the kernel panic. If
>>> +       it's set the QR code will contain the URL and the kmsg compressed with
>>> +       zlib as a URL parameter. If it's empty, the QR code will contain the
>>> +       kmsg as uncompressed text only. It can be overridden with the
>>> +       drm.panic_qr_url=<url> kernel parameter.
>>>          There is a demo code in javascript, to decode and uncompress the kmsg
>>>          data from the URL parameter at https://github.com/kdj0c/panic_report
>>>
>>> diff --git a/drivers/gpu/drm/drm_panic.c b/drivers/gpu/drm/drm_panic.c
>>> index 9fe97c4ed..463544f71 100644
>>> --- a/drivers/gpu/drm/drm_panic.c
>>> +++ b/drivers/gpu/drm/drm_panic.c
>>> @@ -49,6 +49,15 @@ MODULE_LICENSE("GPL");
>>>    static uint panic_qr_version = CONFIG_DRM_PANIC_SCREEN_QR_VERSION;
>>>    module_param(panic_qr_version, uint, 0644);
>>>    MODULE_PARM_DESC(panic_qr_version, "maximum version (size) of the QR code");
>>> +static char panic_qr_url[256] = CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL;
>>> +module_param_string(panic_qr_url, panic_qr_url, sizeof(panic_qr_url), 0444);
>>> +MODULE_PARM_DESC(panic_qr_url, "base URL of the QR code in the panic screen");
>>> +
>>> +const char *drm_panic_get_qr_url(void)
>>> +{
>>> +     return panic_qr_url;
>>> +}
>>> +EXPORT_SYMBOL_GPL(drm_panic_get_qr_url);
>>>    #endif
>>>
>>>    static enum drm_panic_type drm_panic_type = -1;
>>> diff --git a/drivers/gpu/drm/drm_panic_helper.c b/drivers/gpu/drm/drm_panic_helper.c
>>> index 8913c3d22..b0ea0b4e8 100644
>>> --- a/drivers/gpu/drm/drm_panic_helper.c
>>> +++ b/drivers/gpu/drm/drm_panic_helper.c
>>> @@ -609,17 +609,20 @@ static void drm_panic_helper_qr_exit(void)
>>>        stream.workspace = NULL;
>>>    }
>>>
>>> -static int drm_panic_helper_get_qr_code_url(u8 **qr_image, unsigned int qr_version)
>>> +static int drm_panic_helper_get_qr_code_url(u8 **qr_image, unsigned int qr_version,
>>> +                                         const char *qr_url)
>>>    {
>>>        struct kmsg_dump_iter iter;
>>> -     char url[256];
>>> +     char url[512];
>>>        size_t kmsg_len, max_kmsg_size;
>>>        char *kmsg;
>>>        int max_qr_data_size, url_len;
>>>
>>>        url_len = snprintf(url, sizeof(url), "%s?a=%s&v=%s&z=",
>>> -                        CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL,
>>> -                        utsname()->machine, utsname()->release);
>>> +                        qr_url, utsname()->machine, utsname()->release);
>>> +
>>> +     if (url_len >= (int)sizeof(url))
>>> +             return -E2BIG;
>>>
>>>        max_qr_data_size = drm_panic_helper_qr_max_data_size(qr_version, url_len);
>>>        max_kmsg_size = min(MAX_ZLIB_RATIO * max_qr_data_size, QR_BUFFER1_SIZE);
>>> @@ -686,8 +689,10 @@ static int drm_panic_helper_get_qr_code_raw(u8 **qr_image, unsigned int qr_versi
>>>
>>>    static int drm_panic_helper_get_qr_code(u8 **qr_image, unsigned int qr_version)
>>>    {
>>> -     if (strlen(CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL) > 0)
>>> -             return drm_panic_helper_get_qr_code_url(qr_image, qr_version);
>>> +     const char *qr_url = drm_panic_get_qr_url();
>>> +
>>> +     if (qr_url[0])
>>> +             return drm_panic_helper_get_qr_code_url(qr_image, qr_version, qr_url);
>>>        else
>>>                return drm_panic_helper_get_qr_code_raw(qr_image, qr_version);
>>>    }
>>> diff --git a/drivers/gpu/drm/drm_panic_internal.h b/drivers/gpu/drm/drm_panic_internal.h
>>> index fe6d514a0..f33552265 100644
>>> --- a/drivers/gpu/drm/drm_panic_internal.h
>>> +++ b/drivers/gpu/drm/drm_panic_internal.h
>>> @@ -14,6 +14,10 @@ struct drm_device;
>>>
>>>    #ifdef CONFIG_DRM_PANIC
>>>
>>> +#if IS_ENABLED(CONFIG_DRM_PANIC_SCREEN_QR_CODE)
>>> +const char *drm_panic_get_qr_url(void);
>>> +#endif
>>> +
>>>    /**
>>>     * drm_panic_lock - protect panic printing relevant state
>>>     * @dev: struct drm_device
>>>
>>> base-commit: 54e61ea6c492d69a1717018826d8340810c812eb
>>
>