Re: [PATCH v2] drm/drv: Add buffer bounds check in drm_dev_wedged_event()

[Raag Jadav <raag.jadav@intel.com>]

On Fri, Jul 24, 2026 at 12:00:06PM +0530, Mallesh Koujalagi wrote:
> event_string[] has a fixed size of WEDGE_STR_LEN (32) bytes.
> scnprintf(buf, size, "%s,", recovery) writes strlen(recovery)+1
> content bytes (token + comma) and requires one additional byte
> for the NUL terminator within 'size'.
> 
> Without a bounds check, if the remaining space is insufficient,
> scnprintf() silently truncates the recovery token mid-name,
> producing a malformed uevent payload (e.g. "WEDGED=bus-reset,vendor-spe").
> 
> Add a pre-flight drm_WARN_ON() guard:
> 
>   len + strlen(recovery) + 1 >= WEDGE_STR_LEN
> 
> Fixes: b7cf9f4ac1b8 ("drm: Introduce device wedged event")
> Signed-off-by: Mallesh Koujalagi <mallesh.koujalagi@intel.com>
> ---
> v2:
> - Add proper logic to handle recovery string. (Raag)
> ---
>  drivers/gpu/drm/drm_drv.c | 14 ++++++++++++++
>  1 file changed, 14 insertions(+)
> 
> diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
> index e51ed959da89..e48b22ca38bd 100644
> --- a/drivers/gpu/drm/drm_drv.c
> +++ b/drivers/gpu/drm/drm_drv.c
> @@ -586,6 +586,20 @@ int drm_dev_wedged_event(struct drm_device *dev, unsigned long method,
>  		if (drm_WARN_ONCE(dev, !recovery, "invalid recovery method %u\n", opt))
>  			break;
>  
> +		/*
> +		 * scnprintf(buf, size, "%s,", recovery) writes strlen(recovery)+1
> +		 * content bytes (token + comma) and reserves 1 byte for NUL within
> +		 * 'size'.  It fits without truncation when:
> +		 *   len + strlen(recovery) + 1 <= WEDGE_STR_LEN - 1  (safe)
> +		 * so warn and bail when:
> +		 *   len + strlen(recovery) + 1 >= WEDGE_STR_LEN       (would truncate)
> +		 * Note: ">= WEDGE_STR_LEN - 1" would be off-by-one — it would
> +		 * incorrectly reject the exact-fit case where NUL lands on the last
> +		 * valid byte (index WEDGE_STR_LEN - 1).

This looks a bit verbose, can we shorten it up a bit?

> +		 */
> +		if (drm_WARN_ON(dev, len + strlen(recovery) + 1 >= WEDGE_STR_LEN))

I'd use drm_WARN_ON_ONCE() and avoid spamming logs.

Raag

> +			break;
> +
>  		len += scnprintf(event_string + len, sizeof(event_string) - len, "%s,", recovery);
>  	}
>  
> -- 
> 2.48.1
>