FAILED: patch "[PATCH] drm/panic: Do not use un-escaped URL as format string" failed to apply to 6.12-stable tree

FAILED: patch "[PATCH] drm/panic: Do not use un-escaped URL as format string" failed to apply to 6.12-stable tree

[Sasha Levin]

The patch below does not apply to the 6.12-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.12.y
git checkout FETCH_HEAD
git cherry-pick -x 6596aae25585b183ebd528206bde6f12efaf8db1
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '20261107051705-failed-6.12-6596aae25585@kernel.org' --subject-prefix 'PATCH 6.12.y' 'HEAD^..'

Thanks,
Sasha

------------------ original commit in Linus's tree ------------------

From 6596aae25585b183ebd528206bde6f12efaf8db1 Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <tzimmermann@suse.de>
Date: Fri, 11 Sep 2026 14:43:54 +0200
Subject: [PATCH] drm/panic: Do not use un-escaped URL as format string

Replace the direct use of DRM_PANIC_SCREEN_QR_CODE_URL in snprintf()
with a %s conversion specifier. Avoids a possible vulnerabilty from
a crafted URL string.

As the attacker needs to control the kernel at the Kconfig level, the
potential for an exploit is likely low.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>
Fixes: cb5164ac43d0 ("drm/panic: Add a QR code panic screen")
Cc: Javier Martinez Canillas <javierm@redhat.com>
Cc: Jocelyn Falempe <jfalempe@redhat.com>
Cc: dri-devel@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v6.12+
Link: https://patch.msgid.link/20260911124540.279841-2-tzimmermann@suse.de
---
 drivers/gpu/drm/drm_panic.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/drm_panic.c b/drivers/gpu/drm/drm_panic.c
index e576c4791861d..ba21df4be3380 100644
--- a/drivers/gpu/drm/drm_panic.c
+++ b/drivers/gpu/drm/drm_panic.c
@@ -658,7 +658,8 @@ static int drm_panic_get_qr_code_url(u8 **qr_image)
 	char *kmsg;
 	int max_qr_data_size, url_len;
 
-	url_len = snprintf(url, sizeof(url), CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL "?a=%s&v=%s&z=",
+	url_len = snprintf(url, sizeof(url), "%s?a=%s&v=%s&z=",
+			   CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL,
 			   utsname()->machine, utsname()->release);
 
 	max_qr_data_size = drm_panic_qr_max_data_size(panic_qr_version, url_len);
-- 
2.53.0

[PATCH 6.12.y] drm/panic: Do not use un-escaped URL as format string

[Sasha Levin]

From: Thomas Zimmermann <tzimmermann@suse.de>

[ Upstream commit 6596aae25585b183ebd528206bde6f12efaf8db1 ]

Replace the direct use of DRM_PANIC_SCREEN_QR_CODE_URL in snprintf()
with a %s conversion specifier. Avoids a possible vulnerabilty from
a crafted URL string.

As the attacker needs to control the kernel at the Kconfig level, the
potential for an exploit is likely low.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>
Fixes: cb5164ac43d0 ("drm/panic: Add a QR code panic screen")
Cc: Javier Martinez Canillas <javierm@redhat.com>
Cc: Jocelyn Falempe <jfalempe@redhat.com>
Cc: dri-devel@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v6.12+
Link: https://patch.msgid.link/20260911124540.279841-2-tzimmermann@suse.de
[ sashal: Retained the zl= URL parameter instead of z= to match the older QR encoding. ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_panic.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/drm_panic.c b/drivers/gpu/drm/drm_panic.c
index 06f0aa1cb4f74..f4662f88e2173 100644
--- a/drivers/gpu/drm/drm_panic.c
+++ b/drivers/gpu/drm/drm_panic.c
@@ -507,7 +507,8 @@ static int drm_panic_get_qr_code_url(u8 **qr_image)
 	char *kmsg;
 	int max_qr_data_size, url_len;
 
-	url_len = snprintf(url, sizeof(url), CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL "?a=%s&v=%s&zl=",
+	url_len = snprintf(url, sizeof(url), "%s?a=%s&v=%s&zl=",
+			   CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL,
 			   utsname()->machine, utsname()->release);
 
 	max_qr_data_size = drm_panic_qr_max_data_size(panic_qr_version, url_len);
-- 
2.53.0

Re: [PATCH 6.12.y] drm/panic: Do not use un-escaped URL as format string

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Critical] drm/panic: data corruption in drm_panic_get_qr_code_url()
  [1]
--

commit 6107444dfad860987491c5c76fe37fcd55bcb9ae
Author: Thomas Zimmermann <tzimmermann@suse.de>

drm/panic: Do not use un-escaped URL as format string

This commit passes CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL via a %s format
specifier in drm_panic_get_qr_code_url() instead of concatenating it
directly into the snprintf() format string.

Link: https://patch.msgid.link/20260911124540.279841-2-tzimmermann@suse.de

> diff --git a/drivers/gpu/drm/drm_panic.c b/drivers/gpu/drm/drm_panic.c
> index 0aa87eafdacd5..7dedf18f9ed0c 100644
> --- a/drivers/gpu/drm/drm_panic.c
> +++ b/drivers/gpu/drm/drm_panic.c
> @@ -502,7 +502,8 @@ static int drm_panic_get_qr_code_url(u8 **qr_image)
>  	char *kmsg;
>  	int max_qr_data_size, url_len;
>  
> -	url_len = snprintf(url, sizeof(url), CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL "?a=%s&v=%s&zl=",
> +	url_len = snprintf(url, sizeof(url), "%s?a=%s&v=%s&zl=",
> +			   CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL,
>  			   utsname()->machine, utsname()->release);
>  
>  	max_qr_data_size = drm_panic_qr_max_data_size(panic_qr_version, url_len);

[Severity: Critical]
This problem wasn't introduced by this patch, but can concurrent debugfs
writes across different DRM devices corrupt the global zlib stream and
buffers in drm_panic_get_qr_code_url() [1]?

draw_panic_plane() only serializes callers per device via
drm_panic_trylock(plane->dev), while drm_panic_get_qr_code_url() and
drm_panic_get_qr_code_raw() operate on shared file-scope globals:

drivers/gpu/drm/drm_panic.c:
static char *qrbuf1;
static char *qrbuf2;
static struct z_stream_s stream;

CPU0                                    CPU1
debugfs_panic_write() (dev A)           debugfs_panic_write() (dev B)
  draw_panic_plane()                      draw_panic_plane()
    drm_panic_trylock(dev A)                drm_panic_trylock(dev B)
    ...                                     ...
      drm_panic_get_qr_code_url()             drm_panic_get_qr_code_url()
        zlib_deflateInit2(&stream, ...)
                                                zlib_deflateInit2(&stream, ...)
        stream.next_in = kmsg;                  stream.next_in = kmsg;
                                                  <-- corrupts shared stream

Concurrent writes to per-plane panic debugfs files on two DRM devices
simultaneously mutate qrbuf1, qrbuf2, and stream, corrupting zlib state
and kernel memory.

[1] https://sashiko.dev/#/bug/linux-093f9782-c6d2-4cc0-b04c-5ef4dea5d6f9

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110055810.483002-1-sashal@kernel.org?part=1