[PATCH] drm/rockchip: analogix_dp: bound endpoint name formatting

[PATCH] drm/rockchip: analogix_dp: bound endpoint name formatting

[Yudi Yang]

rockchip_dp_drm_encoder_enable() uses sprintf() to format a device tree
path into a 32-byte stack buffer. Device tree paths are not limited to
this size, so a sufficiently long path can overflow the buffer.

Use snprintf() with the destination size to truncate the generated name
and keep the writes within bounds.

Fixes: 729f8eefdcad ("drm/rockchip: analogix_dp: Add support for RK3588")
Cc: stable@vger.kernel.org
Signed-off-by: Yudi Yang <2000jedi@gmail.com>
---
 drivers/gpu/drm/rockchip/analogix_dp-rockchip.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
index 587e60232ec7..efd5a98e80bd 100644
--- a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
+++ b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
@@ -241,10 +241,11 @@ static void rockchip_dp_drm_encoder_enable(struct drm_encoder *encoder,
 				of_graph_get_remote_port(endpoint.local_node);
 
 			of_property_read_u32(remote_port, "reg", &port_id);
-			sprintf(name, "%s vp%d", remote_port_parent->full_name, port_id);
+			snprintf(name, sizeof(name), "%s vp%d",
+				 remote_port_parent->full_name, port_id);
 		} else {
-			sprintf(name, "%s %s",
-				remote_port_parent->full_name, endpoint.id ? "vopl" : "vopb");
+			snprintf(name, sizeof(name), "%s %s",
+				 remote_port_parent->full_name, endpoint.id ? "vopl" : "vopb");
 		}
 
 		DRM_DEV_DEBUG(dp->dev, "vop %s output to dp\n", (ret) ? "LIT" : "BIG");
-- 
2.43.0

Re: [PATCH] drm/rockchip: analogix_dp: bound endpoint name formatting

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Potential Use-After-Free when accessing `endpoint.local_node` after its reference count has been dropped.
--

commit fc6c7cf47483df3837bf09097a92c40c4a5aed65
Author: Yudi Yang <2000jedi@gmail.com>

drm/rockchip: analogix_dp: bound endpoint name formatting

This commit modifies rockchip_dp_drm_encoder_enable() to use snprintf()
instead of sprintf() when formatting a device tree path into a stack
buffer. This prevents potential buffer overflows from sufficiently long
device tree paths.

> diff --git a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
> index 587e60232ec7c..efd5a98e80bd2 100644
> --- a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
> +++ b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
> @@ -241,10 +241,11 @@ static void rockchip_dp_drm_encoder_enable(struct drm_encoder *encoder,
>  				of_graph_get_remote_port(endpoint.local_node);

[Severity: High]
This isn't a bug introduced by this patch, but does this code use
endpoint.local_node after its reference count has been dropped?

In rockchip_dp_drm_encoder_enable(), drm_of_encoder_active_endpoint() is
called, which internally calls of_graph_parse_endpoint(). This sets
endpoint->local_node without acquiring a reference and then explicitly
drops its reference by calling of_node_put(ep) before returning.

This leaves endpoint.local_node as a dangling pointer, which is then
passed to of_graph_get_remote_port() here (and earlier to
of_graph_get_remote_port_parent()). 

Could this result in a Use-After-Free if the device tree node is dynamically
freed?

>  
>  			of_property_read_u32(remote_port, "reg", &port_id);
> -			sprintf(name, "%s vp%d", remote_port_parent->full_name, port_id);
> +			snprintf(name, sizeof(name), "%s vp%d",
> +				 remote_port_parent->full_name, port_id);
>  		} else {
> -			sprintf(name, "%s %s",
> -				remote_port_parent->full_name, endpoint.id ? "vopl" : "vopb");
> +			snprintf(name, sizeof(name), "%s %s",
> +				 remote_port_parent->full_name, endpoint.id ? "vopl" : "vopb");
>  		}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260901195511.2761251-1-2000jedi@gmail.com?part=1

Re: [PATCH] drm/rockchip: analogix_dp: bound endpoint name formatting

[Heiko Stuebner]

On Tue, 01 Sep 2026 14:55:11 -0500, Yudi Yang wrote:
> rockchip_dp_drm_encoder_enable() uses sprintf() to format a device tree
> path into a 32-byte stack buffer. Device tree paths are not limited to
> this size, so a sufficiently long path can overflow the buffer.
> 
> Use snprintf() with the destination size to truncate the generated name
> and keep the writes within bounds.
> 
> [...]

Applied, thanks!

[1/1] drm/rockchip: analogix_dp: bound endpoint name formatting
      commit: bc69439d983cc491cc86e01fafc1deb94e1bb85e

Best regards,
-- 
Heiko Stuebner <heiko@sntech.de>