drm/panic: Avoid crash from invalid CONFIG_DRM_PANIC_SCREEN values

[PATCH 1/2] drm/panic: Ensure drm_panic_type is initialized to a valid value

Posted by Nathan Chancellor 1 month ago

If a user has set an invalid CONFIG_DRM_PANIC_SCREEN value (such as
"qr_code" without CONFIG_DRM_PANIC_SCREEN_QR_CODE=y due to missing or
incorrect Rust dependencies), there is a panic when accessing
/sys/module/drm/parameters/panic_screen:

  [   12.218375] BUG: unable to handle page fault for address: 0000000796dd8818
  [   12.219737] #PF: supervisor read access in kernel mode
  ...
  [   12.227167] RIP: 0010:drm_panic_type_get+0x1b/0x30

If drm_panic_type_set() does not find a valid drm_panic_type enumeration
in drm_panic_type_map based on the provided value, it does not change
drm_panic_type from the default -1 value, which is not a valid index for
accessing drm_panic_type_map in drm_panic_type_get(), resulting in the
crash.

Validate the value of CONFIG_DRM_PANIC_SCREEN at boot time via the
return value of drm_panic_type_set() in drm_panic_init() and explicitly
fall back to the default of "user" with a message to the user so that
they can adjust their configuration or fix missing dependencies.

  [    0.800697] Unsupported value for CONFIG_DRM_PANIC_SCREEN ('qr_code'), falling back to 'user'...

Fixes: e85e9ccf3f84 ("drm/panic: Report invalid or unsupported panic modes")
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
---
 drivers/gpu/drm/drm_panic.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/drm_panic.c b/drivers/gpu/drm/drm_panic.c
index eb7ef17b9c71..0cd574dd9d88 100644
--- a/drivers/gpu/drm/drm_panic.c
+++ b/drivers/gpu/drm/drm_panic.c
@@ -1072,8 +1072,11 @@ void drm_panic_unregister(struct drm_device *dev)
  */
 void __init drm_panic_init(void)
 {
-	if (drm_panic_type == -1)
-		drm_panic_type_set(CONFIG_DRM_PANIC_SCREEN, NULL);
+	if (drm_panic_type == -1 && drm_panic_type_set(CONFIG_DRM_PANIC_SCREEN, NULL)) {
+		pr_warn("Unsupported value for CONFIG_DRM_PANIC_SCREEN ('%s'), falling back to 'user'...\n",
+			CONFIG_DRM_PANIC_SCREEN);
+		drm_panic_type = DRM_PANIC_TYPE_USER;
+	}
 	drm_panic_qr_init();
 }
 

-- 
2.52.0

Re: [PATCH 1/2] drm/panic: Ensure drm_panic_type is initialized to a valid value

Posted by Jocelyn Falempe 1 month ago

On 06/01/2026 07:19, Nathan Chancellor wrote:
> If a user has set an invalid CONFIG_DRM_PANIC_SCREEN value (such as
> "qr_code" without CONFIG_DRM_PANIC_SCREEN_QR_CODE=y due to missing or
> incorrect Rust dependencies), there is a panic when accessing
> /sys/module/drm/parameters/panic_screen:
> 
>    [   12.218375] BUG: unable to handle page fault for address: 0000000796dd8818
>    [   12.219737] #PF: supervisor read access in kernel mode
>    ...
>    [   12.227167] RIP: 0010:drm_panic_type_get+0x1b/0x30
> 
> If drm_panic_type_set() does not find a valid drm_panic_type enumeration
> in drm_panic_type_map based on the provided value, it does not change
> drm_panic_type from the default -1 value, which is not a valid index for
> accessing drm_panic_type_map in drm_panic_type_get(), resulting in the
> crash.
> 
> Validate the value of CONFIG_DRM_PANIC_SCREEN at boot time via the
> return value of drm_panic_type_set() in drm_panic_init() and explicitly
> fall back to the default of "user" with a message to the user so that
> they can adjust their configuration or fix missing dependencies.
> 
>    [    0.800697] Unsupported value for CONFIG_DRM_PANIC_SCREEN ('qr_code'), falling back to 'user'...
> 

Good catch, thanks for the fix.

Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>

> Fixes: e85e9ccf3f84 ("drm/panic: Report invalid or unsupported panic modes")
> Signed-off-by: Nathan Chancellor <nathan@kernel.org>
> ---
>   drivers/gpu/drm/drm_panic.c | 7 +++++--
>   1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/drm_panic.c b/drivers/gpu/drm/drm_panic.c
> index eb7ef17b9c71..0cd574dd9d88 100644
> --- a/drivers/gpu/drm/drm_panic.c
> +++ b/drivers/gpu/drm/drm_panic.c
> @@ -1072,8 +1072,11 @@ void drm_panic_unregister(struct drm_device *dev)
>    */
>   void __init drm_panic_init(void)
>   {
> -	if (drm_panic_type == -1)
> -		drm_panic_type_set(CONFIG_DRM_PANIC_SCREEN, NULL);
> +	if (drm_panic_type == -1 && drm_panic_type_set(CONFIG_DRM_PANIC_SCREEN, NULL)) {
> +		pr_warn("Unsupported value for CONFIG_DRM_PANIC_SCREEN ('%s'), falling back to 'user'...\n",
> +			CONFIG_DRM_PANIC_SCREEN);
> +		drm_panic_type = DRM_PANIC_TYPE_USER;
> +	}
>   	drm_panic_qr_init();
>   }
>   
>

Re: [PATCH 1/2] drm/panic: Ensure drm_panic_type is initialized to a valid value

Posted by Tvrtko Ursulin 1 month ago

On 06/01/2026 06:19, Nathan Chancellor wrote:
> If a user has set an invalid CONFIG_DRM_PANIC_SCREEN value (such as
> "qr_code" without CONFIG_DRM_PANIC_SCREEN_QR_CODE=y due to missing or
> incorrect Rust dependencies), there is a panic when accessing
> /sys/module/drm/parameters/panic_screen:
> 
>    [   12.218375] BUG: unable to handle page fault for address: 0000000796dd8818
>    [   12.219737] #PF: supervisor read access in kernel mode
>    ...
>    [   12.227167] RIP: 0010:drm_panic_type_get+0x1b/0x30
> 
> If drm_panic_type_set() does not find a valid drm_panic_type enumeration
> in drm_panic_type_map based on the provided value, it does not change
> drm_panic_type from the default -1 value, which is not a valid index for
> accessing drm_panic_type_map in drm_panic_type_get(), resulting in the
> crash.
> 
> Validate the value of CONFIG_DRM_PANIC_SCREEN at boot time via the
> return value of drm_panic_type_set() in drm_panic_init() and explicitly
> fall back to the default of "user" with a message to the user so that
> they can adjust their configuration or fix missing dependencies.
> 
>    [    0.800697] Unsupported value for CONFIG_DRM_PANIC_SCREEN ('qr_code'), falling back to 'user'...
> 
> Fixes: e85e9ccf3f84 ("drm/panic: Report invalid or unsupported panic modes")
> Signed-off-by: Nathan Chancellor <nathan@kernel.org>
> ---
>   drivers/gpu/drm/drm_panic.c | 7 +++++--
>   1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/drm_panic.c b/drivers/gpu/drm/drm_panic.c
> index eb7ef17b9c71..0cd574dd9d88 100644
> --- a/drivers/gpu/drm/drm_panic.c
> +++ b/drivers/gpu/drm/drm_panic.c
> @@ -1072,8 +1072,11 @@ void drm_panic_unregister(struct drm_device *dev)
>    */
>   void __init drm_panic_init(void)
>   {
> -	if (drm_panic_type == -1)
> -		drm_panic_type_set(CONFIG_DRM_PANIC_SCREEN, NULL);
> +	if (drm_panic_type == -1 && drm_panic_type_set(CONFIG_DRM_PANIC_SCREEN, NULL)) {
> +		pr_warn("Unsupported value for CONFIG_DRM_PANIC_SCREEN ('%s'), falling back to 'user'...\n",
> +			CONFIG_DRM_PANIC_SCREEN);
> +		drm_panic_type = DRM_PANIC_TYPE_USER;
> +	}
>   	drm_panic_qr_init();
>   }

I actually tested bad string on the kernel command line but did not 
think to test a bad string in CONFIG_DRM_PANIC_SCREEN. :( And that is 
despite the fact I saw that the kconfig is a free-form input so again my 
bad. Even worse is, I briefly considered converting kconfig to a 
mutually exclusive fixed list but then gave up not wanting to think 
about kconfig backward compatibility issues. We should probably tackle 
that problem since free form inputs are bad. We have another one in DRM 
as well for the fbdev client IIRC.

Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>

Regards,

Tvrtko