1. Patchew
  2. linux
  3. View series

[PATCH] drm/gud: NUL-terminate TV mode names read from the device

Deepanshu Kartikey posted 1 patch 1 month, 1 week ago 
drivers/gpu/drm/gud/gud_connector.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
[PATCH] drm/gud: NUL-terminate TV mode names read from the device
Posted by Deepanshu Kartikey 1 month, 1 week ago 
gud_connector_add_tv_mode() reads a buffer of fixed-size mode names from
the USB device and passes pointers into it to
drm_mode_create_tv_properties_legacy(), which calls strlen() on each one.
Nothing guarantees the device NUL-terminates a name, so strlen() can run
past the end of a slot and, for the last mode, past the end of the
allocation.

Terminate each name at the end of its slot before use.

Fixes: 40e1a70b4aed ("drm: Add GUD USB Display driver")
Reported-by: syzbot+916c888ba5f1a54c9526@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=916c888ba5f1a54c9526
Tested-by: syzbot+916c888ba5f1a54c9526@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 drivers/gpu/drm/gud/gud_connector.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/gud/gud_connector.c b/drivers/gpu/drm/gud/gud_connector.c
index ea0cca58b7c8..5c0065c876a7 100644
--- a/drivers/gpu/drm/gud/gud_connector.c
+++ b/drivers/gpu/drm/gud/gud_connector.c
@@ -396,8 +396,13 @@ static int gud_connector_add_tv_mode(struct gud_device *gdrm, struct drm_connect
 	}
 
 	num_modes = ret / GUD_CONNECTOR_TV_MODE_NAME_LEN;
-	for (i = 0; i < num_modes; i++)
-		modes[i] = &buf[i * GUD_CONNECTOR_TV_MODE_NAME_LEN];
+	for (i = 0; i < num_modes; i++) {
+		char *mode = &buf[i * GUD_CONNECTOR_TV_MODE_NAME_LEN];
+
+		/* The device is not trusted to NUL-terminate the name */
+		mode[GUD_CONNECTOR_TV_MODE_NAME_LEN - 1] = '\0';
+		modes[i] = mode;
+	}
 
 	ret = drm_mode_create_tv_properties_legacy(connector->dev, num_modes, modes);
 free:
-- 
2.43.0
Re: [PATCH] drm/gud: NUL-terminate TV mode names read from the device
Posted by Ruben Wauters 1 month, 1 week ago 
On Sun, 2026-08-16 at 14:22 +0530, Deepanshu Kartikey wrote:
> gud_connector_add_tv_mode() reads a buffer of fixed-size mode names from
> the USB device and passes pointers into it to
> drm_mode_create_tv_properties_legacy(), which calls strlen() on each one.
> Nothing guarantees the device NUL-terminates a name, so strlen() can run
> past the end of a slot and, for the last mode, past the end of the
> allocation.
> 
> Terminate each name at the end of its slot before use.
> 
> Fixes: 40e1a70b4aed ("drm: Add GUD USB Display driver")
> Reported-by: syzbot+916c888ba5f1a54c9526@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=916c888ba5f1a54c9526
> Tested-by: syzbot+916c888ba5f1a54c9526@syzkaller.appspotmail.com
> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
Acked-by: Ruben Wauters <rubenru09@aol.com>
> ---
>  drivers/gpu/drm/gud/gud_connector.c | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/gud/gud_connector.c b/drivers/gpu/drm/gud/gud_connector.c
> index ea0cca58b7c8..5c0065c876a7 100644
> --- a/drivers/gpu/drm/gud/gud_connector.c
> +++ b/drivers/gpu/drm/gud/gud_connector.c
> @@ -396,8 +396,13 @@ static int gud_connector_add_tv_mode(struct gud_device *gdrm, struct drm_connect
>  	}
>  
>  	num_modes = ret / GUD_CONNECTOR_TV_MODE_NAME_LEN;
> -	for (i = 0; i < num_modes; i++)
> -		modes[i] = &buf[i * GUD_CONNECTOR_TV_MODE_NAME_LEN];
> +	for (i = 0; i < num_modes; i++) {
> +		char *mode = &buf[i * GUD_CONNECTOR_TV_MODE_NAME_LEN];
> +
> +		/* The device is not trusted to NUL-terminate the name */
> +		mode[GUD_CONNECTOR_TV_MODE_NAME_LEN - 1] = '\0';
> +		modes[i] = mode;
> +	}
>  
>  	ret = drm_mode_create_tv_properties_legacy(connector->dev, num_modes, modes);
>  free:
Re: [PATCH] drm/gud: NUL-terminate TV mode names read from the device
Posted by Ruben Wauters 1 month ago 
On Mon, 2026-08-17 at 16:36 +0100, Ruben Wauters wrote:
> On Sun, 2026-08-16 at 14:22 +0530, Deepanshu Kartikey wrote:
> > gud_connector_add_tv_mode() reads a buffer of fixed-size mode names from
> > the USB device and passes pointers into it to
> > drm_mode_create_tv_properties_legacy(), which calls strlen() on each one.
> > Nothing guarantees the device NUL-terminates a name, so strlen() can run
> > past the end of a slot and, for the last mode, past the end of the
> > allocation.
> > 
> > Terminate each name at the end of its slot before use.
> > 
> > Fixes: 40e1a70b4aed ("drm: Add GUD USB Display driver")
> > Reported-by: syzbot+916c888ba5f1a54c9526@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=916c888ba5f1a54c9526
> > Tested-by: syzbot+916c888ba5f1a54c9526@syzkaller.appspotmail.com
> > Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> Acked-by: Ruben Wauters <rubenru09@aol.com>

Thank you, applied to drm-misc-fixes, Cc'd stable

Ruben
> > ---
> >  drivers/gpu/drm/gud/gud_connector.c | 9 +++++++--
> >  1 file changed, 7 insertions(+), 2 deletions(-)
> > 
> > diff --git a/drivers/gpu/drm/gud/gud_connector.c b/drivers/gpu/drm/gud/gud_connector.c
> > index ea0cca58b7c8..5c0065c876a7 100644
> > --- a/drivers/gpu/drm/gud/gud_connector.c
> > +++ b/drivers/gpu/drm/gud/gud_connector.c
> > @@ -396,8 +396,13 @@ static int gud_connector_add_tv_mode(struct gud_device *gdrm, struct drm_connect
> >  	}
> >  
> >  	num_modes = ret / GUD_CONNECTOR_TV_MODE_NAME_LEN;
> > -	for (i = 0; i < num_modes; i++)
> > -		modes[i] = &buf[i * GUD_CONNECTOR_TV_MODE_NAME_LEN];
> > +	for (i = 0; i < num_modes; i++) {
> > +		char *mode = &buf[i * GUD_CONNECTOR_TV_MODE_NAME_LEN];
> > +
> > +		/* The device is not trusted to NUL-terminate the name */
> > +		mode[GUD_CONNECTOR_TV_MODE_NAME_LEN - 1] = '\0';
> > +		modes[i] = mode;
> > +	}
> >  
> >  	ret = drm_mode_create_tv_properties_legacy(connector->dev, num_modes, modes);
> >  free:
Re: [PATCH] drm/gud: NUL-terminate TV mode names read from the device
Posted by Ruben Wauters 1 month ago 
On Sun, 2026-08-23 at 16:41 +0100, Ruben Wauters wrote:
> On Mon, 2026-08-17 at 16:36 +0100, Ruben Wauters wrote:
> > On Sun, 2026-08-16 at 14:22 +0530, Deepanshu Kartikey wrote:
> > > gud_connector_add_tv_mode() reads a buffer of fixed-size mode names from
> > > the USB device and passes pointers into it to
> > > drm_mode_create_tv_properties_legacy(), which calls strlen() on each one.
> > > Nothing guarantees the device NUL-terminates a name, so strlen() can run
> > > past the end of a slot and, for the last mode, past the end of the
> > > allocation.
> > > 
> > > Terminate each name at the end of its slot before use.
> > > 
> > > Fixes: 40e1a70b4aed ("drm: Add GUD USB Display driver")
> > > Reported-by: syzbot+916c888ba5f1a54c9526@syzkaller.appspotmail.com
> > > Closes: https://syzkaller.appspot.com/bug?extid=916c888ba5f1a54c9526
> > > Tested-by: syzbot+916c888ba5f1a54c9526@syzkaller.appspotmail.com
> > > Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> > Acked-by: Ruben Wauters <rubenru09@aol.com>
> 
> Thank you, applied to drm-misc-fixes, Cc'd stable

Hello, my apologies, upon checking other patches received, I found a
better implementation that returns an error and avoids truncating, as
such that one will be applied over this one instead, apologies for any
confusion.

Ruben
> 
> Ruben
> > > ---
> > >  drivers/gpu/drm/gud/gud_connector.c | 9 +++++++--
> > >  1 file changed, 7 insertions(+), 2 deletions(-)
> > > 
> > > diff --git a/drivers/gpu/drm/gud/gud_connector.c b/drivers/gpu/drm/gud/gud_connector.c
> > > index ea0cca58b7c8..5c0065c876a7 100644
> > > --- a/drivers/gpu/drm/gud/gud_connector.c
> > > +++ b/drivers/gpu/drm/gud/gud_connector.c
> > > @@ -396,8 +396,13 @@ static int gud_connector_add_tv_mode(struct gud_device *gdrm, struct drm_connect
> > >  	}
> > >  
> > >  	num_modes = ret / GUD_CONNECTOR_TV_MODE_NAME_LEN;
> > > -	for (i = 0; i < num_modes; i++)
> > > -		modes[i] = &buf[i * GUD_CONNECTOR_TV_MODE_NAME_LEN];
> > > +	for (i = 0; i < num_modes; i++) {
> > > +		char *mode = &buf[i * GUD_CONNECTOR_TV_MODE_NAME_LEN];
> > > +
> > > +		/* The device is not trusted to NUL-terminate the name */
> > > +		mode[GUD_CONNECTOR_TV_MODE_NAME_LEN - 1] = '\0';
> > > +		modes[i] = mode;
> > > +	}
> > >  
> > >  	ret = drm_mode_create_tv_properties_legacy(connector->dev, num_modes, modes);
> > >  free:

Patchew 2.1-devel-ea86937

© 2016 - 2026 Red Hat, Inc.