]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
drm/log: Fix out-of-bounds read on empty message length
authorShixiong Ou <oushixiong@kylinos.cn>
Wed, 29 Jul 2026 08:45:17 +0000 (16:45 +0800)
committerJocelyn Falempe <jfalempe@redhat.com>
Thu, 13 Aug 2026 13:47:50 +0000 (15:47 +0200)
commit60baa179ed1333535f6e2da4133511db55278ee4
treee9e9469dc9dc9af56822a75b7c6bd9598b3c53f5
parent921ac6cb066d09b5765db892d0db0ffaffa98767
drm/log: Fix out-of-bounds read on empty message length

drm_log_draw_kmsg_record() accesses s[len - 1] to strip the trailing
newline, but len is unsigned int. If len is 0, the subtraction wraps
to UINT_MAX, causing an out-of-bounds read.

Add an early return when len is 0.

Fixes: 25e2c2a3eff5 ("drm/log: Color the timestamp, to improve readability")
Signed-off-by: Shixiong Ou <oushixiong@kylinos.cn>
Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>
Link: https://patch.msgid.link/20260729084520.688087-1-oushixiong1025@163.com
Signed-off-by: Jocelyn Falempe <jfalempe@redhat.com>
drivers/gpu/drm/clients/drm_log.c