From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f177.google.com (mail-pg1-f177.google.com [209.85.215.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1898035C6B7 for ; Sun, 16 Aug 2026 08:52:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.177 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786870372; cv=none; b=syxq2GLf+0wNRRG2C85+jOe4kcsoUVP/N5ihwV3Q8vKfQ0AS0yBPNsuu59r65IKa0MA267b99iKSsquwI9mUL90J3M8zmyzQ0ddQDJr/wjiYebBgEb0j+ibkOdr6LR+bhA+huA8euAyLFtfDSjxUAtLb1pnxVDqvW00lyvQ/Hxw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786870372; c=relaxed/simple; bh=g4PxbjqlGFw9BTJpt3Mpi4MYi2RRzBamZE/R0B5Rzpg=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=H+tNX1k2bKm30SV3QmVz+yCmstprYHovmKEMC0fPAGMhB0IPXvGlqpN0MGb7SZwqYwMsMCStraT5Eobh46ur6r7y/qrQmCndAOFR+wdnTbDezkRyeUAbFV13gh+JZu53PbW1RlsRt1tIwron4WZZYjNc8FYGtcg+KwJE7PtTXfg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ONJhpYtm; arc=none smtp.client-ip=209.85.215.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ONJhpYtm" Received: by mail-pg1-f177.google.com with SMTP id 41be03b00d2f7-cbee3777e1cso1283302a12.3 for ; Sun, 16 Aug 2026 01:52:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786870370; x=1787475170; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=3t5V5/D+/g818Z3TQJ3FpKYZkU43EH6Jl8hrdpQWuYI=; b=ONJhpYtmiZmkGUDRVwrqS98L2IXt6i14gWBP65LasnxY8WBRpvOjic9WpnTll/0KAO lr9TDlzcuuyngIfKUKhaJVLb2Ym9Pt2yndyMFwWn9x/hwFin9qO0igl6gFzEysHBNgBl +ZrPVcI0yt+5gFOwuYNCTNql6vK5ZTlNyTp+sJFQD7R5tUwFjkDrz4uMr+yZIWAXjsbZ iTC94109+Zu2ABb+27eAtC8b6EmxQtJun2rHgb7HYNwX1jfeV4TlOcUeGCKkj2H9lRSL oLx7gyD6IsrhACcy1tB0J4bM7vrFu3urpZLFU1abUVQebKtOuA8kzVT7qcvbay1vAn2A RF+A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786870370; x=1787475170; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=3t5V5/D+/g818Z3TQJ3FpKYZkU43EH6Jl8hrdpQWuYI=; b=Vf1C/5z5/MwgzKUbYxXqHrvW0X5aHFFoc6pYPdWbMHd5EflmQwxne58htXAOQxk0se Tb7W9iU5HoJYcyzrLsVTxwVJAM0W31yc4yHGWBnhPR+zWizgmaLiWINuojMAdTHv7KyB mCvzoys89bmC82tKi4Nc3UCxQRWEGQlbByEtNphqpgcMMB85dQGLyPhrYvTo/rA0EuvF Wc3cc8L19HGm0pHBK04vjigjckV7XWxdafnwf7ZPflLM9pgWwNHMB7k/YZaEGOHnKqY7 xLbG6UeOzyXcbqN4rGASRChFPBB0k+6LPXgpIxKwdCK0kcp9y06gbiNZr/DSQuYh4k58 Kr4A== X-Forwarded-Encrypted: i=1; AHgh+RqFJlthmwxZdbTZoTMAZ8TggxZjZii5P+nBDx8u1b9qpYcfpNzoKAioW0lFTb4o/7Dp4zX71U2fdKy9in4=@vger.kernel.org X-Gm-Message-State: AOJu0YwAMH2JNyDv/sE1GOEytndDZIJVsg/TkEFWoCucQa/bDN3E+FfQ zpriQMxn7QNEXhyj8MNDEkTk6pBfjGxCwBJ5hZIfOKRjj3rEJhaG7QT7 X-Gm-Gg: AR+sD100/MxQ5Bx6OXslpg/xVc16pMyRo76/8Mv5as5K+1y6l2vYcvJVPavN7lc1bDY 0cdUjO1U5EXcDrK+uUZE59UPnl2/ZqZcsPvSxs0XIuy4GfrBKGux0QsD0+BdjdooSQoC//9cSsQ gCl1y+gcbU3FkwjOYtQd5KgWYU+2enR2xIQlYTKiAPU0qhBwxme6uuc7qL0C8hSFCfiFkE/+q3S vAZmU+w7u5Nl6i9gACfvn+TidCIUbOUwjXOI8LAaknxxvfqIHG2VLDkT/H0CfhekUHfmUVtrgHf o+9PQU6xj1GpnmXmvShrsDuujaFw8DVeFtA9Odc4hgtla+TPgxzp0rI24jhBBHpOoZxrML618/n dhXbKoPfq/8WFECHX9Km/c2s83v8s75CHBH4Y4y7SXrXEyNh2hwJh0fXLojnH0Ia15GGYioZLJ8 FczEGuHQnlehGBBJrDG/QNwcJMFkx6d22QimcxYw9mf0csAWbXeyDBY2J2qIBaSewF6rzWL5xPr DUARjb6miCLuq6OIyJmR4V8pNW81NwhjXcRp02UHHIWXhP67quPjJJJXfHP1qDV X-Received: by 2002:a05:6a21:7702:b0:3b3:d0f:7883 with SMTP id adf61e73a8af0-3cc7196eda5mr21211407637.7.1786870370284; Sun, 16 Aug 2026 01:52:50 -0700 (PDT) Received: from deepanshu-Legion-Pro-5-16AFR10.. ([2405:201:682f:383f:3194:7c7d:e0ca:9186]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-141388b2554sm40425821c88.14.2026.08.16.01.52.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 16 Aug 2026 01:52:49 -0700 (PDT) From: Deepanshu Kartikey To: rubenru09@aol.com, maarten.lankhorst@linux.intel.com, mripard@kernel.org, tzimmermann@suse.de, airlied@gmail.com, simona@ffwll.ch Cc: peter@stuge.se, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Deepanshu Kartikey , syzbot+916c888ba5f1a54c9526@syzkaller.appspotmail.com Subject: [PATCH] drm/gud: NUL-terminate TV mode names read from the device Date: Sun, 16 Aug 2026 14:22:34 +0530 Message-ID: <20260816085234.22053-1-kartikey406@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit gud_connector_add_tv_mode() reads a buffer of fixed-size mode names from the USB device and passes pointers into it to drm_mode_create_tv_properties_legacy(), which calls strlen() on each one. Nothing guarantees the device NUL-terminates a name, so strlen() can run past the end of a slot and, for the last mode, past the end of the allocation. Terminate each name at the end of its slot before use. Fixes: 40e1a70b4aed ("drm: Add GUD USB Display driver") Reported-by: syzbot+916c888ba5f1a54c9526@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=916c888ba5f1a54c9526 Tested-by: syzbot+916c888ba5f1a54c9526@syzkaller.appspotmail.com Signed-off-by: Deepanshu Kartikey --- drivers/gpu/drm/gud/gud_connector.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/gud/gud_connector.c b/drivers/gpu/drm/gud/gud_connector.c index ea0cca58b7c8..5c0065c876a7 100644 --- a/drivers/gpu/drm/gud/gud_connector.c +++ b/drivers/gpu/drm/gud/gud_connector.c @@ -396,8 +396,13 @@ static int gud_connector_add_tv_mode(struct gud_device *gdrm, struct drm_connect } num_modes = ret / GUD_CONNECTOR_TV_MODE_NAME_LEN; - for (i = 0; i < num_modes; i++) - modes[i] = &buf[i * GUD_CONNECTOR_TV_MODE_NAME_LEN]; + for (i = 0; i < num_modes; i++) { + char *mode = &buf[i * GUD_CONNECTOR_TV_MODE_NAME_LEN]; + + /* The device is not trusted to NUL-terminate the name */ + mode[GUD_CONNECTOR_TV_MODE_NAME_LEN - 1] = '\0'; + modes[i] = mode; + } ret = drm_mode_create_tv_properties_legacy(connector->dev, num_modes, modes); free: -- 2.43.0