[PATCH 1/4] drm/log: Fix out-of-bounds read on empty message length

[PATCH 1/4] drm/log: Fix out-of-bounds read on empty message length

[oushixiong1025]

From: Shixiong Ou <oushixiong@kylinos.cn>

drm_log_draw_kmsg_record() accesses s[len - 1] to strip the trailing
newline, but len is unsigned int. If len is 0, the subtraction wraps
to UINT_MAX, causing an out-of-bounds read.

Add an early return when len is 0.

Signed-off-by: Shixiong Ou <oushixiong@kylinos.cn>
---
 drivers/gpu/drm/clients/drm_log.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/clients/drm_log.c b/drivers/gpu/drm/clients/drm_log.c
index e3e02c84a4cf..294b3be1a6b3 100644
--- a/drivers/gpu/drm/clients/drm_log.c
+++ b/drivers/gpu/drm/clients/drm_log.c
@@ -162,6 +162,9 @@ static void drm_log_draw_kmsg_record(struct drm_log_scanout *scanout,
 {
 	u32 prefix_len = 0;
 
+	if (!len)
+		return;
+
 	if (len > TS_PREFIX_LEN && s[0] == '[' && s[6] == '.' && s[TS_PREFIX_LEN] == ']')
 		prefix_len = TS_PREFIX_LEN + 1;
 
-- 
2.25.1


No virus found
		Checked by Hillstone Network AntiVirus

[PATCH 2/4] drm/log: Fix division by zero when scale module parameter is 0

[oushixiong1025]

From: Shixiong Ou <oushixiong@kylinos.cn>

The scale module parameter can be set to 0 via kernel command line or
sysfs. When scale is 0, scaled_font_h and scaled_font_w become 0,
causing a division by zero in the rows/columns calculation.

Add a custom param_ops setter to clamp scale to a minimum of 1 at the
source, ensuring scale is always valid for all users.

Signed-off-by: Shixiong Ou <oushixiong@kylinos.cn>
---
 drivers/gpu/drm/clients/drm_log.c | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/clients/drm_log.c b/drivers/gpu/drm/clients/drm_log.c
index 294b3be1a6b3..a04f651e8265 100644
--- a/drivers/gpu/drm/clients/drm_log.c
+++ b/drivers/gpu/drm/clients/drm_log.c
@@ -26,7 +26,27 @@ MODULE_DESCRIPTION("DRM boot logger");
 MODULE_LICENSE("GPL");
 
 static unsigned int scale = 1;
-module_param(scale, uint, 0444);
+
+static int drm_log_scale_set(const char *val, const struct kernel_param *kp)
+{
+	int ret;
+
+	ret = param_set_uint(val, kp);
+	if (ret)
+		return ret;
+
+	if (scale < 1)
+		scale = 1;
+
+	return 0;
+}
+
+static const struct kernel_param_ops drm_log_scale_ops = {
+	.set	= drm_log_scale_set,
+	.get	= param_get_uint,
+};
+
+module_param_cb(scale, &drm_log_scale_ops, &scale, 0444);
 MODULE_PARM_DESC(scale, "Integer scaling factor for drm_log, default is 1");
 
 /**
-- 
2.25.1


No virus found
		Checked by Hillstone Network AntiVirus

Re: [PATCH 2/4] drm/log: Fix division by zero when scale module parameter is 0

[Jani Nikula]

On Wed, 29 Jul 2026, oushixiong1025@163.com wrote:
> From: Shixiong Ou <oushixiong@kylinos.cn>
>
> The scale module parameter can be set to 0 via kernel command line or
> sysfs. When scale is 0, scaled_font_h and scaled_font_w become 0,
> causing a division by zero in the rows/columns calculation.
>
> Add a custom param_ops setter to clamp scale to a minimum of 1 at the
> source, ensuring scale is always valid for all users.
>
> Signed-off-by: Shixiong Ou <oushixiong@kylinos.cn>
> ---
>  drivers/gpu/drm/clients/drm_log.c | 22 +++++++++++++++++++++-
>  1 file changed, 21 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/clients/drm_log.c b/drivers/gpu/drm/clients/drm_log.c
> index 294b3be1a6b3..a04f651e8265 100644
> --- a/drivers/gpu/drm/clients/drm_log.c
> +++ b/drivers/gpu/drm/clients/drm_log.c
> @@ -26,7 +26,27 @@ MODULE_DESCRIPTION("DRM boot logger");
>  MODULE_LICENSE("GPL");
>  
>  static unsigned int scale = 1;
> -module_param(scale, uint, 0444);
> +
> +static int drm_log_scale_set(const char *val, const struct kernel_param *kp)
> +{
> +	int ret;
> +
> +	ret = param_set_uint(val, kp);
> +	if (ret)
> +		return ret;

Pedantically, scale may be 0 between param_set_uint() and the check
below, i.e. the fix is racy.

An alternative is to use a function to get the scaling factor, and
having it return scale ?: 1.

BR,
Jani.


> +
> +	if (scale < 1)
> +		scale = 1;
> +
> +	return 0;
> +}
> +
> +static const struct kernel_param_ops drm_log_scale_ops = {
> +	.set	= drm_log_scale_set,
> +	.get	= param_get_uint,
> +};
> +
> +module_param_cb(scale, &drm_log_scale_ops, &scale, 0444);
>  MODULE_PARM_DESC(scale, "Integer scaling factor for drm_log, default is 1");
>  
>  /**

-- 
Jani Nikula, Intel

Re: [PATCH 1/4] drm/log: Fix out-of-bounds read on empty message length

[Jocelyn Falempe]

On 29/07/2026 10:45, oushixiong1025@163.com wrote:
> From: Shixiong Ou <oushixiong@kylinos.cn>
> 
> drm_log_draw_kmsg_record() accesses s[len - 1] to strip the trailing
> newline, but len is unsigned int. If len is 0, the subtraction wraps
> to UINT_MAX, causing an out-of-bounds read.
> 
> Add an early return when len is 0.

Thanks, for your contribution

Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>

> 
> Signed-off-by: Shixiong Ou <oushixiong@kylinos.cn>
> ---
>   drivers/gpu/drm/clients/drm_log.c | 3 +++
>   1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/gpu/drm/clients/drm_log.c b/drivers/gpu/drm/clients/drm_log.c
> index e3e02c84a4cf..294b3be1a6b3 100644
> --- a/drivers/gpu/drm/clients/drm_log.c
> +++ b/drivers/gpu/drm/clients/drm_log.c
> @@ -162,6 +162,9 @@ static void drm_log_draw_kmsg_record(struct drm_log_scanout *scanout,
>   {
>   	u32 prefix_len = 0;
>   
> +	if (!len)
> +		return;
> +
>   	if (len > TS_PREFIX_LEN && s[0] == '[' && s[6] == '.' && s[TS_PREFIX_LEN] == ']')
>   		prefix_len = TS_PREFIX_LEN + 1;
>   

Re: [PATCH 1/4] drm/log: Fix out-of-bounds read on empty message length

[Jocelyn Falempe]

I just pushed the 4 patches.

The 3 fixes to drm-misc-fixes, and the vmap/unmap optimization to 
drm-misc-next.

Thanks for your contribution.

-- 

Jocelyn Falempe