Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Medium] The newly added buffer bounds check evaluates truncation at the wrong time, missing partial truncations on the final recovery method and causing string corruption. --
--- Patch [1]: [PATCH] drm/drv: Add buffer bounds check in drm_dev_wedged_event() --- commit d685223ec7cc48ba38c7ea409895bbfb9a46aadc Author: Mallesh Koujalagi <[email protected]> drm/drv: Add buffer bounds check in drm_dev_wedged_event() This patch adds a bounds check to prevent silent truncation when formatting the wedged event string. It emits a warning and breaks the loop if the buffer is full. > diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c > index 1ff0bf7cba6aa..63eef0a19e993 100644 > --- a/drivers/gpu/drm/drm_drv.c > +++ b/drivers/gpu/drm/drm_drv.c > @@ -578,6 +578,9 @@ int drm_dev_wedged_event(struct drm_device *dev, unsigned > long method, > if (drm_WARN_ONCE(dev, !recovery, "invalid recovery method > %u\n", opt)) > break; > > + if (drm_WARN_ON(dev, len >= WEDGE_STR_LEN - 1)) > + break; > + > len += scnprintf(event_string + len, sizeof(event_string) - > len, "%s,", recovery); [Severity: Medium] Since this bounds check is placed before the scnprintf() call, what happens if the string is partially truncated during the final iteration of the loop? If multiple recovery methods are present and their combined length exceeds the 32-byte buffer during the last iteration, scnprintf() will partially truncate the string. Because this is the last iteration, the loop terminates without ever reaching the bounds check on the next iteration. Consequently, the truncation goes unnoticed, and the post-loop cleanup code: if (recovery) /* Get rid of trailing comma */ event_string[len - 1] = '\0'; will overwrite the last valid character of the truncated string rather than a trailing comma, emitting a malformed string to userspace. Should the truncation check also evaluate the result of the scnprintf() call to ensure partial truncations are caught on the final loop iteration? > } -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
