drm/i915/gt: Use scnprintf() for avoiding potential buffer overflow (61f874d6) · Commits · 戴 / test

Since snprintf() returns the would-be-output size instead of the actual output size, the succeeding calls may go beyond the given buffer limit. Fix it by replacing with scnprintf(). Signed-off-by:

Takashi Iwai <tiwai@suse.de> Reviewed-by:

Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by:

Chris Wilson <chris@chris-wilson.co.uk> Link: https://patchwork.freedesktop.org/patch/msgid/20200311073256.6535-1-tiwai@suse.de

drivers/gpu/drm/i915/gt/intel_engine_cs.c

+11 −11

Original line number	Diff line number	Diff line
		@@ -1381,13 +1381,13 @@ static void intel_engine_print_registers(struct intel_engine_cs *engine,
		char hdr[160];
		int len;

		len = snprintf(hdr, sizeof(hdr),
		len = scnprintf(hdr, sizeof(hdr),
		"\t\tActive[%d]: ",
		(int)(port - execlists->active));
		if (!i915_request_signaled(rq)) {
		struct intel_timeline *tl = get_timeline(rq);

		len += snprintf(hdr + len, sizeof(hdr) - len,
		len += scnprintf(hdr + len, sizeof(hdr) - len,
		"ring:{start:%08x, hwsp:%08x, seqno:%08x, runtime:%llums}, ",
		i915_ggtt_offset(rq->ring->vma),
		tl ? tl->hwsp_offset : 0,
		@@ -1398,7 +1398,7 @@ static void intel_engine_print_registers(struct intel_engine_cs *engine,
		if (tl)
		intel_timeline_put(tl);
		}
		snprintf(hdr + len, sizeof(hdr) - len, "rq: ");
		scnprintf(hdr + len, sizeof(hdr) - len, "rq: ");
		print_request(m, rq, hdr);
		}
		for (port = execlists->pending; (rq = *port); port++) {

Admin message