Commit 61f874d6 authored by Takashi Iwai's avatar Takashi Iwai Committed by Chris Wilson

drm/i915/gt: Use scnprintf() for avoiding potential buffer overflow

Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Reviewed-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
Link: https://patchwork.freedesktop.org/patch/msgid/20200311073256.6535-1-tiwai@suse.de
parent 3c4e93e9
...@@ -1381,24 +1381,24 @@ static void intel_engine_print_registers(struct intel_engine_cs *engine, ...@@ -1381,24 +1381,24 @@ static void intel_engine_print_registers(struct intel_engine_cs *engine,
char hdr[160]; char hdr[160];
int len; int len;
len = snprintf(hdr, sizeof(hdr), len = scnprintf(hdr, sizeof(hdr),
"\t\tActive[%d]: ", "\t\tActive[%d]: ",
(int)(port - execlists->active)); (int)(port - execlists->active));
if (!i915_request_signaled(rq)) { if (!i915_request_signaled(rq)) {
struct intel_timeline *tl = get_timeline(rq); struct intel_timeline *tl = get_timeline(rq);
len += snprintf(hdr + len, sizeof(hdr) - len, len += scnprintf(hdr + len, sizeof(hdr) - len,
"ring:{start:%08x, hwsp:%08x, seqno:%08x, runtime:%llums}, ", "ring:{start:%08x, hwsp:%08x, seqno:%08x, runtime:%llums}, ",
i915_ggtt_offset(rq->ring->vma), i915_ggtt_offset(rq->ring->vma),
tl ? tl->hwsp_offset : 0, tl ? tl->hwsp_offset : 0,
hwsp_seqno(rq), hwsp_seqno(rq),
DIV_ROUND_CLOSEST_ULL(intel_context_get_total_runtime_ns(rq->context), DIV_ROUND_CLOSEST_ULL(intel_context_get_total_runtime_ns(rq->context),
1000 * 1000)); 1000 * 1000));
if (tl) if (tl)
intel_timeline_put(tl); intel_timeline_put(tl);
} }
snprintf(hdr + len, sizeof(hdr) - len, "rq: "); scnprintf(hdr + len, sizeof(hdr) - len, "rq: ");
print_request(m, rq, hdr); print_request(m, rq, hdr);
} }
for (port = execlists->pending; (rq = *port); port++) { for (port = execlists->pending; (rq = *port); port++) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment