Commit 66691e27 authored by Evan Lambert's avatar Evan Lambert Committed by Dmitry Baryshkov
Browse files

drm/msm: Replace unsafe snprintf usage with scnprintf 



The refill_buf function uses snprintf to append to a fixed-size buffer.
snprintf returns the length that would have been written, which can
exceed the remaining buffer size. If this happens, ptr advances beyond
the buffer and rem becomes negative. In the 2nd iteration, rem is
treated as a large unsigned integer, causing snprintf to write oob.

While this behavior is technically mitigated by num_perfcntrs being
locked at 5, it's still unsafe if num_perfcntrs were ever to change/a
second source was added.

Signed-off-by: default avatarEvan Lambert <veyga@veygax.dev>
Reviewed-by: default avatarDmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/696358/
Link: https://lore.kernel.org/r/20251224124254.17920-3-veyga@veygax.dev


Signed-off-by: default avatarDmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
parent 88733a0b

drivers/gpu/drm/msm/msm_perf.c

+5 −5
Original line number Diff line number Diff line
@@ -65,13 +65,13 @@ static int refill_buf(struct msm_perf_state *perf) 


	if ((perf->cnt++ % 32) == 0) {

		/* Header line: */

		n = snprintf(ptr, rem, "%%BUSY");

		n = scnprintf(ptr, rem, "%%BUSY");

		ptr += n;

		rem -= n;



		for (i = 0; i < gpu->num_perfcntrs; i++) {

			const struct msm_gpu_perfcntr *perfcntr = &gpu->perfcntrs[i];

			n = snprintf(ptr, rem, "\t%s", perfcntr->name);

			n = scnprintf(ptr, rem, "\t%s", perfcntr->name);

			ptr += n;

			rem -= n;

		}
@@ -93,21 +93,21 @@ static int refill_buf(struct msm_perf_state *perf) 
			return ret;



		val = totaltime ? 1000 * activetime / totaltime : 0;

		n = snprintf(ptr, rem, "%3d.%d%%", val / 10, val % 10);

		n = scnprintf(ptr, rem, "%3d.%d%%", val / 10, val % 10);

		ptr += n;

		rem -= n;



		for (i = 0; i < ret; i++) {

			/* cycle counters (I think).. convert to MHz.. */

			val = cntrs[i] / 10000;

			n = snprintf(ptr, rem, "\t%5d.%02d",

			n = scnprintf(ptr, rem, "\t%5d.%02d",

					val / 100, val % 100);

			ptr += n;

			rem -= n;

		}

	}



	n = snprintf(ptr, rem, "\n");

	n = scnprintf(ptr, rem, "\n");

	ptr += n;

	rem -= n;