iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot()

[ Upstream commit 75c02a037609f34db17e91be195cedb33b61bae0 ]

snprintf() returns the number of bytes that would have been written, not
the number actually written. Using this for offset tracking can cause
buffer overruns if truncation occurs.

Replace snprintf() with scnprintf() to ensure the offset stays within
bounds.

Since scnprintf() never returns a negative value, and zero is not possible
in this context because 'bytes' starts at 0 and 'size - bytes' is
DEBUG_BUFFER_SIZE in the first call, which is large enough to hold the
string literals used, the return value is always positive. An integer
overflow is also completely out of reach here due to the small and fixed
buffer size. The error check in latency_show_one() is therefore
unnecessary. Remove it and make dmar_latency_snapshot() return void.

Signed-off-by: Seyediman Seyedarab <ImanDevel@gmail.com>
Link: https://lore.kernel.org/r/20250731225048.131364-1-ImanDevel@gmail.com
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/iommu/intel/debugfs.c b/drivers/iommu/intel/debugfs.c
index 5aa7f46a420b58106c978bb81353ef3b8b39ad58..38790ff50977c82c3d9671100b1886125f74fb22 100644 (file)
--- a/drivers/iommu/intel/debugfs.c
+++ b/drivers/iommu/intel/debugfs.c
@@ -661,17 +661,11 @@ DEFINE_SHOW_ATTRIBUTE(ir_translation_struct);
 static void latency_show_one(struct seq_file *m, struct intel_iommu *iommu,
                             struct dmar_drhd_unit *drhd)
 {
-       int ret;
-
        seq_printf(m, "IOMMU: %s Register Base Address: %llx\n",
                   iommu->name, drhd->reg_base_addr);
 
-       ret = dmar_latency_snapshot(iommu, debug_buf, DEBUG_BUFFER_SIZE);
-       if (ret < 0)
-               seq_puts(m, "Failed to get latency snapshot");
-       else
-               seq_puts(m, debug_buf);
-       seq_puts(m, "\n");
+       dmar_latency_snapshot(iommu, debug_buf, DEBUG_BUFFER_SIZE);
+       seq_printf(m, "%s\n", debug_buf);
 }
 
 static int latency_show(struct seq_file *m, void *v)

diff --git a/drivers/iommu/intel/perf.c b/drivers/iommu/intel/perf.c
index adc4de6bbd88e1e0a33470b735766e908d8d1343..dceeadc3ee7cdd76202ad1f10ff83b51a9b112e5 100644 (file)
--- a/drivers/iommu/intel/perf.c
+++ b/drivers/iommu/intel/perf.c
@@ -113,7 +113,7 @@ static char *latency_type_names[] = {
        "     svm_prq"
 };
 
-int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
+void dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
 {
        struct latency_statistic *lstat = iommu->perf_statistic;
        unsigned long flags;
@@ -122,7 +122,7 @@ int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
        memset(str, 0, size);
 
        for (i = 0; i < COUNTS_NUM; i++)
-               bytes += snprintf(str + bytes, size - bytes,
+               bytes += scnprintf(str + bytes, size - bytes,
                                  "%s", latency_counter_names[i]);
 
        spin_lock_irqsave(&latency_lock, flags);
@@ -130,7 +130,7 @@ int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
                if (!dmar_latency_enabled(iommu, i))
                        continue;
 
-               bytes += snprintf(str + bytes, size - bytes,
+               bytes += scnprintf(str + bytes, size - bytes,
                                  "\n%s", latency_type_names[i]);
 
                for (j = 0; j < COUNTS_NUM; j++) {
@@ -156,11 +156,9 @@ int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
                                break;
                        }
 
-                       bytes += snprintf(str + bytes, size - bytes,
+                       bytes += scnprintf(str + bytes, size - bytes,
                                          "%12lld", val);
                }
        }
        spin_unlock_irqrestore(&latency_lock, flags);
-
-       return bytes;
 }

diff --git a/drivers/iommu/intel/perf.h b/drivers/iommu/intel/perf.h
index df9a36942d643562575888285a2ec6f6a9237f94..1d4baad7e852ebccf4e2f6c3d807a52ac67ec754 100644 (file)
--- a/drivers/iommu/intel/perf.h
+++ b/drivers/iommu/intel/perf.h
@@ -40,7 +40,7 @@ void dmar_latency_disable(struct intel_iommu *iommu, enum latency_type type);
 bool dmar_latency_enabled(struct intel_iommu *iommu, enum latency_type type);
 void dmar_latency_update(struct intel_iommu *iommu, enum latency_type type,
                         u64 latency);
-int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size);
+void dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size);
 #else
 static inline int
 dmar_latency_enable(struct intel_iommu *iommu, enum latency_type type)
@@ -64,9 +64,8 @@ dmar_latency_update(struct intel_iommu *iommu, enum latency_type type, u64 laten
 {
 }
 
-static inline int
+static inline void
 dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
 {
-       return 0;
 }
 #endif /* CONFIG_DMAR_PERF */