drm/msm: Replace unsafe snprintf usage with scnprintf

The refill_buf function uses snprintf to append to a fixed-size buffer.
snprintf returns the length that would have been written, which can
exceed the remaining buffer size. If this happens, ptr advances beyond
the buffer and rem becomes negative. In the 2nd iteration, rem is
treated as a large unsigned integer, causing snprintf to write oob.

While this behavior is technically mitigated by num_perfcntrs being
locked at 5, it's still unsafe if num_perfcntrs were ever to change/a
second source was added.

Signed-off-by: Evan Lambert <veyga@veygax.dev>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/696358/
Link: https://lore.kernel.org/r/20251224124254.17920-3-veyga@veygax.dev
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>

diff --git a/drivers/gpu/drm/msm/msm_perf.c b/drivers/gpu/drm/msm/msm_perf.c
index d3c7889aaf267a9faa67511cec7cbd190603fb11..c369d4acc3781b93c4c49b095f4e6176f8b9b773 100644 (file)
--- a/drivers/gpu/drm/msm/msm_perf.c
+++ b/drivers/gpu/drm/msm/msm_perf.c
@@ -65,13 +65,13 @@ static int refill_buf(struct msm_perf_state *perf)
 
        if ((perf->cnt++ % 32) == 0) {
                /* Header line: */
-               n = snprintf(ptr, rem, "%%BUSY");
+               n = scnprintf(ptr, rem, "%%BUSY");
                ptr += n;
                rem -= n;
 
                for (i = 0; i < gpu->num_perfcntrs; i++) {
                        const struct msm_gpu_perfcntr *perfcntr = &gpu->perfcntrs[i];
-                       n = snprintf(ptr, rem, "\t%s", perfcntr->name);
+                       n = scnprintf(ptr, rem, "\t%s", perfcntr->name);
                        ptr += n;
                        rem -= n;
                }
@@ -93,21 +93,21 @@ static int refill_buf(struct msm_perf_state *perf)
                        return ret;
 
                val = totaltime ? 1000 * activetime / totaltime : 0;
-               n = snprintf(ptr, rem, "%3d.%d%%", val / 10, val % 10);
+               n = scnprintf(ptr, rem, "%3d.%d%%", val / 10, val % 10);
                ptr += n;
                rem -= n;
 
                for (i = 0; i < ret; i++) {
                        /* cycle counters (I think).. convert to MHz.. */
                        val = cntrs[i] / 10000;
-                       n = snprintf(ptr, rem, "\t%5d.%02d",
+                       n = scnprintf(ptr, rem, "\t%5d.%02d",
                                        val / 100, val % 100);
                        ptr += n;
                        rem -= n;
                }
        }
 
-       n = snprintf(ptr, rem, "\n");
+       n = scnprintf(ptr, rem, "\n");
        ptr += n;
        rem -= n;