diff options
| author | Seyediman Seyedarab <imandevel@gmail.com> | 2025-07-24 15:59:13 -0400 |
|---|---|---|
| committer | Danilo Krummrich <dakr@kernel.org> | 2025-08-09 12:20:46 +0200 |
| commit | 6510b62fe9303aaf48ff136ff69186bcfc32172d (patch) | |
| tree | a16a3c9faa6a031c27b6e895f6046048a1809f34 | |
| parent | d2b48f2b30f25997a1ae1ad0cefac68c25f8c330 (diff) | |
drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
snprintf() returns the number of characters that *would* have been
written, which can overestimate how much you actually wrote to the
buffer in case of truncation. That leads to 'data += this' advancing
the pointer past the end of the buffer and size going negative.
Switching to scnprintf() prevents potential buffer overflows and ensures
consistent behavior when building the output string.
Signed-off-by: Seyediman Seyedarab <ImanDevel@gmail.com>
Link: https://lore.kernel.org/r/20250724195913.60742-1-ImanDevel@gmail.com
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
| -rw-r--r-- | drivers/gpu/drm/nouveau/nvkm/core/enum.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/gpu/drm/nouveau/nvkm/core/enum.c b/drivers/gpu/drm/nouveau/nvkm/core/enum.c index b9581feb24cc..a23b40b27b81 100644 --- a/drivers/gpu/drm/nouveau/nvkm/core/enum.c +++ b/drivers/gpu/drm/nouveau/nvkm/core/enum.c @@ -44,7 +44,7 @@ nvkm_snprintbf(char *data, int size, const struct nvkm_bitfield *bf, u32 value) bool space = false; while (size >= 1 && bf->name) { if (value & bf->mask) { - int this = snprintf(data, size, "%s%s", + int this = scnprintf(data, size, "%s%s", space ? " " : "", bf->name); size -= this; data += this; |