drm/i915/gt: Use scnprintf() for avoiding potential buffer overflow

Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Link: https://patchwork.freedesktop.org/patch/msgid/20200311073256.6535-1-tiwai@suse.de

diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
index 53ac3f0..8eeec87 100644 (file)
--- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c
+++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
@@ -1381,24 +1381,24 @@ static void intel_engine_print_registers(struct intel_engine_cs *engine,
                        char hdr[160];
                        int len;
 
-                       len = snprintf(hdr, sizeof(hdr),
-                                      "\t\tActive[%d]: ",
-                                      (int)(port - execlists->active));
+                       len = scnprintf(hdr, sizeof(hdr),
+                                       "\t\tActive[%d]: ",
+                                       (int)(port - execlists->active));
                        if (!i915_request_signaled(rq)) {
                                struct intel_timeline *tl = get_timeline(rq);
 
-                               len += snprintf(hdr + len, sizeof(hdr) - len,
-                                               "ring:{start:%08x, hwsp:%08x, seqno:%08x, runtime:%llums}, ",
-                                               i915_ggtt_offset(rq->ring->vma),
-                                               tl ? tl->hwsp_offset : 0,
-                                               hwsp_seqno(rq),
-                                               DIV_ROUND_CLOSEST_ULL(intel_context_get_total_runtime_ns(rq->context),
-                                                                     1000 * 1000));
+                               len += scnprintf(hdr + len, sizeof(hdr) - len,
+                                                "ring:{start:%08x, hwsp:%08x, seqno:%08x, runtime:%llums}, ",
+                                                i915_ggtt_offset(rq->ring->vma),
+                                                tl ? tl->hwsp_offset : 0,
+                                                hwsp_seqno(rq),
+                                                DIV_ROUND_CLOSEST_ULL(intel_context_get_total_runtime_ns(rq->context),
+                                                                      1000 * 1000));
 
                                if (tl)
                                        intel_timeline_put(tl);
                        }
-                       snprintf(hdr + len, sizeof(hdr) - len, "rq: ");
+                       scnprintf(hdr + len, sizeof(hdr) - len, "rq: ");
                        print_request(m, rq, hdr);
                }
                for (port = execlists->pending; (rq = *port); port++) {