Messages in this thread Patch in this message | | | From | Eric Sesterhenn <> | Subject | [PATCH 6/7] Handle snprintf truncation in msm_perf more gracefully | Date | Wed, 11 Oct 2017 10:27:53 +0200 |
| |
This prevents the snprintf to cause a WARN_ON_ONCE if rem gets negative. This can happen if an earlier snprintf truncates the string but returns the length it would require to print the full string.
Signed-off-by: Eric Sesterhenn <eric.sesterhenn@x41-dsec.de> --- drivers/gpu/drm/msm/msm_perf.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/msm/msm_perf.c b/drivers/gpu/drm/msm/msm_perf.c index 5ab21bd2decb..93803ca869d5 100644 --- a/drivers/gpu/drm/msm/msm_perf.c +++ b/drivers/gpu/drm/msm/msm_perf.c @@ -77,7 +77,7 @@ static int refill_buf(struct msm_perf_state *perf) ptr += n; rem -= n;
- for (i = 0; i < gpu->num_perfcntrs; i++) { + for (i = 0; i < gpu->num_perfcntrs && rem > 0; i++) { const struct msm_gpu_perfcntr *perfcntr = &gpu->perfcntrs[i]; n = snprintf(ptr, rem, "\t%s", perfcntr->name); ptr += n; @@ -105,7 +105,7 @@ static int refill_buf(struct msm_perf_state *perf) ptr += n; rem -= n;
- for (i = 0; i < ret; i++) { + for (i = 0; i < ret && rem > 0; i++) { /* cycle counters (I think).. convert to MHz.. */ val = cntrs[i] / 10000; n = snprintf(ptr, rem, "\t%5d.%02d", @@ -115,9 +115,11 @@ static int refill_buf(struct msm_perf_state *perf) } }
- n = snprintf(ptr, rem, "\n"); - ptr += n; - rem -= n; + if (rem > 0) { + n = snprintf(ptr, rem, "\n"); + ptr += n; + rem -= n; + }
perf->bufpos = 0; perf->buftot = ptr - perf->buf; -- Eric Sesterhenn (Principal Security Consultant) X41 D-SEC GmbH, Dennewartstr. 25-27, D-52068 Aachen T: +49 241 9809418-0, Fax: -9 Unternehmenssitz: Aachen, Amtsgericht Aachen: HRB19989 Geschäftsführer: Markus Vervier [unhandled content-type:application/pgp-signature]
| |