• Srinivasan Shanmugam's avatar
    drm/amdgpu: Fix 'fw_name' buffer size to prevent truncations in amdgpu_mes_init_microcode · 20fd1446
    Srinivasan Shanmugam authored
    The snprintf function is used to write a formatted string into fw_name.
    The format of the string is "amdgpu/%s_mes%s.bin", where %s is replaced
    by the string in ucode_prefix and the second %s is replaced by either
    "_2" or "1" depending on the condition pipe == AMDGPU_MES_SCHED_PIPE.
    
    The length of the string "amdgpu/%s_mes%s.bin" is 16 characters plus the
    length of ucode_prefix and the length of the string "_2" or "1". The
    size of ucode_prefix is 30, so the maximum length of ucode_prefix is 29
    characters (since one character is needed for the null terminator).
    Therefore, the maximum possible length of the string written into
    fw_name is 16 + 29 + 2 = 47 characters.
    
    The size of fw_name is 40, so if the length of the string written into
    fw_name is more than 39 characters (since one character is needed for
    the null terminator), it will be truncated by the snprintf function, and
    thus warnings will be seen.
    
    By increasing the size of fw_name to 50, we ensure that fw_name is
    large enough to hold the maximum possible length of the string, so the
    snprintf function will not truncate the output.
    
    Fixes the below with gcc W=1:
    drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c: In function ‘amdgpu_mes_init_microcode’:
    drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c:1482:66: warning: ‘%s’ directive output may be truncated writing up to 1 bytes into a region of size between 0 and 29 [-Wformat-truncation=]
     1482 |                 snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mes%s.bin",
          |                                                                  ^~
    drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c:1482:17: note: ‘snprintf’ output between 16 and 46 bytes into a destination of size 40
     1482 |                 snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mes%s.bin",
          |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     1483 |                          ucode_prefix,
          |                          ~~~~~~~~~~~~~
     1484 |                          pipe == AMDGPU_MES_SCHED_PIPE ? "" : "1");
          |                          ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c:1477:66: warning: ‘%s’ directive output may be truncated writing 1 byte into a region of size between 0 and 29 [-Wformat-truncation=]
     1477 |                 snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mes%s.bin",
          |                                                                  ^~
     1478 |                          ucode_prefix,
     1479 |                          pipe == AMDGPU_MES_SCHED_PIPE ? "_2" : "1");
          |                                                                 ~~~
    drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c:1477:17: note: ‘snprintf’ output between 17 and 46 bytes into a destination of size 40
     1477 |                 snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mes%s.bin",
          |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     1478 |                          ucode_prefix,
          |                          ~~~~~~~~~~~~~
     1479 |                          pipe == AMDGPU_MES_SCHED_PIPE ? "_2" : "1");
          |                          ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c:1477:66: warning: ‘%s’ directive output may be truncated writing 2 bytes into a region of size between 0 and 29 [-Wformat-truncation=]
     1477 |                 snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mes%s.bin",
          |                                                                  ^~
     1478 |                          ucode_prefix,
     1479 |                          pipe == AMDGPU_MES_SCHED_PIPE ? "_2" : "1");
          |                                                          ~~~~
    drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c:1477:17: note: ‘snprintf’ output between 18 and 47 bytes into a destination of size 40
     1477 |                 snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mes%s.bin",
          |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     1478 |                          ucode_prefix,
          |                          ~~~~~~~~~~~~~
     1479 |                          pipe == AMDGPU_MES_SCHED_PIPE ? "_2" : "1");
          |                          ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c:1489:62: warning: ‘_mes.bin’ directive output may be truncated writing 8 bytes into a region of size between 4 and 33 [-Wformat-truncation=]
     1489 |                 snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mes.bin",
          |                                                              ^~~~~~~~
    drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c:1489:17: note: ‘snprintf’ output between 16 and 45 bytes into a destination of size 40
     1489 |                 snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mes.bin",
          |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     1490 |                          ucode_prefix);
          |                          ~~~~~~~~~~~~~
    
    Cc: Alex Deucher <alexander.deucher@amd.com>
    Cc: Christian König <christian.koenig@amd.com>
    Suggested-by: default avatarLijo Lazar <lijo.lazar@amd.com>
    Signed-off-by: default avatarSrinivasan Shanmugam <srinivasan.shanmugam@amd.com>
    Reviewed-by: default avatarLijo Lazar <lijo.lazar@amd.com>
    Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
    20fd1446
amdgpu_mes.c 41 KB