drm/amdgpu: Fix snprintf buffer size in smu_v14_0_init_microcode
This commit addresses buffer overflow in the smu_v14_0_init_microcode function. The issue was about the snprintf function writing more bytes into the fw_name buffer than it can hold. The line of code is: snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin", ucode_prefix); Here, snprintf is used to write a formatted string into fw_name. The format is "amdgpu/%s.bin", where %s is a placeholder for the string ucode_prefix. The sizeof(fw_name) argument tells snprintf the maximum number of bytes it can write into fw_name, including the null-terminating character. In the original code, fw_name is an array of 30 characters. The string "amdgpu/%s.bin" could be up to 41 bytes long, which exceeds the 30 bytes allocated for fw_name. This is because %s could be replaced by ucode_prefix, which can be up to 29 characters long. Adding the 12 characters from "amdgpu/" and ".bin", the total length could be 41 characters. To address this, the size of ucode_prefix has been reduced to 15 characters. This ensures that the maximum length of the string written into fw_name does not exceed its capacity. smu_13/14 etc. don't follow legacy scheme ie., amdgpu_ucode_legacy_naming Fixes the below with gcc W=1: drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu14/smu_v14_0.c: In function ‘smu_v14_0_init_microcode’: drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu14/smu_v14_0.c:80:52: warning: ‘%s’ directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=] 80 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin", ucode_prefix); | ^~ ~~~~~~~~~~~~ drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu14/smu_v14_0.c:80:9: note: ‘snprintf’ output between 12 and 41 bytes into a destination of size 30 80 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s.bin", ucode_prefix); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Fixes: fe6cd915 ("drm/amd/swsmu: add smu14 ip support") Cc: Li Ma <li.ma@amd.com> Cc: Likun Gao <Likun.Gao@amd.com> Cc: Lijo Lazar <lijo.lazar@amd.com> Cc: Kenneth Feng <kenneth.feng@amd.com> Cc: Alex Deucher <alexander.deucher@amd.com> Cc: Christian König <christian.koenig@amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> Suggested-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Showing
Please register or sign in to comment