[PATCH] drm/amdgpu/jpeg: Fix sprintf buffer overflow warning in jpeg_v2_5

Michal Simek posted 1 patch 4 hours ago
drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
[PATCH] drm/amdgpu/jpeg: Fix sprintf buffer overflow warning in jpeg_v2_5
Posted by Michal Simek 4 hours ago
Replace sprintf() with snprintf() to fix the -Werror=format-overflow
warning when building with allmodconfig:

  drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c:152:47: error: '%d' directive
  writing between 1 and 11 bytes into a region of size 7
  [-Werror=format-overflow=]
    152 |                 sprintf(ring->name, "jpeg_dec_%d", i);

The ring->name buffer is 16 bytes. Using snprintf() with sizeof()
ensures the buffer cannot overflow regardless of the integer value.

Signed-off-by: Michal Simek <michal.simek@amd.com>
---

 drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c b/drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c
index 20983f126b49..fe2b049afac3 100644
--- a/drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c
+++ b/drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c
@@ -149,7 +149,7 @@ static int jpeg_v2_5_sw_init(struct amdgpu_ip_block *ip_block)
 		else
 			ring->vm_hub = AMDGPU_MMHUB0(0);
 		ring->doorbell_index = (adev->doorbell_index.vcn.vcn_ring0_1 << 1) + 1 + 8 * i;
-		sprintf(ring->name, "jpeg_dec_%d", i);
+		snprintf(ring->name, sizeof(ring->name), "jpeg_dec_%d", i);
 		r = amdgpu_ring_init(adev, ring, 512, &adev->jpeg.inst[i].irq,
 				     0, AMDGPU_RING_PRIO_DEFAULT, NULL);
 		if (r)
-- 
2.43.0

base-commit: def01be0116ec66f7903e49ededad78e49717109
branch: master
Re: [PATCH] drm/amdgpu/jpeg: Fix sprintf buffer overflow warning in jpeg_v2_5
Posted by Christian König an hour ago
On 4/14/26 08:02, Michal Simek wrote:
> Replace sprintf() with snprintf() to fix the -Werror=format-overflow
> warning when building with allmodconfig:
> 
>   drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c:152:47: error: '%d' directive
>   writing between 1 and 11 bytes into a region of size 7
>   [-Werror=format-overflow=]
>     152 |                 sprintf(ring->name, "jpeg_dec_%d", i);
> 
> The ring->name buffer is 16 bytes. Using snprintf() with sizeof()
> ensures the buffer cannot overflow regardless of the integer value.
> 
> Signed-off-by: Michal Simek <michal.simek@amd.com>

Reviewed-by: Christian König <christian.koenig@amd.com>

> ---
> 
>  drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c b/drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c
> index 20983f126b49..fe2b049afac3 100644
> --- a/drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c
> +++ b/drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c
> @@ -149,7 +149,7 @@ static int jpeg_v2_5_sw_init(struct amdgpu_ip_block *ip_block)
>  		else
>  			ring->vm_hub = AMDGPU_MMHUB0(0);
>  		ring->doorbell_index = (adev->doorbell_index.vcn.vcn_ring0_1 << 1) + 1 + 8 * i;
> -		sprintf(ring->name, "jpeg_dec_%d", i);
> +		snprintf(ring->name, sizeof(ring->name), "jpeg_dec_%d", i);
>  		r = amdgpu_ring_init(adev, ring, 512, &adev->jpeg.inst[i].irq,
>  				     0, AMDGPU_RING_PRIO_DEFAULT, NULL);
>  		if (r)