From nobody Fri Dec 19 17:53:01 2025 Received: from mail-wm1-f53.google.com (mail-wm1-f53.google.com [209.85.128.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 13F293054D4 for ; Thu, 4 Dec 2025 13:20:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.53 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764854426; cv=none; b=ZKrQZylRTHmmH1ytkpddg5VQ4XAzDfnK2lvaYudXnoqm9BVe87dUFZIdRVO22cTCkTZvtgCdaocSvJzReb+pp4VnUJ8C3Qliw1Y58wn9qKuYeqkJTEcMWarhRh75MfvCp+Eg8fEfXqci30ovSmR9O0sqPCmEUHC4eq49dPLtlAM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764854426; c=relaxed/simple; bh=OFaIA1I59QW0DvuDmnApT5r5ZexFus+R8cL8PVWTZ6M=; h=Date:From:To:Cc:Subject:Message-ID:MIME-Version:Content-Type: Content-Disposition; b=nU+clfQ+fIeJTsHicE4ppGjYrAlulRyFMRnoS6No6Wv2TVd34TD9quWws4mmhvzYwvfSM9hOxkY8nbTcKk2Ol76LdoXzLsubiqcgBW776i/Y8BtwOC4XL58Au3McODMkdgHvjKAf5zvFJEEkB6A2ikizbuVSLpnW/DwVcdT5Ve8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linaro.org; spf=pass smtp.mailfrom=linaro.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b=t+M4ZVWa; arc=none smtp.client-ip=209.85.128.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linaro.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b="t+M4ZVWa" Received: by mail-wm1-f53.google.com with SMTP id 5b1f17b1804b1-477563e28a3so7414845e9.1 for ; Thu, 04 Dec 2025 05:20:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1764854422; x=1765459222; darn=vger.kernel.org; h=content-disposition:mime-version:message-id:subject:cc:to:from:date :from:to:cc:subject:date:message-id:reply-to; bh=YklG8feiR5FU/k+rcsWunlToF1mBL/k2qOqrOj6/0mM=; b=t+M4ZVWanji94pDQm3+fvjHThh4kkc/5dkHjhNZjKqtC79y60L8Ns1pEHSHS+QxUQB uomUHEkSgJxUQ0lNFOqlLDJWEk0mtkx/qNqpx7tnDXRUGAhPahIFh359X25riVz7Hqr7 /3/5uAJTMzBv90hinNbIz+gDQ5zh0ElFbV8L0epJa772xPJkxuOe9Day3dF/ZJqhRH7P bYy6mHFUlb5L55XcRGyb3Akale3/kqEcM+nN6IH52fCLyF9Wesg5z3IjHemFu0jlJ4NN IxyjSyeM5J3qV9SZQLQNt2H57ExgEbBSdMko3E+umGLMkf/o22K1osz82xbK15po2S98 OKvQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1764854422; x=1765459222; h=content-disposition:mime-version:message-id:subject:cc:to:from:date :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=YklG8feiR5FU/k+rcsWunlToF1mBL/k2qOqrOj6/0mM=; b=d/DKOrMjUDb+qAh5JvqwiLXy1nYvZVt70J/0AT/JFqgAWsrbUWPNey84H0dwHn+n3q txqpBGySbKaIiN0nmuUfhMP+uXcvCaLPmlcqm6AtMNnKQXLVy/aN5P5ARNDKXpAjtf9G lF1bnS4U949PPLbobXqWlv43BYLGMsK+YzPnBsdE3NKmVYN4YgfrREndaKGgnXqPmYjB zPFE6mxkAtxAhLZV86xb7JlJ58Avcg5LvrJhu5jRTd3yRPkDcoxHBgz7mr6rO9j0X0nS j4Qo2DgQACVIVz0hPrwTG1Xot6M4ZuR7bP8ta3RU8tlkE90qf0nMVLEQPHxKdleidwMG isZQ== X-Forwarded-Encrypted: i=1; AJvYcCWLuoNXuLrgKvvnG69e8WbY/frTSP9uCbi3SD8Spa0ZxFwlKARcqYxPTvtvyNUTaMaF06lgby44TceM5iI=@vger.kernel.org X-Gm-Message-State: AOJu0Yy5ylAfxz37v3E8BjijGoZ6clK11yKFmLbx7a0FuV2HNWSUZxV8 B/fZ6WUTIYkraZmd7Q8F3AnAuj/T7WGMUkpIpomKbP6xSMQCaNlrv/tF+qbo23kZNuA= X-Gm-Gg: ASbGncvpEi80uHearFJI3YRDWdK8uAA+Gh1O76nYmQ3GQEJdHtsGe3e67+iHv10CZ4a m6m16IhdEHqV5283aGzeCxnJcASWlVyBFEbcZip//LxFd5V06YHfl1czvzHPu624/sY8TITZ7QU NRTrxf4lYpWRCtUazty7NxOKcfxUmortn8nDfC7/mGBVokfZnxzYZDo3ttOaZ4uWPef3U4PUccU 4qFCJK3sbLJk5d8cEBJLInKZxsbOpvu7t/tY5ENoad8Ue4ct86Pg+nnVunJnWsNacl18YN9qE/y XYCm8Nskxoqhk86/Z3gTS1voneEv/4qqOQX18/rHGv4lzwHj5burqO3oyHQzN+tlY0CG9HaF/hw nY/BzMcaTz6Lrm9b1NRQB0PYXLDpAWejyPeihsHFO5bGBayLx++S6e4BTPa31Zz6GWXrcgINwPI mYtn8HJZXZh1NjeON1ddWfWEd8afPz3IXrZzek X-Google-Smtp-Source: AGHT+IFcjjEFgmXKpF7SlmgB5UtUoXukvdBKYhqBaRbor0ZYnolgBTjOqdu8w3shLE1sDh0KfSPfjQ== X-Received: by 2002:a05:600c:a07:b0:477:9890:9ab8 with SMTP id 5b1f17b1804b1-4792eb10ddcmr30456395e9.3.1764854422033; Thu, 04 Dec 2025 05:20:22 -0800 (PST) Received: from localhost (h1f65.n1.ips.mtn.co.ug. [41.210.159.101]) by smtp.gmail.com with UTF8SMTPSA id 5b1f17b1804b1-479310b8e70sm31237805e9.5.2025.12.04.05.20.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 04 Dec 2025 05:20:21 -0800 (PST) Date: Thu, 4 Dec 2025 16:20:18 +0300 From: Dan Carpenter To: Hersen Wu Cc: Harry Wentland , Leo Li , Rodrigo Siqueira , Alex Deucher , Christian =?iso-8859-1?Q?K=F6nig?= , David Airlie , Simona Vetter , "ChiaHsuan (Tom) Chung" , Roman Li , Peter Shkenev , Timur =?iso-8859-1?Q?Krist=F3f?= , Wayne Lin , Alex Hung , Kun Liu , Ray Wu , amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: [PATCH] drm/amd/display: Fix debugfs output in dp_link_settings_read() Message-ID: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Disposition: inline X-Mailer: git-send-email haha only kidding Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" This code passes the wrong limit to snprintf(). It does: str_len =3D strlen("Current: %d 0x%x %d "); snprintf(rd_buf_ptr, str_len, ".... The limit should normally be the number of bytes remaining in the buffer but instead of that it's using the number of bytes in the unexpanded format string. So if any of the numbers are more than 1 digit then the output string will have characters missing from the middle of the output. Normally, we would do it like this: off +=3D scnprintf(p + off, buf_size - off, "... Also we can use cleanup.h magic to free the "buf" and simple_read_from_buffer() to copy the buffer to the user as a bit of a cleanup. Fixes: 41db5f1931ec ("drm/amd/display: set-read link rate and lane count th= rough debugfs") Signed-off-by: Dan Carpenter --- Not tested. .../amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 94 ++++++------------- 1 file changed, 31 insertions(+), 63 deletions(-) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/dr= ivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c index cb4bb67289a4..028dfd0aa43d 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c @@ -185,72 +185,40 @@ static int parse_write_buffer_into_params(char *wr_bu= f, uint32_t wr_buf_size, * check current and preferred settings. * */ -static ssize_t dp_link_settings_read(struct file *f, char __user *buf, - size_t size, loff_t *pos) +static ssize_t dp_link_settings_read(struct file *f, char __user *ubuf, + size_t count, loff_t *pos) { struct amdgpu_dm_connector *connector =3D file_inode(f)->i_private; struct dc_link *link =3D connector->dc_link; - char *rd_buf =3D NULL; - char *rd_buf_ptr =3D NULL; - const uint32_t rd_buf_size =3D 100; - uint32_t result =3D 0; - uint8_t str_len =3D 0; - int r; - - if (*pos & 3 || size & 3) - return -EINVAL; - - rd_buf =3D kcalloc(rd_buf_size, sizeof(char), GFP_KERNEL); - if (!rd_buf) - return 0; - - rd_buf_ptr =3D rd_buf; - - str_len =3D strlen("Current: %d 0x%x %d "); - snprintf(rd_buf_ptr, str_len, "Current: %d 0x%x %d ", - link->cur_link_settings.lane_count, - link->cur_link_settings.link_rate, - link->cur_link_settings.link_spread); - rd_buf_ptr +=3D str_len; - - str_len =3D strlen("Verified: %d 0x%x %d "); - snprintf(rd_buf_ptr, str_len, "Verified: %d 0x%x %d ", - link->verified_link_cap.lane_count, - link->verified_link_cap.link_rate, - link->verified_link_cap.link_spread); - rd_buf_ptr +=3D str_len; - - str_len =3D strlen("Reported: %d 0x%x %d "); - snprintf(rd_buf_ptr, str_len, "Reported: %d 0x%x %d ", - link->reported_link_cap.lane_count, - link->reported_link_cap.link_rate, - link->reported_link_cap.link_spread); - rd_buf_ptr +=3D str_len; - - str_len =3D strlen("Preferred: %d 0x%x %d "); - snprintf(rd_buf_ptr, str_len, "Preferred: %d 0x%x %d\n", - link->preferred_link_setting.lane_count, - link->preferred_link_setting.link_rate, - link->preferred_link_setting.link_spread); - - while (size) { - if (*pos >=3D rd_buf_size) - break; - - r =3D put_user(*(rd_buf + result), buf); - if (r) { - kfree(rd_buf); - return r; /* r =3D -EFAULT */ - } - - buf +=3D 1; - size -=3D 1; - *pos +=3D 1; - result +=3D 1; - } - - kfree(rd_buf); - return result; + size_t size =3D 1024; + int off; + + char *buf __free(kfree) =3D kcalloc(size, sizeof(char), GFP_KERNEL); + if (!buf) + return -ENOMEM; + + off =3D 0; + off +=3D scnprintf(buf + off, size - off, "Current: %d 0x%x %d ", + link->cur_link_settings.lane_count, + link->cur_link_settings.link_rate, + link->cur_link_settings.link_spread); + + off +=3D scnprintf(buf + off, size - off, "Verified: %d 0x%x %d ", + link->verified_link_cap.lane_count, + link->verified_link_cap.link_rate, + link->verified_link_cap.link_spread); + + off +=3D scnprintf(buf + off, size - off, "Reported: %d 0x%x %d ", + link->reported_link_cap.lane_count, + link->reported_link_cap.link_rate, + link->reported_link_cap.link_spread); + + off +=3D scnprintf(buf + off, size - off, "Preferred: %d 0x%x %d\n", + link->preferred_link_setting.lane_count, + link->preferred_link_setting.link_rate, + link->preferred_link_setting.link_spread); + + return simple_read_from_buffer(ubuf, count, pos, buf, off); } =20 static ssize_t dp_link_settings_write(struct file *f, const char __user *b= uf, --=20 2.51.0