drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()

snprintf() returns the number of characters that *would* have been
written, which can overestimate how much you actually wrote to the
buffer in case of truncation. That leads to 'data += this' advancing
the pointer past the end of the buffer and size going negative.

Switching to scnprintf() prevents potential buffer overflows and ensures
consistent behavior when building the output string.

Signed-off-by: Seyediman Seyedarab <ImanDevel@gmail.com>
Link: https://lore.kernel.org/r/20250724195913.60742-1-ImanDevel@gmail.com
Signed-off-by: Danilo Krummrich <dakr@kernel.org>

diff --git a/drivers/gpu/drm/nouveau/nvkm/core/enum.c b/drivers/gpu/drm/nouveau/nvkm/core/enum.c
index b9581feb24ccb722727c981485ed7e8b9489b5e8..a23b40b27b81bc0b8e909aae870ed438596910d9 100644 (file)
--- a/drivers/gpu/drm/nouveau/nvkm/core/enum.c
+++ b/drivers/gpu/drm/nouveau/nvkm/core/enum.c
@@ -44,7 +44,7 @@ nvkm_snprintbf(char *data, int size, const struct nvkm_bitfield *bf, u32 value)
        bool space = false;
        while (size >= 1 && bf->name) {
                if (value & bf->mask) {
-                       int this = snprintf(data, size, "%s%s",
+                       int this = scnprintf(data, size, "%s%s",
                                            space ? " " : "", bf->name);
                        size -= this;
                        data += this;