Re: [PATCH 10/11] perf tools: Use scnprintf() in build_id__snprintf() and hwmon read_events()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] The early termination condition `offs < bf_size` is rendered ineffective by the switch to `scnprintf`.
--

commit 0dbaa7b9065f01d9d8a6117248bffa97b3021ddf
Author: Arnaldo Carvalho de Melo <acme@redhat.com>

perf tools: Use scnprintf() in build_id__snprintf() and hwmon read_events()

This commit replaces snprintf() with scnprintf() in build_id__snprintf()
and hwmon_pmu__describe_items() to prevent accumulated lengths from exceeding
the allocated buffer size and underflowing the remaining size.

> diff --git a/tools/perf/util/build-id.c b/tools/perf/util/build-id.c
> index 8c0a9ae932aa5..a3b92108f9626 100644
> --- a/tools/perf/util/build-id.c
> +++ b/tools/perf/util/build-id.c
> @@ -94,7 +94,7 @@ int build_id__snprintf(const struct build_id *build_id, char *bf, size_t bf_size
>  	}
>  
>  	for (size_t i = 0; i < build_id->size && offs < bf_size; ++i)
> -		offs += snprintf(bf + offs, bf_size - offs, "%02x", build_id->data[i]);
> +		offs += scnprintf(bf + offs, bf_size - offs, "%02x", build_id->data[i]);

[Severity: Low]
Does this change neutralize the early termination condition in the loop?

Since scnprintf() returns the number of characters written excluding the null
terminator, `offs` will reach at most `bf_size - 1` and never equals `bf_size`.

Once the buffer is full (`bf_size - offs == 1`), scnprintf() will only write a
null terminator, returning 0. Because `offs` stops increasing, the condition
`offs < bf_size` remains true. This causes the loop to continue writing nothing
for the remaining `build_id->size` iterations instead of exiting early.

>  
>  	return offs;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260608201753.1979464-1-acme@kernel.org?part=10