[PATCH v3] iommu/vt-d: replace snprintf with scnprintf in dmar_latency_snapshot()

[PATCH v3] iommu/vt-d: replace snprintf with scnprintf in dmar_latency_snapshot()

[Seyediman Seyedarab]

snprintf() returns the number of bytes that would have been
written, not the number actually written. Using this for offset
tracking can cause buffer overruns if truncation occurs.

Replace snprintf() with scnprintf() to ensure the offset stays
within bounds.

Since scnprintf() never returns a negative value, and zero is not
possible in this context because 'bytes' starts at 0 and 'size - bytes'
is DEBUG_BUFFER_SIZE in the first call, which is large enough to hold
the string literals used, the return value is always positive. An integer
overflow is also completely out of reach here due to the small and
fixed buffer size. The error check in latency_show_one() is therefore
unnecessary. Remove it and make dmar_latency_snapshot() return void.

Signed-off-by: Seyediman Seyedarab <ImanDevel@gmail.com>
---
Changes in v3:
- Restored return type of dmar_latency_enable() back to 'int'. It was
  mistakenly changed to 'void' in the previous version.

Changes in v2:
- The return type of dmar_latency_snapshot() was changed based on the
  discussion here:
  https://lore.kernel.org/linux-iommu/aIDN3pvUSG3rN4SW@willie-the-truck/

 drivers/iommu/intel/debugfs.c |  8 ++------
 drivers/iommu/intel/perf.c    | 10 ++++------
 drivers/iommu/intel/perf.h    |  5 ++---
 3 files changed, 8 insertions(+), 15 deletions(-)

diff --git a/drivers/iommu/intel/debugfs.c b/drivers/iommu/intel/debugfs.c
index affbf4a1558d..c4aca0eb5e29 100644
--- a/drivers/iommu/intel/debugfs.c
+++ b/drivers/iommu/intel/debugfs.c
@@ -653,12 +653,8 @@ static void latency_show_one(struct seq_file *m, struct intel_iommu *iommu,
 	seq_printf(m, "IOMMU: %s Register Base Address: %llx\n",
 		   iommu->name, drhd->reg_base_addr);
 
-	ret = dmar_latency_snapshot(iommu, debug_buf, DEBUG_BUFFER_SIZE);
-	if (ret < 0)
-		seq_puts(m, "Failed to get latency snapshot");
-	else
-		seq_puts(m, debug_buf);
-	seq_puts(m, "\n");
+	dmar_latency_snapshot(iommu, debug_buf, DEBUG_BUFFER_SIZE);
+	seq_printf(m, "%s\n", debug_buf);
 }
 
 static int latency_show(struct seq_file *m, void *v)
diff --git a/drivers/iommu/intel/perf.c b/drivers/iommu/intel/perf.c
index adc4de6bbd88..dceeadc3ee7c 100644
--- a/drivers/iommu/intel/perf.c
+++ b/drivers/iommu/intel/perf.c
@@ -113,7 +113,7 @@ static char *latency_type_names[] = {
 	"     svm_prq"
 };
 
-int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
+void dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
 {
 	struct latency_statistic *lstat = iommu->perf_statistic;
 	unsigned long flags;
@@ -122,7 +122,7 @@ int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
 	memset(str, 0, size);
 
 	for (i = 0; i < COUNTS_NUM; i++)
-		bytes += snprintf(str + bytes, size - bytes,
+		bytes += scnprintf(str + bytes, size - bytes,
 				  "%s", latency_counter_names[i]);
 
 	spin_lock_irqsave(&latency_lock, flags);
@@ -130,7 +130,7 @@ int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
 		if (!dmar_latency_enabled(iommu, i))
 			continue;
 
-		bytes += snprintf(str + bytes, size - bytes,
+		bytes += scnprintf(str + bytes, size - bytes,
 				  "\n%s", latency_type_names[i]);
 
 		for (j = 0; j < COUNTS_NUM; j++) {
@@ -156,11 +156,9 @@ int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
 				break;
 			}
 
-			bytes += snprintf(str + bytes, size - bytes,
+			bytes += scnprintf(str + bytes, size - bytes,
 					  "%12lld", val);
 		}
 	}
 	spin_unlock_irqrestore(&latency_lock, flags);
-
-	return bytes;
 }
diff --git a/drivers/iommu/intel/perf.h b/drivers/iommu/intel/perf.h
index df9a36942d64..1d4baad7e852 100644
--- a/drivers/iommu/intel/perf.h
+++ b/drivers/iommu/intel/perf.h
@@ -40,7 +40,7 @@ void dmar_latency_disable(struct intel_iommu *iommu, enum latency_type type);
 bool dmar_latency_enabled(struct intel_iommu *iommu, enum latency_type type);
 void dmar_latency_update(struct intel_iommu *iommu, enum latency_type type,
 			 u64 latency);
-int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size);
+void dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size);
 #else
 static inline int
 dmar_latency_enable(struct intel_iommu *iommu, enum latency_type type)
@@ -64,9 +64,8 @@ dmar_latency_update(struct intel_iommu *iommu, enum latency_type type, u64 laten
 {
 }
 
-static inline int
+static inline void
 dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
 {
-	return 0;
 }
 #endif /* CONFIG_DMAR_PERF */
-- 
2.50.1

Re: [PATCH v3] iommu/vt-d: replace snprintf with scnprintf in dmar_latency_snapshot()

[kernel test robot]

Hi Seyediman,

kernel test robot noticed the following build warnings:

[auto build test WARNING on linus/master]
[also build test WARNING on v6.16 next-20250731]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Seyediman-Seyedarab/iommu-vt-d-replace-snprintf-with-scnprintf-in-dmar_latency_snapshot/20250731-045248
base:   linus/master
patch link:    https://lore.kernel.org/r/20250730205046.29719-1-ImanDevel%40gmail.com
patch subject: [PATCH v3] iommu/vt-d: replace snprintf with scnprintf in dmar_latency_snapshot()
config: i386-allmodconfig (https://download.01.org/0day-ci/archive/20250801/202508010632.WB0CM5Bz-lkp@intel.com/config)
compiler: gcc-12 (Debian 12.2.0-14+deb12u1) 12.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250801/202508010632.WB0CM5Bz-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202508010632.WB0CM5Bz-lkp@intel.com/

All warnings (new ones prefixed by >>):

   drivers/iommu/intel/debugfs.c: In function 'latency_show_one':
>> drivers/iommu/intel/debugfs.c:651:13: warning: unused variable 'ret' [-Wunused-variable]
     651 |         int ret;
         |             ^~~


vim +/ret +651 drivers/iommu/intel/debugfs.c

a6d268c619d6765 drivers/iommu/intel-iommu-debugfs.c Sohil Mehta         2018-09-11  647  
456bb0b97f00fe8 drivers/iommu/intel/debugfs.c       Lu Baolu            2021-06-10  648  static void latency_show_one(struct seq_file *m, struct intel_iommu *iommu,
456bb0b97f00fe8 drivers/iommu/intel/debugfs.c       Lu Baolu            2021-06-10  649  			     struct dmar_drhd_unit *drhd)
456bb0b97f00fe8 drivers/iommu/intel/debugfs.c       Lu Baolu            2021-06-10  650  {
456bb0b97f00fe8 drivers/iommu/intel/debugfs.c       Lu Baolu            2021-06-10 @651  	int ret;
456bb0b97f00fe8 drivers/iommu/intel/debugfs.c       Lu Baolu            2021-06-10  652  
456bb0b97f00fe8 drivers/iommu/intel/debugfs.c       Lu Baolu            2021-06-10  653  	seq_printf(m, "IOMMU: %s Register Base Address: %llx\n",
456bb0b97f00fe8 drivers/iommu/intel/debugfs.c       Lu Baolu            2021-06-10  654  		   iommu->name, drhd->reg_base_addr);
456bb0b97f00fe8 drivers/iommu/intel/debugfs.c       Lu Baolu            2021-06-10  655  
a6210a36bda1ca1 drivers/iommu/intel/debugfs.c       Seyediman Seyedarab 2025-07-30  656  	dmar_latency_snapshot(iommu, debug_buf, DEBUG_BUFFER_SIZE);
a6210a36bda1ca1 drivers/iommu/intel/debugfs.c       Seyediman Seyedarab 2025-07-30  657  	seq_printf(m, "%s\n", debug_buf);
456bb0b97f00fe8 drivers/iommu/intel/debugfs.c       Lu Baolu            2021-06-10  658  }
456bb0b97f00fe8 drivers/iommu/intel/debugfs.c       Lu Baolu            2021-06-10  659  

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki