The current implementation will leak a byte to the log via memmove. The specified 27 bytes are off-by-one, as the payload is 25 bytes, and the termination character is only one byte large. To avoid this, factor out the error message, and furthermore make the second parameter of the append_entry function const.
The full trace is as follows:
In function ‘memmove’, from ‘append_entry’ at drivers/gpu/drm/amd/display/dc/basics/logger.c:257:2, from ‘dm_logger_append_va’ at drivers/gpu/drm/amd/display/dc/basics/logger.c:348:4 detected read beyond size of object passed as 2nd parameter
Signed-off-by: Norbert Manthey nmanthey@amazon.de --- drivers/gpu/drm/amd/display/dc/basics/logger.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/basics/logger.c b/drivers/gpu/drm/amd/display/dc/basics/logger.c index 31bee05..6ba8d0c 100644 --- a/drivers/gpu/drm/amd/display/dc/basics/logger.c +++ b/drivers/gpu/drm/amd/display/dc/basics/logger.c @@ -244,7 +244,7 @@ static void log_heading(struct log_entry *entry)
static void append_entry( struct log_entry *entry, - char *buffer, + const char *buffer, uint32_t buf_size) { if (!entry->buf || @@ -346,7 +346,9 @@ void dm_logger_append_va( if (size < LOG_MAX_LINE_SIZE - 1) { append_entry(entry, buffer, size); } else { - append_entry(entry, "LOG_ERROR, line too long\n", 27); + static const char msg[] = "LOG_ERROR, line too long\n"; + + append_entry(entry, msg, sizeof(msg)); } } }