[PATCH] drm/rockchip: analogix_dp: bound endpoint name formatting

[Yudi Yang]

rockchip_dp_drm_encoder_enable() uses sprintf() to format a device tree
path into a 32-byte stack buffer. Device tree paths are not limited to
this size, so a sufficiently long path can overflow the buffer.

Use snprintf() with the destination size to truncate the generated name
and keep the writes within bounds.

Fixes: 729f8eefdcad ("drm/rockchip: analogix_dp: Add support for RK3588")
Cc: sta...@vger.kernel.org
Signed-off-by: Yudi Yang <2000j...@gmail.com>
---
 drivers/gpu/drm/rockchip/analogix_dp-rockchip.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c 
b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
index 587e60232ec7..efd5a98e80bd 100644
--- a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
+++ b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
@@ -241,10 +241,11 @@ static void rockchip_dp_drm_encoder_enable(struct 
drm_encoder *encoder,
                                of_graph_get_remote_port(endpoint.local_node);
 
                        of_property_read_u32(remote_port, "reg", &port_id);
-                       sprintf(name, "%s vp%d", remote_port_parent->full_name, 
port_id);
+                       snprintf(name, sizeof(name), "%s vp%d",
+                                remote_port_parent->full_name, port_id);
                } else {
-                       sprintf(name, "%s %s",
-                               remote_port_parent->full_name, endpoint.id ? 
"vopl" : "vopb");
+                       snprintf(name, sizeof(name), "%s %s",
+                                remote_port_parent->full_name, endpoint.id ? 
"vopl" : "vopb");
                }
 
                DRM_DEV_DEBUG(dp->dev, "vop %s output to dp\n", (ret) ? "LIT" : 
"BIG");
-- 
2.43.0