| From 6c89ffea60aa3b2a33ae7987de1e84bfb89e4c9e Mon Sep 17 00:00:00 2001 |
| From: Takashi Iwai <tiwai@suse.de> |
| Date: Tue, 18 Feb 2020 12:17:37 +0100 |
| Subject: ASoC: pcm: Fix possible buffer overflow in dpcm state sysfs output |
| |
| From: Takashi Iwai <tiwai@suse.de> |
| |
| commit 6c89ffea60aa3b2a33ae7987de1e84bfb89e4c9e upstream. |
| |
| dpcm_show_state() invokes multiple snprintf() calls to concatenate |
| formatted strings on the fixed size buffer. The usage of snprintf() |
| is supposed for avoiding the buffer overflow, but it doesn't work as |
| expected because snprintf() doesn't return the actual output size but |
| the size to be written. |
| |
| Fix this bug by replacing all snprintf() calls with scnprintf() |
| calls. |
| |
| Fixes: f86dcef87b77 ("ASoC: dpcm: Add debugFS support for DPCM") |
| Signed-off-by: Takashi Iwai <tiwai@suse.de> |
| Acked-by: Cezary Rojewski <cezary.rojewski@intel.com> |
| Link: https://lore.kernel.org/r/20200218111737.14193-4-tiwai@suse.de |
| Signed-off-by: Mark Brown <broonie@kernel.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| sound/soc/soc-pcm.c | 16 ++++++++-------- |
| 1 file changed, 8 insertions(+), 8 deletions(-) |
| |
| --- a/sound/soc/soc-pcm.c |
| +++ b/sound/soc/soc-pcm.c |
| @@ -3192,16 +3192,16 @@ static ssize_t dpcm_show_state(struct sn |
| unsigned long flags; |
| |
| /* FE state */ |
| - offset += snprintf(buf + offset, size - offset, |
| + offset += scnprintf(buf + offset, size - offset, |
| "[%s - %s]\n", fe->dai_link->name, |
| stream ? "Capture" : "Playback"); |
| |
| - offset += snprintf(buf + offset, size - offset, "State: %s\n", |
| + offset += scnprintf(buf + offset, size - offset, "State: %s\n", |
| dpcm_state_string(fe->dpcm[stream].state)); |
| |
| if ((fe->dpcm[stream].state >= SND_SOC_DPCM_STATE_HW_PARAMS) && |
| (fe->dpcm[stream].state <= SND_SOC_DPCM_STATE_STOP)) |
| - offset += snprintf(buf + offset, size - offset, |
| + offset += scnprintf(buf + offset, size - offset, |
| "Hardware Params: " |
| "Format = %s, Channels = %d, Rate = %d\n", |
| snd_pcm_format_name(params_format(params)), |
| @@ -3209,10 +3209,10 @@ static ssize_t dpcm_show_state(struct sn |
| params_rate(params)); |
| |
| /* BEs state */ |
| - offset += snprintf(buf + offset, size - offset, "Backends:\n"); |
| + offset += scnprintf(buf + offset, size - offset, "Backends:\n"); |
| |
| if (list_empty(&fe->dpcm[stream].be_clients)) { |
| - offset += snprintf(buf + offset, size - offset, |
| + offset += scnprintf(buf + offset, size - offset, |
| " No active DSP links\n"); |
| goto out; |
| } |
| @@ -3222,16 +3222,16 @@ static ssize_t dpcm_show_state(struct sn |
| struct snd_soc_pcm_runtime *be = dpcm->be; |
| params = &dpcm->hw_params; |
| |
| - offset += snprintf(buf + offset, size - offset, |
| + offset += scnprintf(buf + offset, size - offset, |
| "- %s\n", be->dai_link->name); |
| |
| - offset += snprintf(buf + offset, size - offset, |
| + offset += scnprintf(buf + offset, size - offset, |
| " State: %s\n", |
| dpcm_state_string(be->dpcm[stream].state)); |
| |
| if ((be->dpcm[stream].state >= SND_SOC_DPCM_STATE_HW_PARAMS) && |
| (be->dpcm[stream].state <= SND_SOC_DPCM_STATE_STOP)) |
| - offset += snprintf(buf + offset, size - offset, |
| + offset += scnprintf(buf + offset, size - offset, |
| " Hardware Params: " |
| "Format = %s, Channels = %d, Rate = %d\n", |
| snd_pcm_format_name(params_format(params)), |