lkml.org 
[lkml]   [2020]   [Mar]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 65/86] ASoC: pcm: Fix possible buffer overflow in dpcm state sysfs output
    Date
    From: Takashi Iwai <tiwai@suse.de>

    commit 6c89ffea60aa3b2a33ae7987de1e84bfb89e4c9e upstream.

    dpcm_show_state() invokes multiple snprintf() calls to concatenate
    formatted strings on the fixed size buffer. The usage of snprintf()
    is supposed for avoiding the buffer overflow, but it doesn't work as
    expected because snprintf() doesn't return the actual output size but
    the size to be written.

    Fix this bug by replacing all snprintf() calls with scnprintf()
    calls.

    Fixes: f86dcef87b77 ("ASoC: dpcm: Add debugFS support for DPCM")
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Acked-by: Cezary Rojewski <cezary.rojewski@intel.com>
    Link: https://lore.kernel.org/r/20200218111737.14193-4-tiwai@suse.de
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    sound/soc/soc-pcm.c | 16 ++++++++--------
    1 file changed, 8 insertions(+), 8 deletions(-)

    --- a/sound/soc/soc-pcm.c
    +++ b/sound/soc/soc-pcm.c
    @@ -3357,16 +3357,16 @@ static ssize_t dpcm_show_state(struct sn
    ssize_t offset = 0;

    /* FE state */
    - offset += snprintf(buf + offset, size - offset,
    + offset += scnprintf(buf + offset, size - offset,
    "[%s - %s]\n", fe->dai_link->name,
    stream ? "Capture" : "Playback");

    - offset += snprintf(buf + offset, size - offset, "State: %s\n",
    + offset += scnprintf(buf + offset, size - offset, "State: %s\n",
    dpcm_state_string(fe->dpcm[stream].state));

    if ((fe->dpcm[stream].state >= SND_SOC_DPCM_STATE_HW_PARAMS) &&
    (fe->dpcm[stream].state <= SND_SOC_DPCM_STATE_STOP))
    - offset += snprintf(buf + offset, size - offset,
    + offset += scnprintf(buf + offset, size - offset,
    "Hardware Params: "
    "Format = %s, Channels = %d, Rate = %d\n",
    snd_pcm_format_name(params_format(params)),
    @@ -3374,10 +3374,10 @@ static ssize_t dpcm_show_state(struct sn
    params_rate(params));

    /* BEs state */
    - offset += snprintf(buf + offset, size - offset, "Backends:\n");
    + offset += scnprintf(buf + offset, size - offset, "Backends:\n");

    if (list_empty(&fe->dpcm[stream].be_clients)) {
    - offset += snprintf(buf + offset, size - offset,
    + offset += scnprintf(buf + offset, size - offset,
    " No active DSP links\n");
    goto out;
    }
    @@ -3386,16 +3386,16 @@ static ssize_t dpcm_show_state(struct sn
    struct snd_soc_pcm_runtime *be = dpcm->be;
    params = &dpcm->hw_params;

    - offset += snprintf(buf + offset, size - offset,
    + offset += scnprintf(buf + offset, size - offset,
    "- %s\n", be->dai_link->name);

    - offset += snprintf(buf + offset, size - offset,
    + offset += scnprintf(buf + offset, size - offset,
    " State: %s\n",
    dpcm_state_string(be->dpcm[stream].state));

    if ((be->dpcm[stream].state >= SND_SOC_DPCM_STATE_HW_PARAMS) &&
    (be->dpcm[stream].state <= SND_SOC_DPCM_STATE_STOP))
    - offset += snprintf(buf + offset, size - offset,
    + offset += scnprintf(buf + offset, size - offset,
    " Hardware Params: "
    "Format = %s, Channels = %d, Rate = %d\n",
    snd_pcm_format_name(params_format(params)),

    \
     
     \ /
      Last update: 2020-03-10 14:14    [W:4.057 / U:0.268 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site