Commit 44eeb081 authored by Takashi Iwai's avatar Takashi Iwai
Browse files

ALSA: hda: Use scnprintf() for printing texts for sysfs/procfs 

Some code in HD-audio driver calls snprintf() in a loop and still
expects that the return value were actually written size, while
snprintf() returns the expected would-be length instead.  When the
given buffer limit were small, this leads to a buffer overflow.

Use scnprintf() for addressing those issues.  It returns the actually
written size unlike snprintf().

Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200218091409.27162-1-tiwai@suse.de


Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent cc5049ae

sound/hda/hdmi_chmap.c

+1 −1
Original line number Diff line number Diff line
@@ -250,7 +250,7 @@ void snd_hdac_print_channel_allocation(int spk_alloc, char *buf, int buflen) 


	for (i = 0, j = 0; i < ARRAY_SIZE(cea_speaker_allocation_names); i++) {

		if (spk_alloc & (1 << i))

			j += snprintf(buf + j, buflen - j,  " %s",

			j += scnprintf(buf + j, buflen - j,  " %s",

					cea_speaker_allocation_names[i]);

	}

	buf[j] = '\0';	/* necessary when j == 0 */

sound/pci/hda/hda_codec.c

+1 −1
Original line number Diff line number Diff line
@@ -4022,7 +4022,7 @@ void snd_print_pcm_bits(int pcm, char *buf, int buflen) 


	for (i = 0, j = 0; i < ARRAY_SIZE(bits); i++)

		if (pcm & (AC_SUPPCM_BITS_8 << i))

			j += snprintf(buf + j, buflen - j,  " %d", bits[i]);

			j += scnprintf(buf + j, buflen - j,  " %d", bits[i]);



	buf[j] = '\0'; /* necessary when j == 0 */

}

sound/pci/hda/hda_eld.c

+1 −1
Original line number Diff line number Diff line
@@ -360,7 +360,7 @@ static void hdmi_print_pcm_rates(int pcm, char *buf, int buflen) 


	for (i = 0, j = 0; i < ARRAY_SIZE(alsa_rates); i++)

		if (pcm & (1 << i))

			j += snprintf(buf + j, buflen - j,  " %d",

			j += scnprintf(buf + j, buflen - j,  " %d",

				alsa_rates[i]);



	buf[j] = '\0'; /* necessary when j == 0 */

sound/pci/hda/hda_sysfs.c

+2 −2
Original line number Diff line number Diff line
@@ -222,7 +222,7 @@ static ssize_t init_verbs_show(struct device *dev, 
	int i, len = 0;

	mutex_lock(&codec->user_mutex);

	snd_array_for_each(&codec->init_verbs, i, v) {

		len += snprintf(buf + len, PAGE_SIZE - len,

		len += scnprintf(buf + len, PAGE_SIZE - len,

				"0x%02x 0x%03x 0x%04x\n",

				v->nid, v->verb, v->param);

	}
@@ -272,7 +272,7 @@ static ssize_t hints_show(struct device *dev, 
	int i, len = 0;

	mutex_lock(&codec->user_mutex);

	snd_array_for_each(&codec->hints, i, hint) {

		len += snprintf(buf + len, PAGE_SIZE - len,

		len += scnprintf(buf + len, PAGE_SIZE - len,

				"%s = %s\n", hint->key, hint->val);

	}

	mutex_unlock(&codec->user_mutex);

CRA Git | Maintained and supported by SUSTech CRA and CCSE