Unverified Commit 6c89ffea authored by Takashi Iwai's avatar Takashi Iwai Committed by Mark Brown
Browse files

ASoC: pcm: Fix possible buffer overflow in dpcm state sysfs output 



dpcm_show_state() invokes multiple snprintf() calls to concatenate
formatted strings on the fixed size buffer.  The usage of snprintf()
is supposed for avoiding the buffer overflow, but it doesn't work as
expected because snprintf() doesn't return the actual output size but
the size to be written.

Fix this bug by replacing all snprintf() calls with scnprintf()
calls.

Fixes: f86dcef8 ("ASoC: dpcm: Add debugFS support for DPCM")
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Acked-by: default avatarCezary Rojewski <cezary.rojewski@intel.com>
Link: https://lore.kernel.org/r/20200218111737.14193-4-tiwai@suse.de


Signed-off-by: default avatarMark Brown <broonie@kernel.org>
parent 549cd0ba

sound/soc/soc-pcm.c

+8 −8
Original line number Diff line number Diff line
@@ -3171,16 +3171,16 @@ static ssize_t dpcm_show_state(struct snd_soc_pcm_runtime *fe, 
	unsigned long flags;



	/* FE state */

	offset += snprintf(buf + offset, size - offset,

	offset += scnprintf(buf + offset, size - offset,

			"[%s - %s]\n", fe->dai_link->name,

			stream ? "Capture" : "Playback");



	offset += snprintf(buf + offset, size - offset, "State: %s\n",

	offset += scnprintf(buf + offset, size - offset, "State: %s\n",

	                dpcm_state_string(fe->dpcm[stream].state));



	if ((fe->dpcm[stream].state >= SND_SOC_DPCM_STATE_HW_PARAMS) &&

	    (fe->dpcm[stream].state <= SND_SOC_DPCM_STATE_STOP))

		offset += snprintf(buf + offset, size - offset,

		offset += scnprintf(buf + offset, size - offset,

				"Hardware Params: "

				"Format = %s, Channels = %d, Rate = %d\n",

				snd_pcm_format_name(params_format(params)),
@@ -3188,10 +3188,10 @@ static ssize_t dpcm_show_state(struct snd_soc_pcm_runtime *fe, 
				params_rate(params));



	/* BEs state */

	offset += snprintf(buf + offset, size - offset, "Backends:\n");

	offset += scnprintf(buf + offset, size - offset, "Backends:\n");



	if (list_empty(&fe->dpcm[stream].be_clients)) {

		offset += snprintf(buf + offset, size - offset,

		offset += scnprintf(buf + offset, size - offset,

				" No active DSP links\n");

		goto out;

	}
@@ -3201,16 +3201,16 @@ static ssize_t dpcm_show_state(struct snd_soc_pcm_runtime *fe, 
		struct snd_soc_pcm_runtime *be = dpcm->be;

		params = &dpcm->hw_params;



		offset += snprintf(buf + offset, size - offset,

		offset += scnprintf(buf + offset, size - offset,

				"- %s\n", be->dai_link->name);



		offset += snprintf(buf + offset, size - offset,

		offset += scnprintf(buf + offset, size - offset,

				"   State: %s\n",

				dpcm_state_string(be->dpcm[stream].state));



		if ((be->dpcm[stream].state >= SND_SOC_DPCM_STATE_HW_PARAMS) &&

		    (be->dpcm[stream].state <= SND_SOC_DPCM_STATE_STOP))

			offset += snprintf(buf + offset, size - offset,

			offset += scnprintf(buf + offset, size - offset,

				"   Hardware Params: "

				"Format = %s, Channels = %d, Rate = %d\n",

				snd_pcm_format_name(params_format(params)),

CRA Git | Maintained and supported by SUSTech CRA and CCSE