ALSA: hda: Use scnprintf() for printing texts for sysfs/procfs
commit 44eeb081b8
upstream.
Some code in HD-audio driver calls snprintf() in a loop and still
expects that the return value were actually written size, while
snprintf() returns the expected would-be length instead. When the
given buffer limit were small, this leads to a buffer overflow.
Use scnprintf() for addressing those issues. It returns the actually
written size unlike snprintf().
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200218091409.27162-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
5.4-rM2-2.2.x-imx-squashed
parent
b76e00b67d
commit
80c1e9c4c4
|
@ -250,7 +250,7 @@ void snd_hdac_print_channel_allocation(int spk_alloc, char *buf, int buflen)
|
||||||
|
|
||||||
for (i = 0, j = 0; i < ARRAY_SIZE(cea_speaker_allocation_names); i++) {
|
for (i = 0, j = 0; i < ARRAY_SIZE(cea_speaker_allocation_names); i++) {
|
||||||
if (spk_alloc & (1 << i))
|
if (spk_alloc & (1 << i))
|
||||||
j += snprintf(buf + j, buflen - j, " %s",
|
j += scnprintf(buf + j, buflen - j, " %s",
|
||||||
cea_speaker_allocation_names[i]);
|
cea_speaker_allocation_names[i]);
|
||||||
}
|
}
|
||||||
buf[j] = '\0'; /* necessary when j == 0 */
|
buf[j] = '\0'; /* necessary when j == 0 */
|
||||||
|
|
|
@ -4019,7 +4019,7 @@ void snd_print_pcm_bits(int pcm, char *buf, int buflen)
|
||||||
|
|
||||||
for (i = 0, j = 0; i < ARRAY_SIZE(bits); i++)
|
for (i = 0, j = 0; i < ARRAY_SIZE(bits); i++)
|
||||||
if (pcm & (AC_SUPPCM_BITS_8 << i))
|
if (pcm & (AC_SUPPCM_BITS_8 << i))
|
||||||
j += snprintf(buf + j, buflen - j, " %d", bits[i]);
|
j += scnprintf(buf + j, buflen - j, " %d", bits[i]);
|
||||||
|
|
||||||
buf[j] = '\0'; /* necessary when j == 0 */
|
buf[j] = '\0'; /* necessary when j == 0 */
|
||||||
}
|
}
|
||||||
|
|
|
@ -360,7 +360,7 @@ static void hdmi_print_pcm_rates(int pcm, char *buf, int buflen)
|
||||||
|
|
||||||
for (i = 0, j = 0; i < ARRAY_SIZE(alsa_rates); i++)
|
for (i = 0, j = 0; i < ARRAY_SIZE(alsa_rates); i++)
|
||||||
if (pcm & (1 << i))
|
if (pcm & (1 << i))
|
||||||
j += snprintf(buf + j, buflen - j, " %d",
|
j += scnprintf(buf + j, buflen - j, " %d",
|
||||||
alsa_rates[i]);
|
alsa_rates[i]);
|
||||||
|
|
||||||
buf[j] = '\0'; /* necessary when j == 0 */
|
buf[j] = '\0'; /* necessary when j == 0 */
|
||||||
|
|
|
@ -222,7 +222,7 @@ static ssize_t init_verbs_show(struct device *dev,
|
||||||
int i, len = 0;
|
int i, len = 0;
|
||||||
mutex_lock(&codec->user_mutex);
|
mutex_lock(&codec->user_mutex);
|
||||||
snd_array_for_each(&codec->init_verbs, i, v) {
|
snd_array_for_each(&codec->init_verbs, i, v) {
|
||||||
len += snprintf(buf + len, PAGE_SIZE - len,
|
len += scnprintf(buf + len, PAGE_SIZE - len,
|
||||||
"0x%02x 0x%03x 0x%04x\n",
|
"0x%02x 0x%03x 0x%04x\n",
|
||||||
v->nid, v->verb, v->param);
|
v->nid, v->verb, v->param);
|
||||||
}
|
}
|
||||||
|
@ -272,7 +272,7 @@ static ssize_t hints_show(struct device *dev,
|
||||||
int i, len = 0;
|
int i, len = 0;
|
||||||
mutex_lock(&codec->user_mutex);
|
mutex_lock(&codec->user_mutex);
|
||||||
snd_array_for_each(&codec->hints, i, hint) {
|
snd_array_for_each(&codec->hints, i, hint) {
|
||||||
len += snprintf(buf + len, PAGE_SIZE - len,
|
len += scnprintf(buf + len, PAGE_SIZE - len,
|
||||||
"%s = %s\n", hint->key, hint->val);
|
"%s = %s\n", hint->key, hint->val);
|
||||||
}
|
}
|
||||||
mutex_unlock(&codec->user_mutex);
|
mutex_unlock(&codec->user_mutex);
|
||||||
|
|
Loading…
Reference in New Issue