ALSA: hda: Use scnprintf() for printing texts for sysfs/procfs

commit 44eeb081b8630bb3ad3cd381d1ae1831463e48bb upstream.

Some code in HD-audio driver calls snprintf() in a loop and still
expects that the return value were actually written size, while
snprintf() returns the expected would-be length instead.  When the
given buffer limit were small, this leads to a buffer overflow.

Use scnprintf() for addressing those issues.  It returns the actually
written size unlike snprintf().

Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200218091409.27162-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/sound/hda/hdmi_chmap.c b/sound/hda/hdmi_chmap.c
index f21633cd9b38ea9a8f6a3c955f9209a8f66ecf2f..acbe61b8db7b26b9fa535fb41f3845b612ac0e19 100644 (file)
--- a/sound/hda/hdmi_chmap.c
+++ b/sound/hda/hdmi_chmap.c
@@ -249,7 +249,7 @@ void snd_hdac_print_channel_allocation(int spk_alloc, char *buf, int buflen)
 
        for (i = 0, j = 0; i < ARRAY_SIZE(cea_speaker_allocation_names); i++) {
                if (spk_alloc & (1 << i))
-                       j += snprintf(buf + j, buflen - j,  " %s",
+                       j += scnprintf(buf + j, buflen - j,  " %s",
                                        cea_speaker_allocation_names[i]);
        }
        buf[j] = '\0';  /* necessary when j == 0 */

diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index 1b5e217d1bb27e8b7675c5f273fc5c1a6e5b7f0b..2ad28ce7ff49751a96b202e90546d45b8aa7530c 100644 (file)
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -4104,7 +4104,7 @@ void snd_print_pcm_bits(int pcm, char *buf, int buflen)
 
        for (i = 0, j = 0; i < ARRAY_SIZE(bits); i++)
                if (pcm & (AC_SUPPCM_BITS_8 << i))
-                       j += snprintf(buf + j, buflen - j,  " %d", bits[i]);
+                       j += scnprintf(buf + j, buflen - j,  " %d", bits[i]);
 
        buf[j] = '\0'; /* necessary when j == 0 */
 }

diff --git a/sound/pci/hda/hda_eld.c b/sound/pci/hda/hda_eld.c
index ba7fe9b6655c1f25279e5489081f34327f215d45..864cc8c9ada0ae6112445d3a6622f337067e778f 100644 (file)
--- a/sound/pci/hda/hda_eld.c
+++ b/sound/pci/hda/hda_eld.c
@@ -373,7 +373,7 @@ static void hdmi_print_pcm_rates(int pcm, char *buf, int buflen)
 
        for (i = 0, j = 0; i < ARRAY_SIZE(alsa_rates); i++)
                if (pcm & (1 << i))
-                       j += snprintf(buf + j, buflen - j,  " %d",
+                       j += scnprintf(buf + j, buflen - j,  " %d",
                                alsa_rates[i]);
 
        buf[j] = '\0'; /* necessary when j == 0 */

diff --git a/sound/pci/hda/hda_sysfs.c b/sound/pci/hda/hda_sysfs.c
index 9739fce9e032c3a2126a75b1148c21c5e3502bdd..f3ac19d33bd4df8ee773a8d34e9ec0b76be9bf60 100644 (file)
--- a/sound/pci/hda/hda_sysfs.c
+++ b/sound/pci/hda/hda_sysfs.c
@@ -221,7 +221,7 @@ static ssize_t init_verbs_show(struct device *dev,
        mutex_lock(&codec->user_mutex);
        for (i = 0; i < codec->init_verbs.used; i++) {
                struct hda_verb *v = snd_array_elem(&codec->init_verbs, i);
-               len += snprintf(buf + len, PAGE_SIZE - len,
+               len += scnprintf(buf + len, PAGE_SIZE - len,
                                "0x%02x 0x%03x 0x%04x\n",
                                v->nid, v->verb, v->param);
        }
@@ -271,7 +271,7 @@ static ssize_t hints_show(struct device *dev,
        mutex_lock(&codec->user_mutex);
        for (i = 0; i < codec->hints.used; i++) {
                struct hda_hint *hint = snd_array_elem(&codec->hints, i);
-               len += snprintf(buf + len, PAGE_SIZE - len,
+               len += scnprintf(buf + len, PAGE_SIZE - len,
                                "%s = %s\n", hint->key, hint->val);
        }
        mutex_unlock(&codec->user_mutex);