ASoC: pcm: Fix possible buffer overflow in dpcm state sysfs output

BugLink: https://bugs.launchpad.net/bugs/1868623
commit 6c89ffea60aa3b2a33ae7987de1e84bfb89e4c9e upstream.

dpcm_show_state() invokes multiple snprintf() calls to concatenate
formatted strings on the fixed size buffer.  The usage of snprintf()
is supposed for avoiding the buffer overflow, but it doesn't work as
expected because snprintf() doesn't return the actual output size but
the size to be written.

Fix this bug by replacing all snprintf() calls with scnprintf()
calls.

Fixes: f86dcef87b77 ("ASoC: dpcm: Add debugFS support for DPCM")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Acked-by: Cezary Rojewski <cezary.rojewski@intel.com>
Link: https://lore.kernel.org/r/20200218111737.14193-4-tiwai@suse.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
index f4df6172e938d2e79a1c4a002f17cbbe7a066219..23d149b979750d810fe667948009bbb4326f8f44 100644 (file)
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -3327,16 +3327,16 @@ static ssize_t dpcm_show_state(struct snd_soc_pcm_runtime *fe,
        ssize_t offset = 0;
 
        /* FE state */
-       offset += snprintf(buf + offset, size - offset,
+       offset += scnprintf(buf + offset, size - offset,
                        "[%s - %s]\n", fe->dai_link->name,
                        stream ? "Capture" : "Playback");
 
-       offset += snprintf(buf + offset, size - offset, "State: %s\n",
+       offset += scnprintf(buf + offset, size - offset, "State: %s\n",
                        dpcm_state_string(fe->dpcm[stream].state));
 
        if ((fe->dpcm[stream].state >= SND_SOC_DPCM_STATE_HW_PARAMS) &&
            (fe->dpcm[stream].state <= SND_SOC_DPCM_STATE_STOP))
-               offset += snprintf(buf + offset, size - offset,
+               offset += scnprintf(buf + offset, size - offset,
                                "Hardware Params: "
                                "Format = %s, Channels = %d, Rate = %d\n",
                                snd_pcm_format_name(params_format(params)),
@@ -3344,10 +3344,10 @@ static ssize_t dpcm_show_state(struct snd_soc_pcm_runtime *fe,
                                params_rate(params));
 
        /* BEs state */
-       offset += snprintf(buf + offset, size - offset, "Backends:\n");
+       offset += scnprintf(buf + offset, size - offset, "Backends:\n");
 
        if (list_empty(&fe->dpcm[stream].be_clients)) {
-               offset += snprintf(buf + offset, size - offset,
+               offset += scnprintf(buf + offset, size - offset,
                                " No active DSP links\n");
                goto out;
        }
@@ -3356,16 +3356,16 @@ static ssize_t dpcm_show_state(struct snd_soc_pcm_runtime *fe,
                struct snd_soc_pcm_runtime *be = dpcm->be;
                params = &dpcm->hw_params;
 
-               offset += snprintf(buf + offset, size - offset,
+               offset += scnprintf(buf + offset, size - offset,
                                "- %s\n", be->dai_link->name);
 
-               offset += snprintf(buf + offset, size - offset,
+               offset += scnprintf(buf + offset, size - offset,
                                "   State: %s\n",
                                dpcm_state_string(be->dpcm[stream].state));
 
                if ((be->dpcm[stream].state >= SND_SOC_DPCM_STATE_HW_PARAMS) &&
                    (be->dpcm[stream].state <= SND_SOC_DPCM_STATE_STOP))
-                       offset += snprintf(buf + offset, size - offset,
+                       offset += scnprintf(buf + offset, size - offset,
                                "   Hardware Params: "
                                "Format = %s, Channels = %d, Rate = %d\n",
                                snd_pcm_format_name(params_format(params)),