ASoC: pcm: Fix possible buffer overflow in dpcm state sysfs output

commit 914ec860269632fa30edcbc900edfea897f243b7 upstream.

dpcm_show_state() invokes multiple snprintf() calls to concatenate
formatted strings on the fixed size buffer.  The usage of snprintf()
is supposed for avoiding the buffer overflow, but it doesn't work as
expected because snprintf() doesn't return the actual output size but
the size to be written.

Fix this bug by replacing all snprintf() calls with scnprintf()
calls.

Fixes: 3af640c00582 ("ASoC: dpcm: Add debugFS support for DPCM")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Acked-by: Cezary Rojewski <cezary.rojewski@intel.com>
Link: https://lore.kernel.org/r/20200218111737.14193-4-tiwai@suse.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
index 8712a91e0e3eac964a54e019d52f82d0a935deae..d978df95c5c6560a7697667f2d94fa36a06db1e1 100644 (file)
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -3169,16 +3169,16 @@ static ssize_t dpcm_show_state(struct snd_soc_pcm_runtime *fe,
        unsigned long flags;
 
        /* FE state */
-       offset += snprintf(buf + offset, size - offset,
+       offset += scnprintf(buf + offset, size - offset,
                        "[%s - %s]\n", fe->dai_link->name,
                        stream ? "Capture" : "Playback");
 
-       offset += snprintf(buf + offset, size - offset, "State: %s\n",
+       offset += scnprintf(buf + offset, size - offset, "State: %s\n",
                        dpcm_state_string(fe->dpcm[stream].state));
 
        if ((fe->dpcm[stream].state >= SND_SOC_DPCM_STATE_HW_PARAMS) &&
            (fe->dpcm[stream].state <= SND_SOC_DPCM_STATE_STOP))
-               offset += snprintf(buf + offset, size - offset,
+               offset += scnprintf(buf + offset, size - offset,
                                "Hardware Params: "
                                "Format = %s, Channels = %d, Rate = %d\n",
                                snd_pcm_format_name(params_format(params)),
@@ -3186,10 +3186,10 @@ static ssize_t dpcm_show_state(struct snd_soc_pcm_runtime *fe,
                                params_rate(params));
 
        /* BEs state */
-       offset += snprintf(buf + offset, size - offset, "Backends:\n");
+       offset += scnprintf(buf + offset, size - offset, "Backends:\n");
 
        if (list_empty(&fe->dpcm[stream].be_clients)) {
-               offset += snprintf(buf + offset, size - offset,
+               offset += scnprintf(buf + offset, size - offset,
                                " No active DSP links\n");
                goto out;
        }
@@ -3199,16 +3199,16 @@ static ssize_t dpcm_show_state(struct snd_soc_pcm_runtime *fe,
                struct snd_soc_pcm_runtime *be = dpcm->be;
                params = &dpcm->hw_params;
 
-               offset += snprintf(buf + offset, size - offset,
+               offset += scnprintf(buf + offset, size - offset,
                                "- %s\n", be->dai_link->name);
 
-               offset += snprintf(buf + offset, size - offset,
+               offset += scnprintf(buf + offset, size - offset,
                                "   State: %s\n",
                                dpcm_state_string(be->dpcm[stream].state));
 
                if ((be->dpcm[stream].state >= SND_SOC_DPCM_STATE_HW_PARAMS) &&
                    (be->dpcm[stream].state <= SND_SOC_DPCM_STATE_STOP))
-                       offset += snprintf(buf + offset, size - offset,
+                       offset += scnprintf(buf + offset, size - offset,
                                "   Hardware Params: "
                                "Format = %s, Channels = %d, Rate = %d\n",
                                snd_pcm_format_name(params_format(params)),