ASoC: intel: skl: Fix possible buffer overflow in debug outputs

commit 549cd0ba04dcfe340c349cd983bd440480fae8ee upstream.

The debugfs output of intel skl driver writes strings with multiple
snprintf() calls with the fixed size.  This was supposed to avoid the
buffer overflow but actually it still would, because snprintf()
returns the expected size to be output, not the actual output size.

Fix it by replacing snprintf() calls with scnprintf().

Fixes: d14700a01f91 ("ASoC: Intel: Skylake: Debugfs facility to dump module config")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Acked-by: Cezary Rojewski <cezary.rojewski@intel.com>
Link: https://lore.kernel.org/r/20200218111737.14193-3-tiwai@suse.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/sound/soc/intel/skylake/skl-debug.c b/sound/soc/intel/skylake/skl-debug.c
index 9e38f2afa084536d095f060505bb95610506a895..71c6bbf37b6c8e72e56da771ad0598e4925ef839 100644 (file)
--- a/sound/soc/intel/skylake/skl-debug.c
+++ b/sound/soc/intel/skylake/skl-debug.c
@@ -43,7 +43,7 @@ static ssize_t skl_print_pins(struct skl_module_pin *m_pin, char *buf,
        ssize_t ret = 0;
 
        for (i = 0; i < max_pin; i++) {
-               ret += snprintf(buf + size, MOD_BUF - size,
+               ret += scnprintf(buf + size, MOD_BUF - size,
                                "%s %d\n\tModule %d\n\tInstance %d\n\t"
                                "In-used %s\n\tType %s\n"
                                "\tState %d\n\tIndex %d\n",
@@ -61,7 +61,7 @@ static ssize_t skl_print_pins(struct skl_module_pin *m_pin, char *buf,
 static ssize_t skl_print_fmt(struct skl_module_fmt *fmt, char *buf,
                                        ssize_t size, bool direction)
 {
-       return snprintf(buf + size, MOD_BUF - size,
+       return scnprintf(buf + size, MOD_BUF - size,
                        "%s\n\tCh %d\n\tFreq %d\n\tBit depth %d\n\t"
                        "Valid bit depth %d\n\tCh config %#x\n\tInterleaving %d\n\t"
                        "Sample Type %d\n\tCh Map %#x\n",
@@ -83,16 +83,16 @@ static ssize_t module_read(struct file *file, char __user *user_buf,
        if (!buf)
                return -ENOMEM;
 
-       ret = snprintf(buf, MOD_BUF, "Module:\n\tUUID %pUL\n\tModule id %d\n"
+       ret = scnprintf(buf, MOD_BUF, "Module:\n\tUUID %pUL\n\tModule id %d\n"
                        "\tInstance id %d\n\tPvt_id %d\n", mconfig->guid,
                        mconfig->id.module_id, mconfig->id.instance_id,
                        mconfig->id.pvt_id);
 
-       ret += snprintf(buf + ret, MOD_BUF - ret,
+       ret += scnprintf(buf + ret, MOD_BUF - ret,
                        "Resources:\n\tMCPS %#x\n\tIBS %#x\n\tOBS %#x\t\n",
                        mconfig->mcps, mconfig->ibs, mconfig->obs);
 
-       ret += snprintf(buf + ret, MOD_BUF - ret,
+       ret += scnprintf(buf + ret, MOD_BUF - ret,
                        "Module data:\n\tCore %d\n\tIn queue %d\n\t"
                        "Out queue %d\n\tType %s\n",
                        mconfig->core_id, mconfig->max_in_queue,
@@ -102,38 +102,38 @@ static ssize_t module_read(struct file *file, char __user *user_buf,
        ret += skl_print_fmt(mconfig->in_fmt, buf, ret, true);
        ret += skl_print_fmt(mconfig->out_fmt, buf, ret, false);
 
-       ret += snprintf(buf + ret, MOD_BUF - ret,
+       ret += scnprintf(buf + ret, MOD_BUF - ret,
                        "Fixup:\n\tParams %#x\n\tConverter %#x\n",
                        mconfig->params_fixup, mconfig->converter);
 
-       ret += snprintf(buf + ret, MOD_BUF - ret,
+       ret += scnprintf(buf + ret, MOD_BUF - ret,
                        "Module Gateway:\n\tType %#x\n\tVbus %#x\n\tHW conn %#x\n\tSlot %#x\n",
                        mconfig->dev_type, mconfig->vbus_id,
                        mconfig->hw_conn_type, mconfig->time_slot);
 
-       ret += snprintf(buf + ret, MOD_BUF - ret,
+       ret += scnprintf(buf + ret, MOD_BUF - ret,
                        "Pipeline:\n\tID %d\n\tPriority %d\n\tConn Type %d\n\t"
                        "Pages %#x\n", mconfig->pipe->ppl_id,
                        mconfig->pipe->pipe_priority, mconfig->pipe->conn_type,
                        mconfig->pipe->memory_pages);
 
-       ret += snprintf(buf + ret, MOD_BUF - ret,
+       ret += scnprintf(buf + ret, MOD_BUF - ret,
                        "\tParams:\n\t\tHost DMA %d\n\t\tLink DMA %d\n",
                        mconfig->pipe->p_params->host_dma_id,
                        mconfig->pipe->p_params->link_dma_id);
 
-       ret += snprintf(buf + ret, MOD_BUF - ret,
+       ret += scnprintf(buf + ret, MOD_BUF - ret,
                        "\tPCM params:\n\t\tCh %d\n\t\tFreq %d\n\t\tFormat %d\n",
                        mconfig->pipe->p_params->ch,
                        mconfig->pipe->p_params->s_freq,
                        mconfig->pipe->p_params->s_fmt);
 
-       ret += snprintf(buf + ret, MOD_BUF - ret,
+       ret += scnprintf(buf + ret, MOD_BUF - ret,
                        "\tLink %#x\n\tStream %#x\n",
                        mconfig->pipe->p_params->linktype,
                        mconfig->pipe->p_params->stream);
 
-       ret += snprintf(buf + ret, MOD_BUF - ret,
+       ret += scnprintf(buf + ret, MOD_BUF - ret,
                        "\tState %d\n\tPassthru %s\n",
                        mconfig->pipe->state,
                        mconfig->pipe->passthru ? "true" : "false");
@@ -143,7 +143,7 @@ static ssize_t module_read(struct file *file, char __user *user_buf,
        ret += skl_print_pins(mconfig->m_out_pin, buf,
                        mconfig->max_out_queue, ret, false);
 
-       ret += snprintf(buf + ret, MOD_BUF - ret,
+       ret += scnprintf(buf + ret, MOD_BUF - ret,
                        "Other:\n\tDomain %d\n\tHomogenous Input %s\n\t"
                        "Homogenous Output %s\n\tIn Queue Mask %d\n\t"
                        "Out Queue Mask %d\n\tDMA ID %d\n\tMem Pages %d\n\t"
@@ -201,7 +201,7 @@ static ssize_t fw_softreg_read(struct file *file, char __user *user_buf,
                __ioread32_copy(d->fw_read_buff, fw_reg_addr, w0_stat_sz >> 2);
 
        for (offset = 0; offset < FW_REG_SIZE; offset += 16) {
-               ret += snprintf(tmp + ret, FW_REG_BUF - ret, "%#.4x: ", offset);
+               ret += scnprintf(tmp + ret, FW_REG_BUF - ret, "%#.4x: ", offset);
                hex_dump_to_buffer(d->fw_read_buff + offset, 16, 16, 4,
                                   tmp + ret, FW_REG_BUF - ret, 0);
                ret += strlen(tmp + ret);