[alsa-devel] [bug report] ALSA: x86: Flatten two abstraction layers

[Takashi Iwai]

On Tue, 07 Feb 2017 12:22:30 +0100,
Takashi Iwai wrote:
> 
> On Tue, 07 Feb 2017 11:42:03 +0100,
> Dan Carpenter wrote:
> > 
> > Hello Takashi Iwai,
> > 
> > The patch da8648097497: "ALSA: x86: Flatten two abstraction layers"
> > from Jan 31, 2017, leads to the following static checker warning:
> > 
> > 	sound/x86/intel_hdmi_audio.c:1702 hdmi_lpe_audio_probe()
> > 	error: strcpy() '"IntelHdmiLpeAudio"' too large for 'card->driver' (18 vs 16)
> > 
> > sound/x86/intel_hdmi_audio.c
> >   1695          ctx = card->private_data;
> >   1696          spin_lock_init(&ctx->had_spinlock);
> >   1697          mutex_init(&ctx->mutex);
> >   1698          ctx->connected = false;
> >   1699          ctx->dev = &pdev->dev;
> >   1700          ctx->card = card;
> >   1701          ctx->aes_bits = SNDRV_PCM_DEFAULT_CON_SPDIF;
> >   1702          strcpy(card->driver, INTEL_HAD);
> >                                      ^^^^^^^^^
> > Too long.  We're corrupting memory.  The old code was equally bad, but
> > the renaming the function made it show up as a new warning...
> > 
> >   1703          strcpy(card->shortname, INTEL_HAD);
> >   1704  
> 
> Thanks, now fixed by the patch below.

Looking at the driver module name, it's better to fit the new name
with it.  Below is the respinned patch.


Takashi

-- 8< --
From: Takashi Iwai <tiwai at suse.de>
Subject: [PATCH v2] ALSA: x86: Fix driver name string overflow

The driver sets card->driver name string over its size (16 bytes).
Shorten the name string to fit with it.

Also, set more verbose string to card->shortname and ->longname.
This doesn't have to be identical with card->driver at all.

Reported-by: Dan Carpenter <dan.carpenter at oracle.com>
Signed-off-by: Takashi Iwai <tiwai at suse.de>
---
 sound/x86/intel_hdmi_audio.c     | 3 ++-
 sound/x86/intel_hdmi_lpe_audio.h | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/sound/x86/intel_hdmi_audio.c b/sound/x86/intel_hdmi_audio.c
index 8506a3dc0298..763597c33016 100644
--- a/sound/x86/intel_hdmi_audio.c
+++ b/sound/x86/intel_hdmi_audio.c
@@ -1694,7 +1694,8 @@ static int hdmi_lpe_audio_probe(struct platform_device *pdev)
 	ctx->card = card;
 	ctx->aes_bits = SNDRV_PCM_DEFAULT_CON_SPDIF;
 	strcpy(card->driver, INTEL_HAD);
-	strcpy(card->shortname, INTEL_HAD);
+	strcpy(card->shortname, "Intel HDMI/DP LPE Audio");
+	strcpy(card->longname, "Intel HDMI/DP LPE Audio");
 
 	ctx->irq = -1;
 	ctx->tmds_clock_speed = DIS_SAMPLE_RATE_148_5;
diff --git a/sound/x86/intel_hdmi_lpe_audio.h b/sound/x86/intel_hdmi_lpe_audio.h
index ca4212dca94e..48cab1b84c7b 100644
--- a/sound/x86/intel_hdmi_lpe_audio.h
+++ b/sound/x86/intel_hdmi_lpe_audio.h
@@ -57,7 +57,7 @@
 #define HAD_REG_WIDTH		0x08
 #define HAD_MAX_HW_BUFS		0x04
 #define HAD_MAX_DIP_WORDS		16
-#define INTEL_HAD		"IntelHdmiLpeAudio"
+#define INTEL_HAD		"HdmiLpeAudio"
 
 /* DP Link Rates */
 #define DP_2_7_GHZ			270000
-- 
2.11.0