[alsa-devel] [bug report] ALSA: x86: Flatten two abstraction layers
Hello Takashi Iwai,
The patch da8648097497: "ALSA: x86: Flatten two abstraction layers" from Jan 31, 2017, leads to the following static checker warning:
sound/x86/intel_hdmi_audio.c:1702 hdmi_lpe_audio_probe() error: strcpy() '"IntelHdmiLpeAudio"' too large for 'card->driver' (18 vs 16)
sound/x86/intel_hdmi_audio.c 1695 ctx = card->private_data; 1696 spin_lock_init(&ctx->had_spinlock); 1697 mutex_init(&ctx->mutex); 1698 ctx->connected = false; 1699 ctx->dev = &pdev->dev; 1700 ctx->card = card; 1701 ctx->aes_bits = SNDRV_PCM_DEFAULT_CON_SPDIF; 1702 strcpy(card->driver, INTEL_HAD); ^^^^^^^^^ Too long. We're corrupting memory. The old code was equally bad, but the renaming the function made it show up as a new warning...
1703 strcpy(card->shortname, INTEL_HAD); 1704
regards, dan carpenter
On Tue, 07 Feb 2017 11:42:03 +0100, Dan Carpenter wrote:
Hello Takashi Iwai,
The patch da8648097497: "ALSA: x86: Flatten two abstraction layers" from Jan 31, 2017, leads to the following static checker warning:
sound/x86/intel_hdmi_audio.c:1702 hdmi_lpe_audio_probe() error: strcpy() '"IntelHdmiLpeAudio"' too large for 'card->driver' (18 vs 16)
sound/x86/intel_hdmi_audio.c 1695 ctx = card->private_data; 1696 spin_lock_init(&ctx->had_spinlock); 1697 mutex_init(&ctx->mutex); 1698 ctx->connected = false; 1699 ctx->dev = &pdev->dev; 1700 ctx->card = card; 1701 ctx->aes_bits = SNDRV_PCM_DEFAULT_CON_SPDIF; 1702 strcpy(card->driver, INTEL_HAD); ^^^^^^^^^ Too long. We're corrupting memory. The old code was equally bad, but the renaming the function made it show up as a new warning...
1703 strcpy(card->shortname, INTEL_HAD); 1704
Thanks, now fixed by the patch below.
Takashi
-- 8< -- From: Takashi Iwai tiwai@suse.de Subject: [PATCH] ALSA: x86: Fix driver name string overflow
The driver sets card->driver name string over its size (16 bytes). Shorten the name string to fit with it.
Also, set more verbose string to card->shortname and ->longname. This doesn't have to be identical with card->driver at all.
Reported-by: Dan Carpenter dan.carpenter@oracle.com Signed-off-by: Takashi Iwai tiwai@suse.de --- sound/x86/intel_hdmi_audio.c | 3 ++- sound/x86/intel_hdmi_lpe_audio.h | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/sound/x86/intel_hdmi_audio.c b/sound/x86/intel_hdmi_audio.c index 8506a3dc0298..763597c33016 100644 --- a/sound/x86/intel_hdmi_audio.c +++ b/sound/x86/intel_hdmi_audio.c @@ -1694,7 +1694,8 @@ static int hdmi_lpe_audio_probe(struct platform_device *pdev) ctx->card = card; ctx->aes_bits = SNDRV_PCM_DEFAULT_CON_SPDIF; strcpy(card->driver, INTEL_HAD); - strcpy(card->shortname, INTEL_HAD); + strcpy(card->shortname, "Intel LPE HDMI/DP Audio"); + strcpy(card->longname, "Intel LPE HDMI/DP Audio");
ctx->irq = -1; ctx->tmds_clock_speed = DIS_SAMPLE_RATE_148_5; diff --git a/sound/x86/intel_hdmi_lpe_audio.h b/sound/x86/intel_hdmi_lpe_audio.h index ca4212dca94e..205f7d3f4884 100644 --- a/sound/x86/intel_hdmi_lpe_audio.h +++ b/sound/x86/intel_hdmi_lpe_audio.h @@ -57,7 +57,7 @@ #define HAD_REG_WIDTH 0x08 #define HAD_MAX_HW_BUFS 0x04 #define HAD_MAX_DIP_WORDS 16 -#define INTEL_HAD "IntelHdmiLpeAudio" +#define INTEL_HAD "IntelLpeAudio"
/* DP Link Rates */ #define DP_2_7_GHZ 270000
On Tue, 07 Feb 2017 12:22:30 +0100, Takashi Iwai wrote:
On Tue, 07 Feb 2017 11:42:03 +0100, Dan Carpenter wrote:
Hello Takashi Iwai,
The patch da8648097497: "ALSA: x86: Flatten two abstraction layers" from Jan 31, 2017, leads to the following static checker warning:
sound/x86/intel_hdmi_audio.c:1702 hdmi_lpe_audio_probe() error: strcpy() '"IntelHdmiLpeAudio"' too large for 'card->driver' (18 vs 16)
sound/x86/intel_hdmi_audio.c 1695 ctx = card->private_data; 1696 spin_lock_init(&ctx->had_spinlock); 1697 mutex_init(&ctx->mutex); 1698 ctx->connected = false; 1699 ctx->dev = &pdev->dev; 1700 ctx->card = card; 1701 ctx->aes_bits = SNDRV_PCM_DEFAULT_CON_SPDIF; 1702 strcpy(card->driver, INTEL_HAD); ^^^^^^^^^ Too long. We're corrupting memory. The old code was equally bad, but the renaming the function made it show up as a new warning...
1703 strcpy(card->shortname, INTEL_HAD); 1704
Thanks, now fixed by the patch below.
Looking at the driver module name, it's better to fit the new name with it. Below is the respinned patch.
Takashi
-- 8< -- From: Takashi Iwai tiwai@suse.de Subject: [PATCH v2] ALSA: x86: Fix driver name string overflow
The driver sets card->driver name string over its size (16 bytes). Shorten the name string to fit with it.
Also, set more verbose string to card->shortname and ->longname. This doesn't have to be identical with card->driver at all.
Reported-by: Dan Carpenter dan.carpenter@oracle.com Signed-off-by: Takashi Iwai tiwai@suse.de --- sound/x86/intel_hdmi_audio.c | 3 ++- sound/x86/intel_hdmi_lpe_audio.h | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/sound/x86/intel_hdmi_audio.c b/sound/x86/intel_hdmi_audio.c index 8506a3dc0298..763597c33016 100644 --- a/sound/x86/intel_hdmi_audio.c +++ b/sound/x86/intel_hdmi_audio.c @@ -1694,7 +1694,8 @@ static int hdmi_lpe_audio_probe(struct platform_device *pdev) ctx->card = card; ctx->aes_bits = SNDRV_PCM_DEFAULT_CON_SPDIF; strcpy(card->driver, INTEL_HAD); - strcpy(card->shortname, INTEL_HAD); + strcpy(card->shortname, "Intel HDMI/DP LPE Audio"); + strcpy(card->longname, "Intel HDMI/DP LPE Audio");
ctx->irq = -1; ctx->tmds_clock_speed = DIS_SAMPLE_RATE_148_5; diff --git a/sound/x86/intel_hdmi_lpe_audio.h b/sound/x86/intel_hdmi_lpe_audio.h index ca4212dca94e..48cab1b84c7b 100644 --- a/sound/x86/intel_hdmi_lpe_audio.h +++ b/sound/x86/intel_hdmi_lpe_audio.h @@ -57,7 +57,7 @@ #define HAD_REG_WIDTH 0x08 #define HAD_MAX_HW_BUFS 0x04 #define HAD_MAX_DIP_WORDS 16 -#define INTEL_HAD "IntelHdmiLpeAudio" +#define INTEL_HAD "HdmiLpeAudio"
/* DP Link Rates */ #define DP_2_7_GHZ 270000
participants (2)
-
Dan Carpenter -
Takashi Iwai