linux-kernel - [PATCH] ALSA: core: Increase the name array size for debugfs directory name

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 12 Sep 2023 11:39:10 +0300
From:   Peter Ujfalusi <peter.ujfalusi@...ux.intel.com>
To:     tiwai@...e.com, perex@...ex.cz, arnd@...db.de
Cc:     masahiroy@...nel.org, linux-kernel@...r.kernel.org,
        alsa-devel@...a-project.org
Subject: [PATCH] ALSA: core: Increase the name array size for debugfs directory name

The idx is guarantied to be less than SNDRV_CARDS (max 256 or 8) by the
code in snd_card_init(), however the compiler does not see that.
Compiling with W=1 results:

sound/core/init.c: In function ‘snd_card_init’:
sound/core/init.c:367:28: error: ‘%d’ directive writing between 1 and 10 bytes into a region of size 4 [-Werror=format-overflow=]
  367 |         sprintf(name, "card%d", idx);
      |                            ^~
sound/core/init.c:367:23: note: directive argument in the range [0, 2147483646]
  367 |         sprintf(name, "card%d", idx);
      |                       ^~~~~~~~
sound/core/init.c:367:9: note: ‘sprintf’ output between 6 and 15 bytes into a destination of size 8
  367 |         sprintf(name, "card%d", idx);
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors

While the code is correct, we need to silence the compiler somehow.
It could be done by limiting the range in sprintf like
sprintf(name, "card%d", idx % SNDRV_CARDS);
sprintf(name, "card%hhd", idx);
etc

These are too workaroundish. Increase the name array to 15 instead which
looks better and only adds 7 bytes on stack.

The warnings got brought to light by a recent patch upstream:
commit 6d4ab2e97dcf ("extrawarn: enable format and stringop overflow warnings in W=1")

Signed-off-by: Peter Ujfalusi <peter.ujfalusi@...ux.intel.com>
---
Hi,

The mentioned commit causes other build failures with W=1 at least in
sound/usb/mixer_scarlett_gen2.c
sound/usb/mixer.c
sound/soc/codecs/hdac_hdmi.c
sound/hda/intel-sdw-acpi.c

Some of them are also false and we need to find a workaround, but
I think the scarlett case might be valid.

Regards,
Peter

 sound/core/init.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/core/init.c b/sound/core/init.c
index d61bde1225f2..d8a13a76d241 100644
--- a/sound/core/init.c
+++ b/sound/core/init.c
@@ -279,7 +279,7 @@ static int snd_card_init(struct snd_card *card, struct device *parent,
 {
 	int err;
 #ifdef CONFIG_SND_DEBUG
-	char name[8];
+	char name[15];
 #endif
 
 	if (extra_size > 0)
-- 
2.42.0