Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4dbbce0f authored by Prasad Kumpatla's avatar Prasad Kumpatla Committed by Gerrit - the friendly Code Review server
Browse files

asoc: codecs: Fix out of bounds access in register show function 



In register show function, when snprintf returns a negative value
out of bounds access occurs while copying the data to user.
Add return value check on snprintf before copy_to_user
to fix this and add sizeof() for tmp_buff to avoid buffer
overflow.

Change-Id: I15f1add37987d2176a165669d7a5b40bd576004c
Signed-off-by: default avatarPrasad Kumpatla <nkumpat@codeaurora.org>
parent 070556cb

asoc/codecs/wsa883x/wsa883x.c

+6 −1
Original line number Original line Diff line number Diff line
@@ -238,8 +238,13 @@ static ssize_t swr_slave_reg_show(struct swr_device *pdev, char __user *ubuf, 
		if (!is_swr_slave_reg_readable(i))

		if (!is_swr_slave_reg_readable(i))

			continue;

			continue;

		swr_read(pdev, pdev->dev_num, i, &reg_val, 1);

		swr_read(pdev, pdev->dev_num, i, &reg_val, 1);

		len = snprintf(tmp_buf, 25, "0x%.3x: 0x%.2x\n", i,

		len = snprintf(tmp_buf, sizeof(tmp_buf), "0x%.3x: 0x%.2x\n", i,

			       (reg_val & 0xFF));

			       (reg_val & 0xFF));

		if (len < 0) {

			pr_err("%s: fail to fill the buffer\n", __func__);

			total = -EFAULT;

			goto copy_err;

		}

		if ((total + len) >= count - 1)

		if ((total + len) >= count - 1)

			break;

			break;

		if (copy_to_user((ubuf + total), tmp_buf, len)) {

		if (copy_to_user((ubuf + total), tmp_buf, len)) {