Received: by 2002:ac0:bc90:0:0:0:0:0 with SMTP id a16csp675414img; Fri, 22 Mar 2019 06:22:28 -0700 (PDT) X-Google-Smtp-Source: APXvYqxzc5gqDnyFscTJ9tenGf/nX6b1mM83ciupSalvtAecof9PoquhtIHhBUtSF8Ofe+gOKQpi X-Received: by 2002:a62:6444:: with SMTP id y65mr994344pfb.56.1553260948589; Fri, 22 Mar 2019 06:22:28 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1553260948; cv=none; d=google.com; s=arc-20160816; b=q3GqipEFRuHrga7ovuDFI/viRFh7PNndvroojhiPmwX6q0oMMQQKH1Xu5dhZrZTMXk UREzTS4HuitZjhkpob9xY4XkJe3Om/Nv62i27e1me6K8zLNBfRGLJCfkiCbtwBRfxiGz gzOg7+X32Kx5zPF033QqrTKbxL4aTtXqqfRT1sMKnL4sgJJUE58P5gwNMViB6Dh9EXq3 YB2/5l6CUup/IRhbiiQHw8T62Y9y5RaysWpinN3k5DMvMxIx1kwN4V389caxFFoOZ2Vl O5d75YLhjOPcLIm0VGDwAho4A9Os22zoFpyGaCEq8L2Rq4xVMZK9lBUQX5O4xG5Aczca wfHw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=gg4UobA9JuCUtcKLHuX2nd7TXvYwJyPt4uJ3la1cKxM=; b=AlSr5b6EGXkVGB9wOj0xeDL7f7VbXn8vW4pKkzm4OfVO0mPJO1kY+i3Cu3OW4Ch2rD ndlnAwmr5S8e1qwIq6YpkQ7uuEArNSj+0dgTZOJ7DXHxg9wtVEC3b96DXG3CrkFy5hr5 VTN0wD9Hu2PECeqZQJ8dwYwHH9YH9PmPYHz/muZBQJ4uPF6g4aE5GqsGTH3bHSkefxrW 4DPhCSfW4ZWaRmZvZvL27Um/LcHTpYrgEAUsIT7hGpjM9Hn6jZKgkU9Vpq1253k7Gvq5 U+Irb36uPJ0RBUv0ibY84xJ9Hs7p2FtFlIj3DGLrWQMPDJKnmSyxciKs0DvPGAMQyqdG Qjkg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b="dgKhji/a"; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id e130si6553667pfc.264.2019.03.22.06.22.11; Fri, 22 Mar 2019 06:22:28 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b="dgKhji/a"; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728499AbfCVLVB (ORCPT + 99 others); Fri, 22 Mar 2019 07:21:01 -0400 Received: from mail.kernel.org ([198.145.29.99]:47394 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727957AbfCVLU7 (ORCPT ); Fri, 22 Mar 2019 07:20:59 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 672E82190A; Fri, 22 Mar 2019 11:20:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1553253658; bh=xR1XREv1vbw5LdTB/Jo5XMaitKG3pSs8v6E2DQPrquk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dgKhji/aC+wlRyFAKlbK53yPN9zPbT9JSgKZZmpVZn0lM9rMbC75oqxgZ9EXFDuZY EmkTRijkB9uYKk2yVmWv4NpZb6BtirCS+TxmOhcA4jr+B2p3pQuOoN0lR+5wsjfOUY oa4JF1Y2LpvENf9OCPLnGPzdVDNKCRheQXu3yYQE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Silvio Cesare , Timur Tabi , Nicolin Chen , Mark Brown , Xiubo Li , Fabio Estevam , Dan Carpenter , Kees Cook , Will Deacon , Greg KH , Willy Tarreau , Sasha Levin Subject: [PATCH 3.18 032/134] ASoC: imx-audmux: change snprintf to scnprintf for possible overflow Date: Fri, 22 Mar 2019 12:14:05 +0100 Message-Id: <20190322111212.076895823@linuxfoundation.org> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190322111210.465931067@linuxfoundation.org> References: <20190322111210.465931067@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.18-stable review patch. If anyone has any objections, please let me know. ------------------ [ Upstream commit c407cd008fd039320d147088b52d0fa34ed3ddcb ] Change snprintf to scnprintf. There are generally two cases where using snprintf causes problems. 1) Uses of size += snprintf(buf, SIZE - size, fmt, ...) In this case, if snprintf would have written more characters than what the buffer size (SIZE) is, then size will end up larger than SIZE. In later uses of snprintf, SIZE - size will result in a negative number, leading to problems. Note that size might already be too large by using size = snprintf before the code reaches a case of size += snprintf. 2) If size is ultimately used as a length parameter for a copy back to user space, then it will potentially allow for a buffer overflow and information disclosure when size is greater than SIZE. When the size is used to index the buffer directly, we can have memory corruption. This also means when size = snprintf... is used, it may also cause problems since size may become large. Copying to userspace is mitigated by the HARDENED_USERCOPY kernel configuration. The solution to these issues is to use scnprintf which returns the number of characters actually written to the buffer, so the size variable will never exceed SIZE. Signed-off-by: Silvio Cesare Cc: Timur Tabi Cc: Nicolin Chen Cc: Mark Brown Cc: Xiubo Li Cc: Fabio Estevam Cc: Dan Carpenter Cc: Kees Cook Cc: Will Deacon Cc: Greg KH Signed-off-by: Willy Tarreau Acked-by: Nicolin Chen Reviewed-by: Kees Cook Signed-off-by: Mark Brown Signed-off-by: Sasha Levin --- sound/soc/fsl/imx-audmux.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/sound/soc/fsl/imx-audmux.c b/sound/soc/fsl/imx-audmux.c index 46f9beb6b273b..57d581d05de19 100644 --- a/sound/soc/fsl/imx-audmux.c +++ b/sound/soc/fsl/imx-audmux.c @@ -86,49 +86,49 @@ static ssize_t audmux_read_file(struct file *file, char __user *user_buf, if (!buf) return -ENOMEM; - ret = snprintf(buf, PAGE_SIZE, "PDCR: %08x\nPTCR: %08x\n", + ret = scnprintf(buf, PAGE_SIZE, "PDCR: %08x\nPTCR: %08x\n", pdcr, ptcr); if (ptcr & IMX_AUDMUX_V2_PTCR_TFSDIR) - ret += snprintf(buf + ret, PAGE_SIZE - ret, + ret += scnprintf(buf + ret, PAGE_SIZE - ret, "TxFS output from %s, ", audmux_port_string((ptcr >> 27) & 0x7)); else - ret += snprintf(buf + ret, PAGE_SIZE - ret, + ret += scnprintf(buf + ret, PAGE_SIZE - ret, "TxFS input, "); if (ptcr & IMX_AUDMUX_V2_PTCR_TCLKDIR) - ret += snprintf(buf + ret, PAGE_SIZE - ret, + ret += scnprintf(buf + ret, PAGE_SIZE - ret, "TxClk output from %s", audmux_port_string((ptcr >> 22) & 0x7)); else - ret += snprintf(buf + ret, PAGE_SIZE - ret, + ret += scnprintf(buf + ret, PAGE_SIZE - ret, "TxClk input"); - ret += snprintf(buf + ret, PAGE_SIZE - ret, "\n"); + ret += scnprintf(buf + ret, PAGE_SIZE - ret, "\n"); if (ptcr & IMX_AUDMUX_V2_PTCR_SYN) { - ret += snprintf(buf + ret, PAGE_SIZE - ret, + ret += scnprintf(buf + ret, PAGE_SIZE - ret, "Port is symmetric"); } else { if (ptcr & IMX_AUDMUX_V2_PTCR_RFSDIR) - ret += snprintf(buf + ret, PAGE_SIZE - ret, + ret += scnprintf(buf + ret, PAGE_SIZE - ret, "RxFS output from %s, ", audmux_port_string((ptcr >> 17) & 0x7)); else - ret += snprintf(buf + ret, PAGE_SIZE - ret, + ret += scnprintf(buf + ret, PAGE_SIZE - ret, "RxFS input, "); if (ptcr & IMX_AUDMUX_V2_PTCR_RCLKDIR) - ret += snprintf(buf + ret, PAGE_SIZE - ret, + ret += scnprintf(buf + ret, PAGE_SIZE - ret, "RxClk output from %s", audmux_port_string((ptcr >> 12) & 0x7)); else - ret += snprintf(buf + ret, PAGE_SIZE - ret, + ret += scnprintf(buf + ret, PAGE_SIZE - ret, "RxClk input"); } - ret += snprintf(buf + ret, PAGE_SIZE - ret, + ret += scnprintf(buf + ret, PAGE_SIZE - ret, "\nData received from %s\n", audmux_port_string((pdcr >> 13) & 0x7)); -- 2.19.1