[PATCH] soundwire: master: use sysfs_emit_at() to avoid sysfs buffer overflow

[PATCH] soundwire: master: use sysfs_emit_at() to avoid sysfs buffer overflow

[Weigang He]

clock_frequencies_show() and clock_gears_show() loop over num_clk_freq /
num_clk_gears, writing each entry into the sysfs output buffer with
sprintf(buf + size, ...) without bounding the running offset against
PAGE_SIZE. Both counts are taken from firmware-supplied properties
(parsed in mipi_disco.c via fwnode_property_count_u32()) and are not
otherwise capped, so a device whose firmware advertises a large enough
array overflows the single-page sysfs buffer.

Switch both loops to sysfs_emit_at(), which bounds each write to the
PAGE_SIZE buffer.

Found by static analysis tool CodeQL.

Fixes: c5778ca49a194 ("soundwire: master: add sysfs support")
Assisted-by: LLM codeql
Signed-off-by: Weigang He <geoffreyhe2@gmail.com>
---

Notes:
    Compile-tested only (ARCH=arm64 and ARCH=x86_64 allmodconfig, W=1). Not
    tested on hardware, and there is no reproducer.
    
    The CodeQL query behind this report was synthesized with LLM assistance,
    and the fix and changelog were drafted with LLM assistance; I have
    reviewed them.

 drivers/soundwire/master.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/soundwire/master.c b/drivers/soundwire/master.c
index 440bfc52ccba5..fb1ef2210732d 100644
--- a/drivers/soundwire/master.c
+++ b/drivers/soundwire/master.c
@@ -61,9 +61,9 @@ static ssize_t clock_frequencies_show(struct device *dev,
 	int i;
 
 	for (i = 0; i < md->bus->prop.num_clk_freq; i++)
-		size += sprintf(buf + size, "%8d ",
-				md->bus->prop.clk_freq[i]);
-	size += sprintf(buf + size, "\n");
+		size += sysfs_emit_at(buf, size, "%8d ",
+				      md->bus->prop.clk_freq[i]);
+	size += sysfs_emit_at(buf, size, "\n");
 
 	return size;
 }
@@ -77,9 +77,9 @@ static ssize_t clock_gears_show(struct device *dev,
 	int i;
 
 	for (i = 0; i < md->bus->prop.num_clk_gears; i++)
-		size += sprintf(buf + size, "%8d ",
-				md->bus->prop.clk_gears[i]);
-	size += sprintf(buf + size, "\n");
+		size += sysfs_emit_at(buf, size, "%8d ",
+				      md->bus->prop.clk_gears[i]);
+	size += sysfs_emit_at(buf, size, "\n");
 
 	return size;
 }

base-commit: 165768bb70265b5c38cf0b73fafd75be235f8b14
prerequisite-patch-id: c5a3be8688fd8e88a00352acb1374e91fcb52a03
prerequisite-patch-id: 67693e2c08624df0841619cc085ce9200f4385fc
prerequisite-patch-id: f3d73f7c19be7e952aa8061303f53f9a08576a88
prerequisite-patch-id: 541e578709d048f4c8115f1d926be2f2c03ecb0e
prerequisite-patch-id: f23f8e0693435497645805822d98a92e57fb46f3
prerequisite-patch-id: eae82895db8ba67018a777a91a283ad6bc4a55b2
prerequisite-patch-id: aed00f7502865e3f9262959d828eae4a4021108f
prerequisite-patch-id: 4cd2054e4973f2ed050d71e0ad73147165913916
-- 
2.43.0