From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793699706; b=skDTOamnv1xBJpOQY4PmgD3DkaNnPkENWqUeW5yktK8ZRrewtfq6gOCy02WOsEGrLsjn zLuOFucQPry4VVyZQWAIanyA9xQINKawgB0nkU8CE+k07iC2zAxHoqBp3yH785SdSD5Yp isrTm98s7Qsd8hXHPw1X4DVp6ltTDe3FM0nNL31OzTuiAmXVq0ZsP605+rdsKy58cYK/T +zBiYC8fYfWIc6A8Ocg1ywFYJHKISwUx+0ADIsWcWp75sT2wYnlew+auDZXvFq1lEPMoO avgWeRiy5hiwV7xiTQ/i5128r/iDaMZwwWCgMYEDjZYqVO/dvXXSJso7Ctb1pAR3Xww== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793699706; h=Received:DKIM-Signature:From:To:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:MIME-Version:Content-Transfer-Encoding; bh=SjvoufU53YipE1rwywIAKoeshFADyLF0Pz/wwifWPLc=; b=dDt8ZsNXcHtCg+E1+vzmeHPIcadY9c69iZoW9oirCLfU34n4L0V9NrDh6en1nx9gyU93 eyZm/hiO4c44dcjVnZW5AQIchN7AtQEFdaBvZ/nTnQdYLsvqADaMyFj2WY0iwB0dfv87y sqd5tys303Jsbn0DITzQxmUxhW8agmEBq0gFcxymRDUmLc6CE/K7B0Y9ZT26ZJJWbWLfz Pa0SKOWw6eM8W67kPBkzAaWSl1ZKH/onnFxwMnNkFS1nO7NdqF+XrqakHPaYFlHtQoO6F aAyMfEdGGjPtrKe8vw4zcS/+QBE3cTWC1H3LRxXlc33LYd53AO4CwDewAQGkoui6jbw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=ipAf4aQx; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 89EF7606EEBD; Tue, 3 Nov 2026 09:55:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=ipAf4aQx Received: by smtp.kernel.org (Postfix) with ESMTPSA id 08DFB1F000C1; Tue, 3 Nov 2026 09:55:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1793699706; bh=SjvoufU53YipE1rwywIAKoeshFADyLF0Pz/wwifWPLc=; h=From:To:Subject:Date:In-Reply-To:References; b=ipAf4aQxmwFJ6JQpkH2dW3va5wADsnlLaKSf3YIirnl1+7RTxxy+7bfrn1rwdv+PW Lk2QQsFQnSAC6mGHL1W0RrmskUBZrNbdlioy7QkLXrjVb5gKzQA3U6/41UBWcyMfZP MGKRncKc9INgH6itXj5ZA6tes6jkpWB6eVBM5hvFxhJGLjdT3lBDzTViCwoRvvmVuw GSdjCb9ZZr5I15xthWutzxdfoQAvhzKUP/Eg6VqSnaoUX10E1w+loqKTmhA1Zx9hZc zNC9vnnWJwyY0G1vUfL2KmhS2kN0P7cHsGAz21okI8xqw+12yorO+gIz2jlw1rTlDb TBpFoaLprfv3g== From: Lee Jones To: lee@kernel.org, Vinod Koul , Bard Liao , Pierre-Louis Bossart , linux-sound@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 02/10] soundwire: sysfs: Use sysfs_emit_at() in array show callbacks Date: Tue, 3 Nov 2026 09:53:46 +0000 Message-ID: <20261103095445.81414-3-lee@kernel.org> X-Mailer: git-send-email 2.56.0.385.gac671c819a-goog In-Reply-To: <20261103095445.81414-1-lee@kernel.org> References: <20261103095445.81414-1-lee@kernel.org> X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit words_show() and the show callbacks generated by sdw_dpn_array_attr() format firmware-supplied property arrays into the sysfs buffer using unbounded sprintf(buf + size, ...) loops. If firmware provides a large array count, sprintf() can write past PAGE_SIZE and corrupt kernel memory. Replace the sprintf(buf + size, ...) calls with bounds-checked sysfs_emit_at() calls. Closes: https://sashiko.dev/#/bug/linux-543ff498-3bed-412d-8972-4855c5aa6008 Signed-off-by: Lee Jones --- v1 => v2: Drop Fixes and Stable tags drivers/soundwire/sysfs_slave.c | 6 +++--- drivers/soundwire/sysfs_slave_dpn.c | 8 ++++---- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/drivers/soundwire/sysfs_slave.c b/drivers/soundwire/sysfs_slave.c index a2ee064147e0..35272cfe9fc8 100644 --- a/drivers/soundwire/sysfs_slave.c +++ b/drivers/soundwire/sysfs_slave.c @@ -161,9 +161,9 @@ static ssize_t words_show(struct device *dev, int i; for (i = 0; i < slave->prop.dp0_prop->num_words; i++) - size += sprintf(buf + size, "%d ", - slave->prop.dp0_prop->words[i]); - size += sprintf(buf + size, "\n"); + size += sysfs_emit_at(buf, size, "%d ", + slave->prop.dp0_prop->words[i]); + size += sysfs_emit_at(buf, size, "\n"); return size; } diff --git a/drivers/soundwire/sysfs_slave_dpn.c b/drivers/soundwire/sysfs_slave_dpn.c index d2561400da77..16872ea64b1f 100644 --- a/drivers/soundwire/sysfs_slave_dpn.c +++ b/drivers/soundwire/sysfs_slave_dpn.c @@ -134,10 +134,10 @@ static ssize_t field##_dpn_show(struct sdw_slave *slave, \ for_each_set_bit(bit, &mask, 32) { \ if (bit == N) { \ for (j = 0; j < dpn[i].num_##field; j++) \ - size += sprintf(buf + size, \ - format_string, \ - dpn[i].field[j]); \ - size += sprintf(buf + size, "\n"); \ + size += sysfs_emit_at(buf, size, \ + format_string, \ + dpn[i].field[j]); \ + size += sysfs_emit_at(buf, size, "\n"); \ return size; \ } \ i++; \ -- 2.56.0.385.gac671c819a-goog