[PATCH] ASoC: wm_adsp_fw_find_test: Replace strlcat() with seq_buf

[PATCH] ASoC: wm_adsp_fw_find_test: Replace strlcat() with seq_buf

[Andrey Zakharov]

strlcat() is being removed from the kernel. It runs an unbounded
strlen() on the destination, and its size argument is not tied to
the real buffer, see the issue below.

The test builds the searched_fw_files string by appending to a fixed
size buffer in two places. Use seq_buf_init_append() and
seq_buf_puts() instead. seq_buf_init_append() keeps the NUL-terminated
content already in the buffer, and seq_buf_puts() copies as much as
fits and keeps the buffer NUL-terminated if it overflows.

Tested: built with gcc 16.2.1 and ran the wm-adsp-fw-find KUnit suite
under QEMU (x86_64, kunit.py, REGMAP_BUILD): 90 of 90 tests pass, the
same as without the patch. As a negative control, changing the
separator written by the firmware request stub makes the search order
cases fail. The directory listing in the pick_file test is only used
in failure messages and is not compared with anything.

Not tested: other architectures, the case where the 768 byte buffer
overflows, and any real hardware.

Link: https://github.com/KSPP/linux/issues/370
Signed-off-by: Andrey Zakharov <dedemorow@gmail.com>
---
 sound/soc/codecs/wm_adsp_fw_find_test.c | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/sound/soc/codecs/wm_adsp_fw_find_test.c b/sound/soc/codecs/wm_adsp_fw_find_test.c
index ae686dc4fa94..2a44b2670fa9 100644
--- a/sound/soc/codecs/wm_adsp_fw_find_test.c
+++ b/sound/soc/codecs/wm_adsp_fw_find_test.c
@@ -8,6 +8,7 @@
 #include <kunit/device.h>
 #include <kunit/static_stub.h>
 #include <kunit/test.h>
+#include <linux/seq_buf.h>
 #include <linux/slab.h>
 #include "wm_adsp.h"
 
@@ -104,14 +105,15 @@ static void wm_adsp_fw_find_test_pick_file(struct kunit *test)
 	struct wm_adsp_fw_find_test *priv = test->priv;
 	const struct wm_adsp_fw_find_test_params *params = test->param_value;
 	struct wm_adsp *dsp = &priv->dsp;
+	struct seq_buf sb;
 	int i, ret;
 
 	/* Concatenate string of dir content for error messages */
+	seq_buf_init_append(&sb, priv->searched_fw_files,
+			    sizeof(priv->searched_fw_files));
 	for (i = 0; params->dir_files[i]; i++) {
-		strlcat(priv->searched_fw_files, params->dir_files[i],
-			sizeof(priv->searched_fw_files));
-		strlcat(priv->searched_fw_files, ";",
-			sizeof(priv->searched_fw_files));
+		seq_buf_puts(&sb, params->dir_files[i]);
+		seq_buf_puts(&sb, ";");
 	}
 
 	dsp->cs_dsp.name = params->dsp_name;
@@ -160,6 +162,7 @@ static int wm_adsp_fw_find_test_firmware_request_stub(const struct firmware **fi
 	struct kunit *test = kunit_get_current_test();
 	const struct wm_adsp_fw_find_test_params *params = test->param_value;
 	struct wm_adsp_fw_find_test *priv = test->priv;
+	struct seq_buf sb;
 
 	/*
 	 * Searches are accumulated as a single string of space-separated names.
@@ -168,10 +171,12 @@ static int wm_adsp_fw_find_test_firmware_request_stub(const struct firmware **fi
 	 * a simple KUNIT_EXPECT_STREQ(), which avoids the risk of bugs in a
 	 * more complex custom comparison.
 	 */
+	seq_buf_init_append(&sb, priv->searched_fw_files,
+			    sizeof(priv->searched_fw_files));
 	if (priv->searched_fw_files[0] != '\0')
-		strlcat(priv->searched_fw_files, " ", sizeof(priv->searched_fw_files));
+		seq_buf_puts(&sb, " ");
 
-	strlcat(priv->searched_fw_files, filename, sizeof(priv->searched_fw_files));
+	seq_buf_puts(&sb, filename);
 
 	/* Non-parameterized test? */
 	if (!params)
-- 
2.56.0