From 8aacfcf7abe5dbfa36841216fe4dd5e166bdada3 Mon Sep 17 00:00:00 2001
From: Aditya Bavanari <abavanar@codeaurora.org>
Date: Fri, 21 Jun 2019 15:56:39 +0530
Subject: [PATCH] asoc: codecs: Fix out of bounds access in register show
 functions

In register show functions, when snprintf returns a negative value
out of bounds access occurs while copying the data to user.
Add return value check on snprintf before copy_to_user
to fix this.

Change-Id: I1eb793721c653bf6d1fbd10f4cea3436ffe6f519
Signed-off-by: Aditya Bavanari <abavanar@codeaurora.org>
---
 asoc/codecs/wcd9xxx-core.c | 5 +++++
 asoc/codecs/wsa881x.c      | 8 +++++++-
 soc/swr-wcd-ctrl.c         | 6 ++++++
 3 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/asoc/codecs/wcd9xxx-core.c b/asoc/codecs/wcd9xxx-core.c
index fd2e933520df..9e92ae087fc4 100644
--- a/asoc/codecs/wcd9xxx-core.c
+++ b/asoc/codecs/wcd9xxx-core.c
@@ -709,6 +709,11 @@ static ssize_t wcd9xxx_slimslave_reg_show(char __user *ubuf, size_t count,
 		reg_val = wcd9xxx_interface_reg_read(debugCodec, i);
 		len = snprintf(tmp_buf, sizeof(tmp_buf),
 			"0x%.3x: 0x%.2x\n", i, reg_val);
+		if (len < 0) {
+			pr_err("%s: fail to fill the buffer\n", __func__);
+			total = -EFAULT;
+			goto copy_err;
+		}
 
 		if ((total + len) >= count - 1)
 			break;
diff --git a/asoc/codecs/wsa881x.c b/asoc/codecs/wsa881x.c
index f98de2e19373..2871ad351206 100644
--- a/asoc/codecs/wsa881x.c
+++ b/asoc/codecs/wsa881x.c
@@ -105,7 +105,7 @@ struct wsa881x_priv {
 
 #define SWR_SLV_MAX_REG_ADDR	0x390
 #define SWR_SLV_START_REG_ADDR	0x40
-#define SWR_SLV_MAX_BUF_LEN	20
+#define SWR_SLV_MAX_BUF_LEN	25
 #define BYTES_PER_LINE		12
 #define SWR_SLV_RD_BUF_LEN	8
 #define SWR_SLV_WR_BUF_LEN	32
@@ -393,6 +393,12 @@ static ssize_t wsa881x_swrslave_reg_show(char __user *ubuf, size_t count,
 			i, &reg_val, 1);
 		len = snprintf(tmp_buf, 25, "0x%.3x: 0x%.2x\n", i,
 			       (reg_val & 0xFF));
+		if (len < 0) {
+			pr_err("%s: fail to fill the buffer\n", __func__);
+			total = -EFAULT;
+			goto copy_err;
+		}
+
 		if ((total + len) >= count - 1)
 			break;
 		if (copy_to_user((ubuf + total), tmp_buf, len)) {
diff --git a/soc/swr-wcd-ctrl.c b/soc/swr-wcd-ctrl.c
index f38085f24b0d..66409f8cec91 100644
--- a/soc/swr-wcd-ctrl.c
+++ b/soc/swr-wcd-ctrl.c
@@ -265,6 +265,12 @@ static ssize_t swrm_reg_show(char __user *ubuf, size_t count,
 		i <= SWR_MSTR_MAX_REG_ADDR; i += 4) {
 		reg_val = dbgswrm->read(dbgswrm->handle, i);
 		len = snprintf(tmp_buf, 25, "0x%.3x: 0x%.2x\n", i, reg_val);
+		if (len < 0) {
+			pr_err("%s: fail to fill the buffer\n", __func__);
+			total = -EFAULT;
+			goto copy_err;
+		}
+
 		if ((total + len) >= count - 1)
 			break;
 		if (copy_to_user((ubuf + total), tmp_buf, len)) {