intf_name and dir are 32-byte buffers. Parsing a module-provided AIF stream name with unbounded %s conversions can cause buffer-overwrites. Limit each conversion to 31 characters.

Fixes: 60e7327d54b2 ("greybus: audio: Find data connection based on id") Cc: stable@vger.kernel.org Signed-off-by: Yudi Yang 2000jedi@gmail.com --- drivers/staging/greybus/audio_codec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/greybus/audio_codec.c b/drivers/staging/greybus/audio_codec.c index 6daa4e706792..c3fefe1414f9 100644 --- a/drivers/staging/greybus/audio_codec.c +++ b/drivers/staging/greybus/audio_codec.c @@ -311,7 +311,7 @@ int gbaudio_module_update(struct gbaudio_codec_info *codec, }

/* parse dai_id from AIF widget's stream_name */ - if (sscanf(w->sname, "%s %d %s", intf_name, &dai_id, dir) != 3) { + if (sscanf(w->sname, "%31s %d %31s", intf_name, &dai_id, dir) != 3) { dev_err(codec->dev, "Error while parsing dai_id for %s\n", w->name); return -EINVAL; }