From: Christophe JAILLET Date: Sat, 23 Mar 2024 06:57:03 +0000 (+0100) Subject: usb: gadget: u_audio: Fix the size of a buffer in a strscpy() call X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=16fac242177c5eb374bb2caacc28793732857369;p=linux.git usb: gadget: u_audio: Fix the size of a buffer in a strscpy() call The size given to strscpy() is not consistent with the destination buffer that is used. The size is related to 'driver' and the buffer is 'mixername'. sizeof(card->mixername) is 80 and sizeof(card->driver) is 16, so in theory this could lead to unneeded string truncation. In practice, this is not the case because g_audio_setup() has only 2 callers. 'card_name' is either "UAC1_Gadget" or "UAC2_Gadget". Anyway, using the correct size is cleaner and more future proof. In order to be less verbose, use the new 2-argument version of strscpy() which computes auto-magically the size of the destination. Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/bf8a9353319566624f653531b80e5caf3d346ba1.1711176700.git.christophe.jaillet@wanadoo.fr Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c index 4a42574b4a7fe..00ff623b4ebb5 100644 --- a/drivers/usb/gadget/function/u_audio.c +++ b/drivers/usb/gadget/function/u_audio.c @@ -1257,7 +1257,7 @@ int g_audio_setup(struct g_audio *g_audio, const char *pcm_name, if ((c_chmask && g_audio->in_ep_fback) || (p_chmask && params->p_fu.id) || (c_chmask && params->c_fu.id)) - strscpy(card->mixername, card_name, sizeof(card->driver)); + strscpy(card->mixername, card_name); if (c_chmask && g_audio->in_ep_fback) { kctl = snd_ctl_new1(&u_audio_controls[UAC_FBACK_CTRL],