[PATCH] ASoC: codecs: fs210x: fix possible buffer overflow

[PATCH] ASoC: codecs: fs210x: fix possible buffer overflow

[Alexander A. Klimov]

In fs210x_effect_scene_info(), a string was copied like this:

     strscpy(DST, SRC, strlen(SRC));

A buffer overflow would happen if strlen(SRC) > sizeof(DST).
Actually, strscpy() must be used this way:

     strscpy(DST, SRC, sizeof(DST));
     strscpy(DST, SRC); // defaults to sizeof(DST)

Fixes: 756117701779 ("ASoC: codecs: Add FourSemi FS2104/5S audio amplifier driver")
Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
---
  sound/soc/codecs/fs210x.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/codecs/fs210x.c b/sound/soc/codecs/fs210x.c
index e6195b71adad..eda716f817b5 100644
--- a/sound/soc/codecs/fs210x.c
+++ b/sound/soc/codecs/fs210x.c
@@ -968,7 +968,7 @@ static int fs210x_effect_scene_info(struct snd_kcontrol *kcontrol,
  	if (scene->name)
  		name = scene->name;

-	strscpy(uinfo->value.enumerated.name, name, strlen(name) + 1);
+	strscpy(uinfo->value.enumerated.name, name);

  	return 0;
  }
-- 
2.54.0

Re: [PATCH] ASoC: codecs: fs210x: fix possible buffer overflow

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 361 bytes --]

On Mon, May 11, 2026 at 10:35:30PM +0200, Alexander A. Klimov wrote:
> In fs210x_effect_scene_info(), a string was copied like this:
> 
>     strscpy(DST, SRC, strlen(SRC));
> 
> A buffer overflow would happen if strlen(SRC) > sizeof(DST).
> Actually, strscpy() must be used this way:

This doesn't apply against current code, please check and resend.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

[PATCH v2] ASoC: codecs: fs210x: fix possible buffer overflow

[Alexander A. Klimov]

In fs210x_effect_scene_info(), a string was copied like this:

     strscpy(DST, SRC, strlen(SRC) + 1);

A buffer overflow would happen if strlen(SRC) >= sizeof(DST).
Actually, strscpy() must be used this way:

     strscpy(DST, SRC, sizeof(DST));
     strscpy(DST, SRC); // defaults to sizeof(DST)

Fixes: 756117701779 ("ASoC: codecs: Add FourSemi FS2104/5S audio amplifier driver")
Signed-off-by: Alexander A. Klimov <grandmaster@al2klimov.de>
---
  v2: changed commit message pseudocode `strlen(SRC)` to `strlen(SRC) + 1`
  v2: changed commit message pseudocode `> sizeof(DST)` to `>= sizeof(DST)`

  Now pseudocode should apply against current code.
  The diff ITSELF already applied to Linus' master
  and broonie/sound.git HEAD.

  sound/soc/codecs/fs210x.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/codecs/fs210x.c b/sound/soc/codecs/fs210x.c
index e6195b71adad..eda716f817b5 100644
--- a/sound/soc/codecs/fs210x.c
+++ b/sound/soc/codecs/fs210x.c
@@ -968,7 +968,7 @@ static int fs210x_effect_scene_info(struct snd_kcontrol *kcontrol,
  	if (scene->name)
  		name = scene->name;

-	strscpy(uinfo->value.enumerated.name, name, strlen(name) + 1);
+	strscpy(uinfo->value.enumerated.name, name);

  	return 0;
  }
-- 
2.54.0

Re: [PATCH v2] ASoC: codecs: fs210x: fix possible buffer overflow

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 251 bytes --]

On Tue, May 12, 2026 at 09:07:15PM +0200, Alexander A. Klimov wrote:
> In fs210x_effect_scene_info(), a string was copied like this:
> 
>     strscpy(DST, SRC, strlen(SRC) + 1);

This doesn't apply against current code, please check and resend.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [PATCH v2] ASoC: codecs: fs210x: fix possible buffer overflow

[Geraldo Nascimento]

Hi Mark,

On Wed, May 13, 2026 at 10:36:32AM +0900, Mark Brown wrote:
> On Tue, May 12, 2026 at 09:07:15PM +0200, Alexander A. Klimov wrote:
> > In fs210x_effect_scene_info(), a string was copied like this:
> > 
> >     strscpy(DST, SRC, strlen(SRC) + 1);
> 
> This doesn't apply against current code, please check and resend.

Do you mean the codechange must be explicit in the commit message
instead of a generic pseudocode version?

Plus, is it acceptable to send v2 in reply to v1 like this? I'm a little
lost.

Thanks,
Geraldo Nascimento