Patch "ALSA: emu10k1: Fix card shortname string buffer overflow" has been added to the 4.0-stable tree

Patch "ALSA: emu10k1: Fix card shortname string buffer overflow" has been added to the 4.0-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    ALSA: emu10k1: Fix card shortname string buffer overflow

to the 4.0-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     alsa-emu10k1-fix-card-shortname-string-buffer-overflow.patch
and it can be found in the queue-4.0 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From d02260824e2cad626fb2a9d62e27006d34b6dedc Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Mon, 27 Apr 2015 13:00:09 +0200
Subject: ALSA: emu10k1: Fix card shortname string buffer overflow

From: Takashi Iwai <tiwai@suse.de>

commit d02260824e2cad626fb2a9d62e27006d34b6dedc upstream.

Some models provide too long string for the shortname that has 32bytes
including the terminator, and it results in a non-terminated string
exposed to the user-space.  This isn't too critical, though, as the
string is stopped at the succeeding longname string.

This patch fixes such entries by dropping "SB" prefix (it's enough to
fit within 32 bytes, so far).  Meanwhile, it also changes strcpy()
with strlcpy() to make sure that this kind of problem won't happen in
future, too.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/emu10k1/emu10k1.c      |    6 ++++--
 sound/pci/emu10k1/emu10k1_main.c |    4 ++--
 2 files changed, 6 insertions(+), 4 deletions(-)

--- a/sound/pci/emu10k1/emu10k1.c
+++ b/sound/pci/emu10k1/emu10k1.c
@@ -183,8 +183,10 @@ static int snd_card_emu10k1_probe(struct
 	}
 #endif
  
-	strcpy(card->driver, emu->card_capabilities->driver);
-	strcpy(card->shortname, emu->card_capabilities->name);
+	strlcpy(card->driver, emu->card_capabilities->driver,
+		sizeof(card->driver));
+	strlcpy(card->shortname, emu->card_capabilities->name,
+		sizeof(card->shortname));
 	snprintf(card->longname, sizeof(card->longname),
 		 "%s (rev.%d, serial:0x%x) at 0x%lx, irq %i",
 		 card->shortname, emu->revision, emu->serial, emu->port, emu->irq);
--- a/sound/pci/emu10k1/emu10k1_main.c
+++ b/sound/pci/emu10k1/emu10k1_main.c
@@ -1421,7 +1421,7 @@ static struct snd_emu_chip_details emu_c
 	 *
 	 */
 	{.vendor = 0x1102, .device = 0x0008, .subsystem = 0x20011102,
-	 .driver = "Audigy2", .name = "SB Audigy 2 ZS Notebook [SB0530]",
+	 .driver = "Audigy2", .name = "Audigy 2 ZS Notebook [SB0530]",
 	 .id = "Audigy2",
 	 .emu10k2_chip = 1,
 	 .ca0108_chip = 1,
@@ -1571,7 +1571,7 @@ static struct snd_emu_chip_details emu_c
 	 .adc_1361t = 1,  /* 24 bit capture instead of 16bit */
 	 .ac97_chip = 1} ,
 	{.vendor = 0x1102, .device = 0x0004, .subsystem = 0x10051102,
-	 .driver = "Audigy2", .name = "SB Audigy 2 Platinum EX [SB0280]",
+	 .driver = "Audigy2", .name = "Audigy 2 Platinum EX [SB0280]",
 	 .id = "Audigy2",
 	 .emu10k2_chip = 1,
 	 .ca0102_chip = 1,


Patches currently in stable-queue which might be from tiwai@suse.de are

queue-4.0/alsa-emux-fix-mutex-deadlock-at-unloading.patch
queue-4.0/alsa-hda-add-mute-led-mode-control-to-thinkpad.patch
queue-4.0/alsa-emu10k1-emu10k2-32-bit-dma-mode.patch
queue-4.0/alsa-emux-fix-mutex-deadlock-in-oss-emulation.patch
queue-4.0/alsa-hda-fix-mute-led-fixed-mode.patch
queue-4.0/alsa-emu10k1-fix-card-shortname-string-buffer-overflow.patch