linux-stable/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
Juerg Haefliger 4964a43006 staging: bcm2835-audio: Replace unsafe strcpy() with strscpy()
Replace strcpy() with strscpy() in bcm2835-audio/bcm2835.c to prevent the
following when loading snd-bcm2835:

[   58.480634] ------------[ cut here ]------------
[   58.485321] kernel BUG at lib/string.c:1149!
[   58.489650] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
[   58.495214] Modules linked in: snd_bcm2835(COE+) snd_pcm snd_timer snd dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua btsdio bluetooth ecdh_generic ecc bcm2835_v4l2(CE) bcm2835_codec(CE) brcmfmac bcm2835_isp(CE) bcm2835_mmal_vchiq(CE) brcmutil cfg80211 v4l2_mem2mem videobuf2_vmalloc videobuf2_dma_contig videobuf2_memops raspberrypi_hwmon videobuf2_v4l2 videobuf2_common videodev bcm2835_gpiomem mc vc_sm_cma(CE) rpivid_mem uio_pdrv_genirq uio sch_fq_codel drm ip_tables x_tables autofs4 btrfs blake2b_generic raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor xor_neon raid6_pq libcrc32c raid1 raid0 multipath linear dwc2 roles spidev udc_core crct10dif_ce xhci_pci xhci_pci_renesas phy_generic aes_neon_bs aes_neon_blk crypto_simd cryptd
[   58.563787] CPU: 3 PID: 1959 Comm: insmod Tainted: G         C OE     5.11.0-1001-raspi #1
[   58.572172] Hardware name: Raspberry Pi 4 Model B Rev 1.2 (DT)
[   58.578086] pstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--)
[   58.584178] pc : fortify_panic+0x20/0x24
[   58.588161] lr : fortify_panic+0x20/0x24
[   58.592136] sp : ffff800010a83990
[   58.595491] x29: ffff800010a83990 x28: 0000000000000002
[   58.600879] x27: ffffb0b07cb72928 x26: 0000000000000000
[   58.606268] x25: ffff39e884973838 x24: ffffb0b07cb74190
[   58.611655] x23: ffffb0b07cb72030 x22: 0000000000000000
[   58.617042] x21: ffff39e884973014 x20: ffff39e88b793010
[   58.622428] x19: ffffb0b07cb72670 x18: 0000000000000030
[   58.627814] x17: 0000000000000000 x16: ffffb0b092ce2c1c
[   58.633200] x15: ffff39e88b901500 x14: 0720072007200720
[   58.638588] x13: 0720072007200720 x12: 0720072007200720
[   58.643979] x11: ffffb0b0936cbdf0 x10: 00000000fffff000
[   58.649366] x9 : ffffb0b09220cfa8 x8 : 0000000000000000
[   58.654752] x7 : ffffb0b093673df0 x6 : ffffb0b09364e000
[   58.660140] x5 : 0000000000000000 x4 : ffff39e93b7db948
[   58.665526] x3 : ffff39e93b7ebcf0 x2 : 0000000000000000
[   58.670913] x1 : 0000000000000000 x0 : 0000000000000022
[   58.676299] Call trace:
[   58.678775]  fortify_panic+0x20/0x24
[   58.682402]  snd_bcm2835_alsa_probe+0x5b8/0x7d8 [snd_bcm2835]
[   58.688247]  platform_probe+0x74/0xe4
[   58.691963]  really_probe+0xf0/0x510
[   58.695585]  driver_probe_device+0xe0/0x100
[   58.699826]  device_driver_attach+0xcc/0xd4
[   58.704068]  __driver_attach+0xb0/0x17c
[   58.707956]  bus_for_each_dev+0x7c/0xd4
[   58.711843]  driver_attach+0x30/0x40
[   58.715467]  bus_add_driver+0x154/0x250
[   58.719354]  driver_register+0x84/0x140
[   58.723242]  __platform_driver_register+0x34/0x40
[   58.728013]  bcm2835_alsa_driver_init+0x30/0x1000 [snd_bcm2835]
[   58.734024]  do_one_initcall+0x54/0x300
[   58.737914]  do_init_module+0x60/0x280
[   58.741719]  load_module+0x680/0x770
[   58.745344]  __do_sys_finit_module+0xbc/0x130
[   58.749761]  __arm64_sys_finit_module+0x2c/0x40
[   58.754356]  el0_svc_common.constprop.0+0x88/0x220
[   58.759216]  do_el0_svc+0x30/0xa0
[   58.762575]  el0_svc+0x28/0x70
[   58.765669]  el0_sync_handler+0x1a4/0x1b0
[   58.769732]  el0_sync+0x178/0x180
[   58.773095] Code: aa0003e1 91366040 910003fd 97ffee21 (d4210000)
[   58.779275] ---[ end trace 29be5b17497bd898 ]---
[   58.783955] note: insmod[1959] exited with preempt_count 1
[   58.791921] ------------[ cut here ]------------

For the sake of it, replace all the other occurences of strcpy() under
bcm2835-audio/ as well.

Signed-off-by: Juerg Haefliger <juergh@canonical.com>
Link: https://lore.kernel.org/r/20210205072502.10907-1-juergh@canonical.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-02-06 14:11:21 +01:00

348 lines
8 KiB
C

// SPDX-License-Identifier: GPL-2.0
/* Copyright 2011 Broadcom Corporation. All rights reserved. */
#include <linux/platform_device.h>
#include <linux/init.h>
#include <linux/slab.h>
#include <linux/module.h>
#include "bcm2835.h"
static bool enable_hdmi;
static bool enable_headphones;
static bool enable_compat_alsa = true;
static int num_channels = MAX_SUBSTREAMS;
module_param(enable_hdmi, bool, 0444);
MODULE_PARM_DESC(enable_hdmi, "Enables HDMI virtual audio device");
module_param(enable_headphones, bool, 0444);
MODULE_PARM_DESC(enable_headphones, "Enables Headphones virtual audio device");
module_param(enable_compat_alsa, bool, 0444);
MODULE_PARM_DESC(enable_compat_alsa,
"Enables ALSA compatibility virtual audio device");
module_param(num_channels, int, 0644);
MODULE_PARM_DESC(num_channels, "Number of audio channels (default: 8)");
static void bcm2835_devm_free_vchi_ctx(struct device *dev, void *res)
{
struct bcm2835_vchi_ctx *vchi_ctx = res;
bcm2835_free_vchi_ctx(vchi_ctx);
}
static int bcm2835_devm_add_vchi_ctx(struct device *dev)
{
struct bcm2835_vchi_ctx *vchi_ctx;
int ret;
vchi_ctx = devres_alloc(bcm2835_devm_free_vchi_ctx, sizeof(*vchi_ctx),
GFP_KERNEL);
if (!vchi_ctx)
return -ENOMEM;
ret = bcm2835_new_vchi_ctx(dev, vchi_ctx);
if (ret) {
devres_free(vchi_ctx);
return ret;
}
devres_add(dev, vchi_ctx);
return 0;
}
typedef int (*bcm2835_audio_newpcm_func)(struct bcm2835_chip *chip,
const char *name,
enum snd_bcm2835_route route,
u32 numchannels);
typedef int (*bcm2835_audio_newctl_func)(struct bcm2835_chip *chip);
struct bcm2835_audio_driver {
struct device_driver driver;
const char *shortname;
const char *longname;
int minchannels;
bcm2835_audio_newpcm_func newpcm;
bcm2835_audio_newctl_func newctl;
enum snd_bcm2835_route route;
};
static int bcm2835_audio_alsa_newpcm(struct bcm2835_chip *chip,
const char *name,
enum snd_bcm2835_route route,
u32 numchannels)
{
int err;
err = snd_bcm2835_new_pcm(chip, "bcm2835 ALSA", 0, AUDIO_DEST_AUTO,
numchannels - 1, false);
if (err)
return err;
err = snd_bcm2835_new_pcm(chip, "bcm2835 IEC958/HDMI", 1, 0, 1, true);
if (err)
return err;
return 0;
}
static int bcm2835_audio_simple_newpcm(struct bcm2835_chip *chip,
const char *name,
enum snd_bcm2835_route route,
u32 numchannels)
{
return snd_bcm2835_new_pcm(chip, name, 0, route, numchannels, false);
}
static struct bcm2835_audio_driver bcm2835_audio_alsa = {
.driver = {
.name = "bcm2835_alsa",
.owner = THIS_MODULE,
},
.shortname = "bcm2835 ALSA",
.longname = "bcm2835 ALSA",
.minchannels = 2,
.newpcm = bcm2835_audio_alsa_newpcm,
.newctl = snd_bcm2835_new_ctl,
};
static struct bcm2835_audio_driver bcm2835_audio_hdmi = {
.driver = {
.name = "bcm2835_hdmi",
.owner = THIS_MODULE,
},
.shortname = "bcm2835 HDMI",
.longname = "bcm2835 HDMI",
.minchannels = 1,
.newpcm = bcm2835_audio_simple_newpcm,
.newctl = snd_bcm2835_new_hdmi_ctl,
.route = AUDIO_DEST_HDMI
};
static struct bcm2835_audio_driver bcm2835_audio_headphones = {
.driver = {
.name = "bcm2835_headphones",
.owner = THIS_MODULE,
},
.shortname = "bcm2835 Headphones",
.longname = "bcm2835 Headphones",
.minchannels = 1,
.newpcm = bcm2835_audio_simple_newpcm,
.newctl = snd_bcm2835_new_headphones_ctl,
.route = AUDIO_DEST_HEADPHONES
};
struct bcm2835_audio_drivers {
struct bcm2835_audio_driver *audio_driver;
const bool *is_enabled;
};
static struct bcm2835_audio_drivers children_devices[] = {
{
.audio_driver = &bcm2835_audio_alsa,
.is_enabled = &enable_compat_alsa,
},
{
.audio_driver = &bcm2835_audio_hdmi,
.is_enabled = &enable_hdmi,
},
{
.audio_driver = &bcm2835_audio_headphones,
.is_enabled = &enable_headphones,
},
};
static void bcm2835_card_free(void *data)
{
snd_card_free(data);
}
static int snd_add_child_device(struct device *dev,
struct bcm2835_audio_driver *audio_driver,
u32 numchans)
{
struct bcm2835_chip *chip;
struct snd_card *card;
int err;
err = snd_card_new(dev, -1, NULL, THIS_MODULE, sizeof(*chip), &card);
if (err < 0) {
dev_err(dev, "Failed to create card");
return err;
}
chip = card->private_data;
chip->card = card;
chip->dev = dev;
mutex_init(&chip->audio_mutex);
chip->vchi_ctx = devres_find(dev,
bcm2835_devm_free_vchi_ctx, NULL, NULL);
if (!chip->vchi_ctx) {
err = -ENODEV;
goto error;
}
strscpy(card->driver, audio_driver->driver.name, sizeof(card->driver));
strscpy(card->shortname, audio_driver->shortname, sizeof(card->shortname));
strscpy(card->longname, audio_driver->longname, sizeof(card->longname));
err = audio_driver->newpcm(chip, audio_driver->shortname,
audio_driver->route,
numchans);
if (err) {
dev_err(dev, "Failed to create pcm, error %d\n", err);
goto error;
}
err = audio_driver->newctl(chip);
if (err) {
dev_err(dev, "Failed to create controls, error %d\n", err);
goto error;
}
err = snd_card_register(card);
if (err) {
dev_err(dev, "Failed to register card, error %d\n", err);
goto error;
}
dev_set_drvdata(dev, chip);
err = devm_add_action(dev, bcm2835_card_free, card);
if (err < 0) {
dev_err(dev, "Failed to add devm action, err %d\n", err);
goto error;
}
dev_info(dev, "card created with %d channels\n", numchans);
return 0;
error:
snd_card_free(card);
return err;
}
static int snd_add_child_devices(struct device *device, u32 numchans)
{
int extrachannels_per_driver = 0;
int extrachannels_remainder = 0;
int count_devices = 0;
int extrachannels = 0;
int minchannels = 0;
int i;
for (i = 0; i < ARRAY_SIZE(children_devices); i++)
if (*children_devices[i].is_enabled)
count_devices++;
if (!count_devices)
return 0;
for (i = 0; i < ARRAY_SIZE(children_devices); i++)
if (*children_devices[i].is_enabled)
minchannels +=
children_devices[i].audio_driver->minchannels;
if (minchannels < numchans) {
extrachannels = numchans - minchannels;
extrachannels_per_driver = extrachannels / count_devices;
extrachannels_remainder = extrachannels % count_devices;
}
dev_dbg(device, "minchannels %d\n", minchannels);
dev_dbg(device, "extrachannels %d\n", extrachannels);
dev_dbg(device, "extrachannels_per_driver %d\n",
extrachannels_per_driver);
dev_dbg(device, "extrachannels_remainder %d\n",
extrachannels_remainder);
for (i = 0; i < ARRAY_SIZE(children_devices); i++) {
struct bcm2835_audio_driver *audio_driver;
int numchannels_this_device;
int err;
if (!*children_devices[i].is_enabled)
continue;
audio_driver = children_devices[i].audio_driver;
if (audio_driver->minchannels > numchans) {
dev_err(device,
"Out of channels, needed %d but only %d left\n",
audio_driver->minchannels,
numchans);
continue;
}
numchannels_this_device =
audio_driver->minchannels + extrachannels_per_driver +
extrachannels_remainder;
extrachannels_remainder = 0;
numchans -= numchannels_this_device;
err = snd_add_child_device(device, audio_driver,
numchannels_this_device);
if (err)
return err;
}
return 0;
}
static int snd_bcm2835_alsa_probe(struct platform_device *pdev)
{
struct device *dev = &pdev->dev;
int err;
if (num_channels <= 0 || num_channels > MAX_SUBSTREAMS) {
num_channels = MAX_SUBSTREAMS;
dev_warn(dev, "Illegal num_channels value, will use %u\n",
num_channels);
}
err = bcm2835_devm_add_vchi_ctx(dev);
if (err)
return err;
err = snd_add_child_devices(dev, num_channels);
if (err)
return err;
return 0;
}
#ifdef CONFIG_PM
static int snd_bcm2835_alsa_suspend(struct platform_device *pdev,
pm_message_t state)
{
return 0;
}
static int snd_bcm2835_alsa_resume(struct platform_device *pdev)
{
return 0;
}
#endif
static struct platform_driver bcm2835_alsa_driver = {
.probe = snd_bcm2835_alsa_probe,
#ifdef CONFIG_PM
.suspend = snd_bcm2835_alsa_suspend,
.resume = snd_bcm2835_alsa_resume,
#endif
.driver = {
.name = "bcm2835_audio",
},
};
module_platform_driver(bcm2835_alsa_driver);
MODULE_AUTHOR("Dom Cobley");
MODULE_DESCRIPTION("Alsa driver for BCM2835 chip");
MODULE_LICENSE("GPL");
MODULE_ALIAS("platform:bcm2835_audio");