Re: [PATCH] staging: greybus: audio_codec: fix stack overflow in stream name parsing

[Yudi Yang]

I found this with an internal program-analysis tool that I cannot disclose
yet, then manually verified the finding. intf_name and dir are 32-byte
arrays, while the unbounded %s conversions allow tokens from w->sname
longer than 31 characters to overflow them. Using %31s limits each
conversion to 31 characters.

I do not have Greybus hardware, so testing was limited to building the
affected object and running checkpatch.pl

Yudi

On Wed, Sep 2, 2026 at 12:55 AM Greg KH <gregkh@xxxxxxxxxxxxxxxxxxx> wrote:
>
> On Tue, Sep 01, 2026 at 01:56:00PM -0500, Yudi Yang wrote:
> > intf_name and dir are 32-byte buffers. Parsing a module-provided AIF
> > stream name with unbounded %s conversions can cause buffer-overwrites.
> > Limit each conversion to 31 characters.
> >
> > Fixes: 60e7327d54b2 ("greybus: audio: Find data connection based on id")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Signed-off-by: Yudi Yang <2000jedi@xxxxxxxxx>
> > ---
> >  drivers/staging/greybus/audio_codec.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
>
> How was this found and tested?
>
> thanks,
>
> greg k-h