On Tue, 15 Sep 2026 11:39:34 -0700
Kees Cook <[email protected]> wrote:
(I've just juked a lot of the 'reply to' list - too long to gmail.)
> On Tue, Sep 15, 2026 at 08:18:18AM +0000, Bill Wendling wrote:
> > --- a/sound/pci/ac97/ac97_codec.c
> > +++ b/sound/pci/ac97/ac97_codec.c
> > @@ -1850,10 +1850,12 @@ void snd_ac97_get_name(struct snd_ac97 *ac97,
> > unsigned int id, char *name,
> >
> > pid = look_for_codec_id(snd_ac97_codec_ids, id);
> > if (pid) {
> > - strlcat(name, " ", maxlen);
> > - strlcat(name, pid->name, maxlen);
> > + int l = strlen(name);
> > +
> > if (pid->mask != 0xffffffff)
> > - sprintf(name + strlen(name), " rev %u", id &
> > ~pid->mask);
> > + snprintf(name + l, maxlen - l, " %s rev %u", pid->name,
> > id & ~pid->mask);
> > + else
> > + snprintf(name + l, maxlen - l, " %s", pid->name);
> > if (ac97 && pid->patch) {
> > if ((modem && (pid->flags & AC97_MODEM_PATCH)) ||
> > (! modem && ! (pid->flags & AC97_MODEM_PATCH)))
> > @@ -1861,6 +1863,7 @@ void snd_ac97_get_name(struct snd_ac97 *ac97,
> > unsigned int id, char *name,
> > }
> > } else {
> > int l = strlen(name);
> > +
> > snprintf(name + l, maxlen - l, " id %x", id & 0xff);
> > }
> > }
>
> I'd rather not open-code the length math here. Can't we use seq_buf()
> instead?
>
Or just use the length returned by the strscpy() call that wrote the initial
part of name[].
The return the name length so the callers don't have to use strcat()
themselves.
Replacing strlcat() with strlen() and a copy is just pointless.
David
