Re: [PATCH 01/28] ALSA: ac97: Refactor snd_ac97_get_name() to use snprintf()

On Tue, 15 Sep 2026 11:39:34 -0700
Kees Cook [off-list ref] wrote:

(I've just juked a lot of the 'reply to' list - too long to gmail.)

On Tue, Sep 15, 2026 at 08:18:18AM +0000, Bill Wendling wrote:

quoted

--- a/sound/pci/ac97/ac97_codec.c
+++ b/sound/pci/ac97/ac97_codec.c

@@ -1850,10 +1850,12 @@ void snd_ac97_get_name(struct snd_ac97 *ac97, unsigned int id, char *name,
 
 	pid = look_for_codec_id(snd_ac97_codec_ids, id);
 	if (pid) {
-		strlcat(name, " ", maxlen);
-		strlcat(name, pid->name, maxlen);
+		int l = strlen(name);
+
 		if (pid->mask != 0xffffffff)
-			sprintf(name + strlen(name), " rev %u", id & ~pid->mask);
+			snprintf(name + l, maxlen - l, " %s rev %u", pid->name, id & ~pid->mask);
+		else
+			snprintf(name + l, maxlen - l, " %s", pid->name);
 		if (ac97 && pid->patch) {
 			if ((modem && (pid->flags & AC97_MODEM_PATCH)) ||
 			    (! modem && ! (pid->flags & AC97_MODEM_PATCH)))

@@ -1861,6 +1863,7 @@ void snd_ac97_get_name(struct snd_ac97 *ac97, unsigned int id, char *name,
 		}
 	} else {
 		int l = strlen(name);
+
 		snprintf(name + l, maxlen - l, " id %x", id & 0xff);
 	}
 }  

I'd rather not open-code the length math here. Can't we use seq_buf()
instead?

Or just use the length returned by the strscpy() call that wrote the initial
part of name[].
The return the name length so the callers don't have to use strcat()
themselves.
Replacing strlcat() with strlen() and a copy is just pointless.

David