[PATCH V2] staging: sm7xxfb: copy name of the device before calling smtc_alloc_fb_info

[Devendra Naga]

as we do a strcpy(smdrv_ptr->fb_struct->fix->id, name), and the name here in
sm7xxx_probe is not having any assignment, and which leads to copying of the garbage value
into the id field of the fix struct of fb interface struct. fix it by copying the name before
calling alloc_fbinfo.

Signed-off-by: Devendra Naga <develker...@gmail.com>
---

Changes since V1:
Fix a null deref when smtc_alloc_fbinfo fails, this was added by me in V1.

drivers/staging/sm7xxfb/sm7xxfb.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/sm7xxfb/sm7xxfb.c b/drivers/staging/sm7xxfb/sm7xxfb.c
index 1c1780c..1e42444 100644
--- a/drivers/staging/sm7xxfb/sm7xxfb.c
+++ b/drivers/staging/sm7xxfb/sm7xxfb.c
@@ -798,6 +798,8 @@ static int __devinit smtcfb_pci_probe(struct pci_dev *pdev,
if (err)
return err;

+ sprintf(name, "sm%Xfb", ent->device);
+
sfb = smtc_alloc_fb_info(pdev, name);

if (!sfb) {
@@ -806,8 +808,6 @@ static int __devinit smtcfb_pci_probe(struct pci_dev *pdev,
}

sfb->chip_id = ent->device;
- sprintf(name, "sm%Xfb", sfb->chip_id);
-
pci_set_drvdata(pdev, sfb);

sm7xx_init_hw();
--
1.7.9.5

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majo...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

[Devendra Naga]

as we do a strcpy(smdrv_ptr->fb_struct->fix->id, name), and the name here in
sm7xxx_probe is not having any assignment, and which leads to copying of the garbage value
into the id field of the fix struct of fb interface struct. fix it by copying the name before
calling alloc_fbinfo

Signed-off-by: Devendra Naga <develker...@gmail.com>
---

Only compile tested
This patch is not tested using the hardware... if any one is having this hardware, i request them to
please test this
drivers/staging/sm7xxfb/sm7xxfb.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/staging/sm7xxfb/sm7xxfb.c b/drivers/staging/sm7xxfb/sm7xxfb.c
index 1c1780c..d3957ef 100644
--- a/drivers/staging/sm7xxfb/sm7xxfb.c
+++ b/drivers/staging/sm7xxfb/sm7xxfb.c
@@ -798,16 +798,17 @@ static int __devinit smtcfb_pci_probe(struct pci_dev *pdev,

if (err)
return err;

+ sprintf(name, "sm%Xfb", ent->device);
+
sfb = smtc_alloc_fb_info(pdev, name);

+ sfb->chip_id = ent->device;
+
if (!sfb) {
err = -ENOMEM;
goto failed_free;
}

- sfb->chip_id = ent->device;

[Dan Carpenter]

Thanks for fixing this, and well done for spotting the bug.

There is a dereference before the check here, but I see you resent
this in another thread. Next time could you respond to the
original with a message which says to not apply it.

regards,
dan carpenter

[Devendra Naga]

Thanks Dan...

> There is a dereference before the check here, but I see you resent
> this in another thread. Next time could you respond to the
> original with a message which says to not apply it.
>

Sure but i have a doubt.

since we do V++ after every change to the sent patch , do we really
need to say that please dont apply this patch and there's one more
patch coming with fix?

> regards,
> dan carpenter
>
>

Thanks,

[Dan Carpenter]

Yes. The second email very far away from the first one if you are
subscribed to a bunch of high traffic email lists.

I reviewed your patch. I saw the bug. I saw that no one else had
replied to your email. I almost didn't notice the v2 email. It's
annoying. It's not hard to just send an email. "Oops. There is
a bug here. I'll sent a v2."

regards,
dan carpenter

[Greg Kroah-Hartman]

On Sat, Aug 04, 2012 at 11:10:20PM +0545, Devendra Naga wrote:
> as we do a strcpy(smdrv_ptr->fb_struct->fix->id, name), and the name here in
> sm7xxx_probe is not having any assignment, and which leads to copying of the garbage value
> into the id field of the fix struct of fb interface struct. fix it by copying the name before
> calling alloc_fbinfo.
>
> Signed-off-by: Devendra Naga <develker...@gmail.com>
> ---
>
> Changes since V1:
> Fix a null deref when smtc_alloc_fbinfo fails, this was added by me in V1.

Huh? Please resend the correct patch you want me to apply, I'm confused
here.

greg k-h