All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] fbdev: platinumfb: replace strcpy with strscpy
@ 2026-08-17  3:18 yuebingkun
  2026-08-17  3:26 ` sashiko-bot
  2026-08-17 14:37 ` David Laight
  0 siblings, 2 replies; 3+ messages in thread
From: yuebingkun @ 2026-08-17  3:18 UTC (permalink / raw)
  To: Helge Deller; +Cc: linux-fbdev, dri-devel, linux-kernel, yuebingkun

strcpy() is deprecated for use on fixed-size buffers. Replace it with
strscpy() to avoid potential buffer overflow issues.

Found by checkpatch.pl:
WARNING: Prefer strscpy over strcpy

Signed-off-by: yuebingkun <yuebingkun@kylinos.cn>
---
 drivers/video/fbdev/platinumfb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/platinumfb.c b/drivers/video/fbdev/platinumfb.c
index a08d955d9b43..fa27a3a4f05b 100644
--- a/drivers/video/fbdev/platinumfb.c
+++ b/drivers/video/fbdev/platinumfb.c
@@ -320,7 +320,7 @@ static void platinum_init_info(struct fb_info *info,
 	fb_alloc_cmap(&info->cmap, 256, 0);
 
 	/* Fill fix common fields */
-	strcpy(info->fix.id, "platinum");
+	strscpy(info->fix.id, "platinum", sizeof(info->fix.id));
 	info->fix.mmio_start = pinfo->platinum_regs_phys;
 	info->fix.mmio_len = 0x1000;
 	info->fix.type = FB_TYPE_PACKED_PIXELS;
-- 
2.43.0


^ permalink raw reply related	[flat|nested] 3+ messages in thread

* Re: [PATCH] fbdev: platinumfb: replace strcpy with strscpy
  2026-08-17  3:18 [PATCH] fbdev: platinumfb: replace strcpy with strscpy yuebingkun
@ 2026-08-17  3:26 ` sashiko-bot
  2026-08-17 14:37 ` David Laight
  1 sibling, 0 replies; 3+ messages in thread
From: sashiko-bot @ 2026-08-17  3:26 UTC (permalink / raw)
  To: yuebingkun; +Cc: dri-devel

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The return values of `ioremap()` and `ioremap_wt()` are not checked in `platinumfb_probe()`. If these memory mappings fail, the driver will dereference NULL pointers, leading to a kernel panic or memory corruption.
--

--- Patch [1]: [PATCH] fbdev: platinumfb: replace strcpy with strscpy ---
commit 6966c7026a255de8bfc9e604d65d483193521ed1
Author: yuebingkun <yuebingkun@kylinos.cn>

fbdev: platinumfb: replace strcpy with strscpy

strcpy() is deprecated for use on fixed-size buffers. Replace it with
strscpy() to avoid potential buffer overflow issues.

> diff --git a/drivers/video/fbdev/platinumfb.c b/drivers/video/fbdev/platinumfb.c
> index a08d955d9b439..fa27a3a4f05b2 100644
> --- a/drivers/video/fbdev/platinumfb.c
> +++ b/drivers/video/fbdev/platinumfb.c
> @@ -320,7 +320,7 @@ static void platinum_init_info(struct fb_info *info,
>  	fb_alloc_cmap(&info->cmap, 256, 0);
>  
>  	/* Fill fix common fields */
> -	strcpy(info->fix.id, "platinum");
> +	strscpy(info->fix.id, "platinum", sizeof(info->fix.id));

[Severity: High]
This isn't a bug introduced by this patch, but I noticed there are missing
checks for the return values of memory mapping functions in the same file.

If ioremap() or ioremap_wt() fails during device probe, they return NULL.
This could lead to a NULL pointer dereference in the same function:

drivers/video/fbdev/platinumfb.c:platinumfb_probe() {
	...
	pinfo->frame_buffer = ioremap_wt(pinfo->rsrc_fb.start, 0x400000);
	pinfo->base_frame_buffer = pinfo->frame_buffer;
	...
	pinfo->platinum_regs = ioremap(pinfo->rsrc_reg.start, 0x1000);
	...
	out_be32(&pinfo->platinum_regs->reg[16].r, (unsigned)pinfo->frame_buffer_phys);
	...
	fbuffer = pinfo->base_frame_buffer;
	fbuffer[0x100000] = 0x34;
	...
}

Should the return values of ioremap_wt() and ioremap() be checked before
dereferencing these pointers?

>  	info->fix.mmio_start = pinfo->platinum_regs_phys;
>  	info->fix.mmio_len = 0x1000;
>  	info->fix.type = FB_TYPE_PACKED_PIXELS;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260817031816.188833-1-yuebingkun@kylinos.cn?part=1

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH] fbdev: platinumfb: replace strcpy with strscpy
  2026-08-17  3:18 [PATCH] fbdev: platinumfb: replace strcpy with strscpy yuebingkun
  2026-08-17  3:26 ` sashiko-bot
@ 2026-08-17 14:37 ` David Laight
  1 sibling, 0 replies; 3+ messages in thread
From: David Laight @ 2026-08-17 14:37 UTC (permalink / raw)
  To: yuebingkun; +Cc: Helge Deller, linux-fbdev, dri-devel, linux-kernel

On Mon, 17 Aug 2026 11:18:16 +0800
yuebingkun <yuebingkun@kylinos.cn> wrote:

> strcpy() is deprecated for use on fixed-size buffers. Replace it with
> strscpy() to avoid potential buffer overflow issues.

There is no point using strscpy() to copy quoted strings into arrays.
Indeed, if the string is too long the kernel build will fail if strcpy()
is used but strscpy() will silently truncate the strings.
So strscpy() is actually worse here.

There are plenty of places where the destination size isn't known.
Which might be worth fixing.

	David

> 
> Found by checkpatch.pl:
> WARNING: Prefer strscpy over strcpy
> 
> Signed-off-by: yuebingkun <yuebingkun@kylinos.cn>
> ---
>  drivers/video/fbdev/platinumfb.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/video/fbdev/platinumfb.c b/drivers/video/fbdev/platinumfb.c
> index a08d955d9b43..fa27a3a4f05b 100644
> --- a/drivers/video/fbdev/platinumfb.c
> +++ b/drivers/video/fbdev/platinumfb.c
> @@ -320,7 +320,7 @@ static void platinum_init_info(struct fb_info *info,
>  	fb_alloc_cmap(&info->cmap, 256, 0);
>  
>  	/* Fill fix common fields */
> -	strcpy(info->fix.id, "platinum");
> +	strscpy(info->fix.id, "platinum", sizeof(info->fix.id));
>  	info->fix.mmio_start = pinfo->platinum_regs_phys;
>  	info->fix.mmio_len = 0x1000;
>  	info->fix.type = FB_TYPE_PACKED_PIXELS;


^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2026-08-17 14:38 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-17  3:18 [PATCH] fbdev: platinumfb: replace strcpy with strscpy yuebingkun
2026-08-17  3:26 ` sashiko-bot
2026-08-17 14:37 ` David Laight

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.