[udev] bug in udev-remove.c

[Kay Sievers <kay.sievers@vrfy.org>]

[-- Attachment #1: Type: text/plain, Size: 385 bytes --]


Uups, we have a bug in udev-remove.c.

udev segfaults with NULL-pointer, if the device is not in the database:

  ./test.block: line 29:  4844 Segmentation fault      $BIN block
  Dec 17 22:47:42 pim udev[4882]: udev_remove_device: '/block/sdy' not found in database, falling back on default name
  Dec 17 22:47:42 pim udev[4882]: udev_remove_device: name is '(null)'


thanks,
Kay



[-- Attachment #2: 01-bug-in-remove.diff --]
[-- Type: text/plain, Size: 731 bytes --]

--- ../udev/udev-remove.c	2003-12-10 03:40:14.000000000 +0100
+++ udev-remove.c	2003-12-17 22:45:09.000000000 +0100
@@ -118,8 +118,8 @@
  */
 int udev_remove_device(char *path, char *subsystem)
 {
-	char name[100];
 	struct udevice *dev;
+	struct udevice device;
 	char *temp;
 
 	dev = udevdb_get_dev(path);
@@ -128,13 +128,15 @@
 		temp = strrchr(path, '/');
 		if (temp == NULL)
 			return -ENODEV;
-		strncpy(name, &temp[1], sizeof(name));
+		memset(&device, 0, sizeof(device));
+		dev = &device;
+		strncpy(device.name, &temp[1], sizeof(device.name));
 	}
 
 	dbg("name is '%s'", dev->name);
 	udevdb_delete_dev(path);
 
-	sysbus_send_remove(name, path);
+	sysbus_send_remove(dev->name, path);
 
 	return delete_node(dev);
 }