* [PATCH v3 1/5] staging: sm750fb: replace strcat() with memcpy() in lynxfb_setup()
@ 2026-02-04 12:05 Artem Lytkin
2026-02-04 12:05 ` [PATCH v3 2/5] staging: sm750fb: use strcmp() for exact option matching Artem Lytkin
` (4 more replies)
0 siblings, 5 replies; 8+ messages in thread
From: Artem Lytkin @ 2026-02-04 12:05 UTC (permalink / raw)
To: Sudip Mukherjee, Teddy Wang, Greg Kroah-Hartman
Cc: linux-fbdev, linux-staging, linux-kernel, Artem Lytkin
As part of kernel hardening, I am auditing calls to strcat(). This
code works but it is a bit ugly.
This function takes a string "options" and allocates "g_settings"
which is large enough to hold a copy of "options". It copies all the
options from "options" to "g_settings" except "noaccel", "nomtrr" and
"dual". The new buffer is large enough to fit all the options so
there is no buffer overflow in using strcat() here.
However, using strcat() is misleading because "tmp" always points
to the next unused character in the "g_settings" buffer and it's
always the NUL character. Use memcpy() instead to make the code
easier to read. This also removes an instance of strcat() which
is a #NiceBonus.
Signed-off-by: Artem Lytkin <iprintercanon@gmail.com>
---
drivers/staging/sm750fb/sm750.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
index fecd7457e..4c6e84c03 100644
--- a/drivers/staging/sm750fb/sm750.c
+++ b/drivers/staging/sm750fb/sm750.c
@@ -1163,7 +1163,7 @@ static int __init lynxfb_setup(char *options)
} else if (!strncmp(opt, "dual", strlen("dual"))) {
g_dualview = 1;
} else {
- strcat(tmp, opt);
+ memcpy(tmp, opt, strlen(opt));
tmp += strlen(opt);
if (options)
*tmp++ = ':';
--
2.43.0
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH v3 2/5] staging: sm750fb: use strcmp() for exact option matching
2026-02-04 12:05 [PATCH v3 1/5] staging: sm750fb: replace strcat() with memcpy() in lynxfb_setup() Artem Lytkin
@ 2026-02-04 12:05 ` Artem Lytkin
2026-02-07 13:31 ` Greg Kroah-Hartman
2026-02-04 12:06 ` [PATCH v3 3/5] staging: sm750fb: remove debug and diagnostic prints Artem Lytkin
` (3 subsequent siblings)
4 siblings, 1 reply; 8+ messages in thread
From: Artem Lytkin @ 2026-02-04 12:05 UTC (permalink / raw)
To: Sudip Mukherjee, Teddy Wang, Greg Kroah-Hartman
Cc: linux-fbdev, linux-staging, linux-kernel, Artem Lytkin
Replace strncmp(opt, "...", strlen("...")) with strcmp() in option
parsing functions. Options from strsep() are complete null-terminated
tokens, so prefix matching via strncmp() could cause false positives
for options like "noaccelXYZ" matching "noaccel".
Fixes: 81dee67e215b ("staging: sm750fb: add sm750 to staging")
Signed-off-by: Artem Lytkin <iprintercanon@gmail.com>
---
drivers/staging/sm750fb/sm750.c | 22 +++++++++++-----------
1 file changed, 11 insertions(+), 11 deletions(-)
diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
index 4c6e84c03..bd2d4a290 100644
--- a/drivers/staging/sm750fb/sm750.c
+++ b/drivers/staging/sm750fb/sm750.c
@@ -937,21 +937,21 @@ static void sm750fb_setup(struct sm750_dev *sm750_dev, char *src)
dev_info(&sm750_dev->pdev->dev, "opt=%s\n", opt);
dev_info(&sm750_dev->pdev->dev, "src=%s\n", src);
- if (!strncmp(opt, "swap", strlen("swap"))) {
+ if (!strcmp(opt, "swap")) {
swap = 1;
- } else if (!strncmp(opt, "nocrt", strlen("nocrt"))) {
+ } else if (!strcmp(opt, "nocrt")) {
sm750_dev->nocrt = 1;
- } else if (!strncmp(opt, "36bit", strlen("36bit"))) {
+ } else if (!strcmp(opt, "36bit")) {
sm750_dev->pnltype = sm750_doubleTFT;
- } else if (!strncmp(opt, "18bit", strlen("18bit"))) {
+ } else if (!strcmp(opt, "18bit")) {
sm750_dev->pnltype = sm750_dualTFT;
- } else if (!strncmp(opt, "24bit", strlen("24bit"))) {
+ } else if (!strcmp(opt, "24bit")) {
sm750_dev->pnltype = sm750_24TFT;
- } else if (!strncmp(opt, "nohwc0", strlen("nohwc0"))) {
+ } else if (!strcmp(opt, "nohwc0")) {
g_hwcursor &= ~0x1;
- } else if (!strncmp(opt, "nohwc1", strlen("nohwc1"))) {
+ } else if (!strcmp(opt, "nohwc1")) {
g_hwcursor &= ~0x2;
- } else if (!strncmp(opt, "nohwc", strlen("nohwc"))) {
+ } else if (!strcmp(opt, "nohwc")) {
g_hwcursor = 0;
} else {
if (!g_fbmode[0]) {
@@ -1156,11 +1156,11 @@ static int __init lynxfb_setup(char *options)
*/
while ((opt = strsep(&options, ":")) != NULL) {
/* options that mean for any lynx chips are configured here */
- if (!strncmp(opt, "noaccel", strlen("noaccel"))) {
+ if (!strcmp(opt, "noaccel")) {
g_noaccel = 1;
- } else if (!strncmp(opt, "nomtrr", strlen("nomtrr"))) {
+ } else if (!strcmp(opt, "nomtrr")) {
g_nomtrr = 1;
- } else if (!strncmp(opt, "dual", strlen("dual"))) {
+ } else if (!strcmp(opt, "dual")) {
g_dualview = 1;
} else {
memcpy(tmp, opt, strlen(opt));
--
2.43.0
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH v3 3/5] staging: sm750fb: remove debug and diagnostic prints
2026-02-04 12:05 [PATCH v3 1/5] staging: sm750fb: replace strcat() with memcpy() in lynxfb_setup() Artem Lytkin
2026-02-04 12:05 ` [PATCH v3 2/5] staging: sm750fb: use strcmp() for exact option matching Artem Lytkin
@ 2026-02-04 12:06 ` Artem Lytkin
2026-02-07 13:32 ` Greg Kroah-Hartman
2026-02-04 12:06 ` [PATCH v3 4/5] staging: sm750fb: convert logging to device-based in sm750.c Artem Lytkin
` (2 subsequent siblings)
4 siblings, 1 reply; 8+ messages in thread
From: Artem Lytkin @ 2026-02-04 12:06 UTC (permalink / raw)
To: Sudip Mukherjee, Teddy Wang, Greg Kroah-Hartman
Cc: linux-fbdev, linux-staging, linux-kernel, Artem Lytkin
Remove pr_info, pr_debug, and pr_warn calls that dump internal
variable values, pointer addresses, structure contents, and
other diagnostic information not useful for production use.
Signed-off-by: Artem Lytkin <iprintercanon@gmail.com>
---
drivers/staging/sm750fb/sm750.c | 53 ++----------------------------
drivers/staging/sm750fb/sm750_hw.c | 8 -----
2 files changed, 2 insertions(+), 59 deletions(-)
diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
index bd2d4a290..050408af2 100644
--- a/drivers/staging/sm750fb/sm750.c
+++ b/drivers/staging/sm750fb/sm750.c
@@ -375,7 +375,6 @@ static int lynxfb_ops_set_par(struct fb_info *info)
line_length = var->xres_virtual * var->bits_per_pixel / 8;
line_length = ALIGN(line_length, crtc->line_pad);
fix->line_length = line_length;
- pr_info("fix->line_length = %d\n", fix->line_length);
/*
* var->red,green,blue,transp are need to be set by driver
@@ -485,11 +484,6 @@ static int lynxfb_ops_check_var(struct fb_var_screeninfo *var,
par = info->par;
crtc = &par->crtc;
- pr_debug("check var:%dx%d-%d\n",
- var->xres,
- var->yres,
- var->bits_per_pixel);
-
ret = lynxfb_set_color_offsets(info);
if (ret) {
@@ -580,7 +574,6 @@ static int lynxfb_ops_blank(int blank, struct fb_info *info)
struct lynxfb_par *par;
struct lynxfb_output *output;
- pr_debug("blank = %d.\n", blank);
par = info->par;
output = &par->output;
sm750_dev = par->dev;
@@ -625,7 +618,6 @@ static int sm750fb_set_drv(struct lynxfb_par *par)
crtc->channel = sm750_primary;
crtc->o_screen = 0;
crtc->v_screen = sm750_dev->pvMem;
- pr_info("use simul primary mode\n");
break;
case sm750_simul_sec:
output->paths = sm750_pnc;
@@ -767,7 +759,6 @@ static int lynxfb_set_fbinfo(struct fb_info *info, int index)
crtc->cursor.mmio = sm750_dev->pvReg +
0x800f0 + (int)crtc->channel * 0x140;
- pr_info("crtc->cursor.mmio = %p\n", crtc->cursor.mmio);
crtc->cursor.max_h = 64;
crtc->cursor.max_w = 64;
crtc->cursor.size = crtc->cursor.max_h * crtc->cursor.max_w * 2 / 8;
@@ -811,11 +802,8 @@ static int lynxfb_set_fbinfo(struct fb_info *info, int index)
g_fbmode[index],
mdb_desc[i]);
break;
- } else if (ret == 3) {
- pr_warn("wanna use default mode\n");
- /*break;*/
- } else if (ret == 4) {
- pr_warn("fall back to any valid mode\n");
+ } else if (ret == 3 || ret == 4) {
+ continue;
} else {
pr_warn("ret = %d,fb_find_mode failed,with %s\n",
ret,
@@ -823,25 +811,6 @@ static int lynxfb_set_fbinfo(struct fb_info *info, int index)
}
}
- /* some member of info->var had been set by fb_find_mode */
-
- pr_info("Member of info->var is :\n"
- "xres=%d\n"
- "yres=%d\n"
- "xres_virtual=%d\n"
- "yres_virtual=%d\n"
- "xoffset=%d\n"
- "yoffset=%d\n"
- "bits_per_pixel=%d\n"
- " ...\n",
- var->xres,
- var->yres,
- var->xres_virtual,
- var->yres_virtual,
- var->xoffset,
- var->yoffset,
- var->bits_per_pixel);
-
/* set par */
par->info = info;
@@ -851,7 +820,6 @@ static int lynxfb_set_fbinfo(struct fb_info *info, int index)
info->pseudo_palette = &par->pseudo_palette[0];
info->screen_base = crtc->v_screen;
- pr_debug("screen_base vaddr = %p\n", info->screen_base);
info->screen_size = line_length * var->yres_virtual;
/* set info->fix */
@@ -865,7 +833,6 @@ static int lynxfb_set_fbinfo(struct fb_info *info, int index)
strscpy(fix->id, fixId[index], sizeof(fix->id));
fix->smem_start = crtc->o_screen + sm750_dev->vidmem_start;
- pr_info("fix->smem_start = %lx\n", fix->smem_start);
/*
* according to mmap experiment from user space application,
* fix->mmio_len should not larger than virtual size
@@ -874,13 +841,10 @@ static int lynxfb_set_fbinfo(struct fb_info *info, int index)
* data into the bound over virtual size
*/
fix->smem_len = crtc->vidmem_size;
- pr_info("fix->smem_len = %x\n", fix->smem_len);
info->screen_size = fix->smem_len;
fix->line_length = line_length;
fix->mmio_start = sm750_dev->vidreg_start;
- pr_info("fix->mmio_start = %lx\n", fix->mmio_start);
fix->mmio_len = sm750_dev->vidreg_size;
- pr_info("fix->mmio_len = %x\n", fix->mmio_len);
lynxfb_set_visual_mode(info);
@@ -889,22 +853,12 @@ static int lynxfb_set_fbinfo(struct fb_info *info, int index)
var->accel_flags = 0;
var->vmode = FB_VMODE_NONINTERLACED;
- pr_debug("#1 show info->cmap :\nstart=%d,len=%d,red=%p,green=%p,blue=%p,transp=%p\n",
- info->cmap.start, info->cmap.len,
- info->cmap.red, info->cmap.green, info->cmap.blue,
- info->cmap.transp);
-
ret = fb_alloc_cmap(&info->cmap, 256, 0);
if (ret < 0) {
pr_err("Could not allocate memory for cmap.\n");
goto exit;
}
- pr_debug("#2 show info->cmap :\nstart=%d,len=%d,red=%p,green=%p,blue=%p,transp=%p\n",
- info->cmap.start, info->cmap.len,
- info->cmap.red, info->cmap.green, info->cmap.blue,
- info->cmap.transp);
-
exit:
lynxfb_ops_check_var(var, info);
return ret;
@@ -934,9 +888,6 @@ static void sm750fb_setup(struct sm750_dev *sm750_dev, char *src)
}
while ((opt = strsep(&src, ":")) != NULL && *opt != 0) {
- dev_info(&sm750_dev->pdev->dev, "opt=%s\n", opt);
- dev_info(&sm750_dev->pdev->dev, "src=%s\n", src);
-
if (!strcmp(opt, "swap")) {
swap = 1;
} else if (!strcmp(opt, "nocrt")) {
diff --git a/drivers/staging/sm750fb/sm750_hw.c b/drivers/staging/sm750fb/sm750_hw.c
index ce46f240c..e3e4b75d6 100644
--- a/drivers/staging/sm750fb/sm750_hw.c
+++ b/drivers/staging/sm750fb/sm750_hw.c
@@ -34,8 +34,6 @@ int hw_sm750_map(struct sm750_dev *sm750_dev, struct pci_dev *pdev)
sm750_dev->vidreg_start = pci_resource_start(pdev, 1);
sm750_dev->vidreg_size = SZ_2M;
- pr_info("mmio phyAddr = %lx\n", sm750_dev->vidreg_start);
-
/*
* reserve the vidreg space of smi adaptor
* if you do this, you need to add release region code
@@ -56,7 +54,6 @@ int hw_sm750_map(struct sm750_dev *sm750_dev, struct pci_dev *pdev)
ret = -EFAULT;
goto exit;
}
- pr_info("mmio virtual addr = %p\n", sm750_dev->pvReg);
sm750_dev->accel.dpr_base = sm750_dev->pvReg + DE_BASE_ADDR_TYPE1;
sm750_dev->accel.dp_port_base = sm750_dev->pvReg + DE_PORT_ADDR_TYPE1;
@@ -72,8 +69,6 @@ int hw_sm750_map(struct sm750_dev *sm750_dev, struct pci_dev *pdev)
* @ddk750_get_vm_size function can be safe.
*/
sm750_dev->vidmem_size = ddk750_get_vm_size();
- pr_info("video memory phyAddr = %lx, size = %u bytes\n",
- sm750_dev->vidmem_start, sm750_dev->vidmem_size);
/* reserve the vidmem space of smi adaptor */
sm750_dev->pvMem =
@@ -84,7 +79,6 @@ int hw_sm750_map(struct sm750_dev *sm750_dev, struct pci_dev *pdev)
ret = -EFAULT;
goto exit;
}
- pr_info("video memory vaddr = %p\n", sm750_dev->pvMem);
exit:
return ret;
}
@@ -163,11 +157,9 @@ int hw_sm750_inithw(struct sm750_dev *sm750_dev, struct pci_dev *pdev)
* The following register values for CH7301 are from
* Chrontel app note and our experiment.
*/
- pr_info("yes,CH7301 DVI chip found\n");
sm750_sw_i2c_write_reg(0xec, 0x1d, 0x16);
sm750_sw_i2c_write_reg(0xec, 0x21, 0x9);
sm750_sw_i2c_write_reg(0xec, 0x49, 0xC0);
- pr_info("okay,CH7301 DVI chip setup done\n");
}
}
--
2.43.0
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH v3 4/5] staging: sm750fb: convert logging to device-based in sm750.c
2026-02-04 12:05 [PATCH v3 1/5] staging: sm750fb: replace strcat() with memcpy() in lynxfb_setup() Artem Lytkin
2026-02-04 12:05 ` [PATCH v3 2/5] staging: sm750fb: use strcmp() for exact option matching Artem Lytkin
2026-02-04 12:06 ` [PATCH v3 3/5] staging: sm750fb: remove debug and diagnostic prints Artem Lytkin
@ 2026-02-04 12:06 ` Artem Lytkin
2026-02-04 12:06 ` [PATCH v3 5/5] staging: sm750fb: convert logging to device-based in sm750_hw.c Artem Lytkin
2026-02-07 13:27 ` [PATCH v3 1/5] staging: sm750fb: replace strcat() with memcpy() in lynxfb_setup() Greg Kroah-Hartman
4 siblings, 0 replies; 8+ messages in thread
From: Artem Lytkin @ 2026-02-04 12:06 UTC (permalink / raw)
To: Sudip Mukherjee, Teddy Wang, Greg Kroah-Hartman
Cc: linux-fbdev, linux-staging, linux-kernel, Artem Lytkin
Convert remaining pr_err and pr_warn calls to dev_err and dev_warn
using info->device where struct fb_info is available. This provides
proper device context in log messages.
Signed-off-by: Artem Lytkin <iprintercanon@gmail.com>
---
drivers/staging/sm750fb/sm750.c | 32 ++++++++++++++++++--------------
1 file changed, 18 insertions(+), 14 deletions(-)
diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
index 050408af2..1561fa5fe 100644
--- a/drivers/staging/sm750fb/sm750.c
+++ b/drivers/staging/sm750fb/sm750.c
@@ -388,7 +388,8 @@ static int lynxfb_ops_set_par(struct fb_info *info)
var->accel_flags = 0;/*FB_ACCELF_TEXT;*/
if (ret) {
- pr_err("bpp %d not supported\n", var->bits_per_pixel);
+ dev_err(info->device, "bpp %d not supported\n",
+ var->bits_per_pixel);
return ret;
}
ret = hw_sm750_crtc_set_mode(crtc, var, fix);
@@ -487,7 +488,8 @@ static int lynxfb_ops_check_var(struct fb_var_screeninfo *var,
ret = lynxfb_set_color_offsets(info);
if (ret) {
- pr_err("bpp %d not supported\n", var->bits_per_pixel);
+ dev_err(info->device, "bpp %d not supported\n",
+ var->bits_per_pixel);
return ret;
}
@@ -502,7 +504,7 @@ static int lynxfb_ops_check_var(struct fb_var_screeninfo *var,
request = ALIGN(request, crtc->line_pad);
request = request * var->yres_virtual;
if (crtc->vidmem_size < request) {
- pr_err("not enough video memory for mode\n");
+ dev_err(info->device, "not enough video memory for mode\n");
return -ENOMEM;
}
@@ -527,7 +529,7 @@ static int lynxfb_ops_setcolreg(unsigned int regno,
ret = 0;
if (regno > 256) {
- pr_err("regno = %d\n", regno);
+ dev_err(info->device, "regno = %d\n", regno);
return -EINVAL;
}
@@ -793,21 +795,23 @@ static int lynxfb_set_fbinfo(struct fb_info *info, int index)
pdb[i], cdb[i], NULL, 8);
if (ret == 1) {
- pr_info("success! use specified mode:%s in %s\n",
- g_fbmode[index],
- mdb_desc[i]);
+ dev_info(info->device,
+ "use specified mode:%s in %s\n",
+ g_fbmode[index],
+ mdb_desc[i]);
break;
} else if (ret == 2) {
- pr_warn("use specified mode:%s in %s,with an ignored refresh rate\n",
- g_fbmode[index],
- mdb_desc[i]);
+ dev_warn(info->device,
+ "use specified mode:%s in %s, with an ignored refresh rate\n",
+ g_fbmode[index],
+ mdb_desc[i]);
break;
} else if (ret == 3 || ret == 4) {
continue;
} else {
- pr_warn("ret = %d,fb_find_mode failed,with %s\n",
- ret,
- mdb_desc[i]);
+ dev_warn(info->device,
+ "fb_find_mode failed with %s (ret=%d)\n",
+ mdb_desc[i], ret);
}
}
@@ -855,7 +859,7 @@ static int lynxfb_set_fbinfo(struct fb_info *info, int index)
ret = fb_alloc_cmap(&info->cmap, 256, 0);
if (ret < 0) {
- pr_err("Could not allocate memory for cmap.\n");
+ dev_err(info->device, "Could not allocate memory for cmap.\n");
goto exit;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH v3 5/5] staging: sm750fb: convert logging to device-based in sm750_hw.c
2026-02-04 12:05 [PATCH v3 1/5] staging: sm750fb: replace strcat() with memcpy() in lynxfb_setup() Artem Lytkin
` (2 preceding siblings ...)
2026-02-04 12:06 ` [PATCH v3 4/5] staging: sm750fb: convert logging to device-based in sm750.c Artem Lytkin
@ 2026-02-04 12:06 ` Artem Lytkin
2026-02-07 13:27 ` [PATCH v3 1/5] staging: sm750fb: replace strcat() with memcpy() in lynxfb_setup() Greg Kroah-Hartman
4 siblings, 0 replies; 8+ messages in thread
From: Artem Lytkin @ 2026-02-04 12:06 UTC (permalink / raw)
To: Sudip Mukherjee, Teddy Wang, Greg Kroah-Hartman
Cc: linux-fbdev, linux-staging, linux-kernel, Artem Lytkin
Convert pr_err calls to dev_err using &pdev->dev in hw_sm750_map()
where struct pci_dev *pdev is available as a function parameter.
Signed-off-by: Artem Lytkin <iprintercanon@gmail.com>
---
drivers/staging/sm750fb/sm750_hw.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/staging/sm750fb/sm750_hw.c b/drivers/staging/sm750fb/sm750_hw.c
index e3e4b75d6..bf4c1585c 100644
--- a/drivers/staging/sm750fb/sm750_hw.c
+++ b/drivers/staging/sm750fb/sm750_hw.c
@@ -42,7 +42,7 @@ int hw_sm750_map(struct sm750_dev *sm750_dev, struct pci_dev *pdev)
*/
ret = pci_request_region(pdev, 1, "sm750fb");
if (ret) {
- pr_err("Can not request PCI regions.\n");
+ dev_err(&pdev->dev, "Can not request PCI regions.\n");
goto exit;
}
@@ -50,7 +50,7 @@ int hw_sm750_map(struct sm750_dev *sm750_dev, struct pci_dev *pdev)
sm750_dev->pvReg =
ioremap(sm750_dev->vidreg_start, sm750_dev->vidreg_size);
if (!sm750_dev->pvReg) {
- pr_err("mmio failed\n");
+ dev_err(&pdev->dev, "mmio failed\n");
ret = -EFAULT;
goto exit;
}
@@ -75,7 +75,7 @@ int hw_sm750_map(struct sm750_dev *sm750_dev, struct pci_dev *pdev)
ioremap_wc(sm750_dev->vidmem_start, sm750_dev->vidmem_size);
if (!sm750_dev->pvMem) {
iounmap(sm750_dev->pvReg);
- pr_err("Map video memory failed\n");
+ dev_err(&pdev->dev, "Map video memory failed\n");
ret = -EFAULT;
goto exit;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [PATCH v3 1/5] staging: sm750fb: replace strcat() with memcpy() in lynxfb_setup()
2026-02-04 12:05 [PATCH v3 1/5] staging: sm750fb: replace strcat() with memcpy() in lynxfb_setup() Artem Lytkin
` (3 preceding siblings ...)
2026-02-04 12:06 ` [PATCH v3 5/5] staging: sm750fb: convert logging to device-based in sm750_hw.c Artem Lytkin
@ 2026-02-07 13:27 ` Greg Kroah-Hartman
4 siblings, 0 replies; 8+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-07 13:27 UTC (permalink / raw)
To: Artem Lytkin
Cc: Sudip Mukherjee, Teddy Wang, linux-fbdev, linux-staging,
linux-kernel
On Wed, Feb 04, 2026 at 12:05:58PM +0000, Artem Lytkin wrote:
> As part of kernel hardening, I am auditing calls to strcat(). This
> code works but it is a bit ugly.
>
> This function takes a string "options" and allocates "g_settings"
> which is large enough to hold a copy of "options". It copies all the
> options from "options" to "g_settings" except "noaccel", "nomtrr" and
> "dual". The new buffer is large enough to fit all the options so
> there is no buffer overflow in using strcat() here.
>
> However, using strcat() is misleading because "tmp" always points
> to the next unused character in the "g_settings" buffer and it's
> always the NUL character. Use memcpy() instead to make the code
> easier to read. This also removes an instance of strcat() which
> is a #NiceBonus.
>
> Signed-off-by: Artem Lytkin <iprintercanon@gmail.com>
> ---
> drivers/staging/sm750fb/sm750.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
> index fecd7457e..4c6e84c03 100644
> --- a/drivers/staging/sm750fb/sm750.c
> +++ b/drivers/staging/sm750fb/sm750.c
> @@ -1163,7 +1163,7 @@ static int __init lynxfb_setup(char *options)
> } else if (!strncmp(opt, "dual", strlen("dual"))) {
> g_dualview = 1;
> } else {
> - strcat(tmp, opt);
> + memcpy(tmp, opt, strlen(opt));
You are open-coding a call to strcat() here :(
Please don't replace one "warning" with another, this will just cause
code churn over time. If the original code is fine, just leave it
as-is, your change here did not actually do anything at all.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH v3 2/5] staging: sm750fb: use strcmp() for exact option matching
2026-02-04 12:05 ` [PATCH v3 2/5] staging: sm750fb: use strcmp() for exact option matching Artem Lytkin
@ 2026-02-07 13:31 ` Greg Kroah-Hartman
0 siblings, 0 replies; 8+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-07 13:31 UTC (permalink / raw)
To: Artem Lytkin
Cc: Sudip Mukherjee, Teddy Wang, linux-fbdev, linux-staging,
linux-kernel
On Wed, Feb 04, 2026 at 12:05:59PM +0000, Artem Lytkin wrote:
> Replace strncmp(opt, "...", strlen("...")) with strcmp() in option
> parsing functions. Options from strsep() are complete null-terminated
> tokens, so prefix matching via strncmp() could cause false positives
> for options like "noaccelXYZ" matching "noaccel".
>
> Fixes: 81dee67e215b ("staging: sm750fb: add sm750 to staging")
> Signed-off-by: Artem Lytkin <iprintercanon@gmail.com>
> ---
> drivers/staging/sm750fb/sm750.c | 22 +++++++++++-----------
> 1 file changed, 11 insertions(+), 11 deletions(-)
>
> diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
> index 4c6e84c03..bd2d4a290 100644
> --- a/drivers/staging/sm750fb/sm750.c
> +++ b/drivers/staging/sm750fb/sm750.c
> @@ -937,21 +937,21 @@ static void sm750fb_setup(struct sm750_dev *sm750_dev, char *src)
> dev_info(&sm750_dev->pdev->dev, "opt=%s\n", opt);
> dev_info(&sm750_dev->pdev->dev, "src=%s\n", src);
>
> - if (!strncmp(opt, "swap", strlen("swap"))) {
> + if (!strcmp(opt, "swap")) {
While I understand the feeling, again, this really isn't doing anything
except cause other code checkers to go "Wait, we can't call strcmp() we
must replace that with strncmp()!"
Please don't replace one warning with another. Option parsing is a
pain, let's not make it any more of a pain than it is. Ideally all of
the framebuffer drivers could make some "simple" helper functions to
handle this crazy logic for them, instead of forcing them to all do it
manually :(
Yet another reason all of us want to just delete all of these drivers...
thanks,
greg k-h
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH v3 3/5] staging: sm750fb: remove debug and diagnostic prints
2026-02-04 12:06 ` [PATCH v3 3/5] staging: sm750fb: remove debug and diagnostic prints Artem Lytkin
@ 2026-02-07 13:32 ` Greg Kroah-Hartman
0 siblings, 0 replies; 8+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-07 13:32 UTC (permalink / raw)
To: Artem Lytkin
Cc: Sudip Mukherjee, Teddy Wang, linux-fbdev, linux-staging,
linux-kernel
On Wed, Feb 04, 2026 at 12:06:00PM +0000, Artem Lytkin wrote:
> @@ -811,11 +802,8 @@ static int lynxfb_set_fbinfo(struct fb_info *info, int index)
> g_fbmode[index],
> mdb_desc[i]);
> break;
> - } else if (ret == 3) {
> - pr_warn("wanna use default mode\n");
> - /*break;*/
> - } else if (ret == 4) {
> - pr_warn("fall back to any valid mode\n");
> + } else if (ret == 3 || ret == 4) {
> + continue;
> } else {
> pr_warn("ret = %d,fb_find_mode failed,with %s\n",
> ret,
Why delete some of these but not all? Why delete any of them?
Consistancy matters :)
thanks,
greg k-h
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2026-02-07 13:32 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-02-04 12:05 [PATCH v3 1/5] staging: sm750fb: replace strcat() with memcpy() in lynxfb_setup() Artem Lytkin
2026-02-04 12:05 ` [PATCH v3 2/5] staging: sm750fb: use strcmp() for exact option matching Artem Lytkin
2026-02-07 13:31 ` Greg Kroah-Hartman
2026-02-04 12:06 ` [PATCH v3 3/5] staging: sm750fb: remove debug and diagnostic prints Artem Lytkin
2026-02-07 13:32 ` Greg Kroah-Hartman
2026-02-04 12:06 ` [PATCH v3 4/5] staging: sm750fb: convert logging to device-based in sm750.c Artem Lytkin
2026-02-04 12:06 ` [PATCH v3 5/5] staging: sm750fb: convert logging to device-based in sm750_hw.c Artem Lytkin
2026-02-07 13:27 ` [PATCH v3 1/5] staging: sm750fb: replace strcat() with memcpy() in lynxfb_setup() Greg Kroah-Hartman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox