Re: [PATCH] more get_property() fallout

[Al Viro]

On Sat, Sep 23, 2006 at 06:21:35PM +0100, Al Viro wrote:
> Signed-off-by: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
> ---
>  drivers/video/riva/fbdev.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/drivers/video/riva/fbdev.c b/drivers/video/riva/fbdev.c
> index 61a4665..4acde4f 100644
> --- a/drivers/video/riva/fbdev.c
> +++ b/drivers/video/riva/fbdev.c
> @@ -1826,7 +1826,7 @@ static int __devinit riva_get_EDID_OF(st
>  {
>  	struct riva_par *par = info->par;
>  	struct device_node *dp;
> -	unsigned char *pedid = NULL;
> +	const unsigned char *pedid = NULL;

Ho-hum...  Actually, that looks like a genuine bug.  Look:

rivafb_probe():
	riva_get_EDID(info, pd);
	riva_get_edidinfo(info);

riva_get_EDID() -> riva_get_EDID_OF() ->
                        pedid = get_property(dp, propnames[i], NULL);
                        if (pedid != NULL) {
                                par->EDID = pedid;
                                NVTRACE("LCD found.\n");
                                return 1;
                        }
then in 
riva_get_edidinfo():
        struct riva_par *par = info->par;

        fb_edid_to_monspecs(par->EDID, &info->monspecs);

fb_edid_to_monspecs() -> edid_checksum() -> fix_edid() -> modifies the string.

What's worse, fb_edid_to_monspecs() appears to assume that the string it
got is long enough.  So... what the hell is going on there?  I'd probably
did kmalloc() and copy that sucker there, making sure that it _is_ long
enough for fbmon.c while we are at it.  Other suggestions?
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/