Re: [PATCH] fbdev: platinumfb: replace strcpy with strscpy

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The return values of `ioremap()` and `ioremap_wt()` are not checked in `platinumfb_probe()`. If these memory mappings fail, the driver will dereference NULL pointers, leading to a kernel panic or memory corruption.
--

--- Patch [1]: [PATCH] fbdev: platinumfb: replace strcpy with strscpy ---
commit 6966c7026a255de8bfc9e604d65d483193521ed1
Author: yuebingkun <[email protected]>

fbdev: platinumfb: replace strcpy with strscpy

strcpy() is deprecated for use on fixed-size buffers. Replace it with
strscpy() to avoid potential buffer overflow issues.

> diff --git a/drivers/video/fbdev/platinumfb.c b/drivers/video/fbdev/platinumfb.c
> index a08d955d9b439..fa27a3a4f05b2 100644
> --- a/drivers/video/fbdev/platinumfb.c
> +++ b/drivers/video/fbdev/platinumfb.c
> @@ -320,7 +320,7 @@ static void platinum_init_info(struct fb_info *info,
>  	fb_alloc_cmap(&info->cmap, 256, 0);
>  
>  	/* Fill fix common fields */
> -	strcpy(info->fix.id, "platinum");
> +	strscpy(info->fix.id, "platinum", sizeof(info->fix.id));

[Severity: High]
This isn't a bug introduced by this patch, but I noticed there are missing
checks for the return values of memory mapping functions in the same file.

If ioremap() or ioremap_wt() fails during device probe, they return NULL.
This could lead to a NULL pointer dereference in the same function:

drivers/video/fbdev/platinumfb.c:platinumfb_probe() {
	...
	pinfo->frame_buffer = ioremap_wt(pinfo->rsrc_fb.start, 0x400000);
	pinfo->base_frame_buffer = pinfo->frame_buffer;
	...
	pinfo->platinum_regs = ioremap(pinfo->rsrc_reg.start, 0x1000);
	...
	out_be32(&pinfo->platinum_regs->reg[16].r, (unsigned)pinfo->frame_buffer_phys);
	...
	fbuffer = pinfo->base_frame_buffer;
	fbuffer[0x100000] = 0x34;
	...
}

Should the return values of ioremap_wt() and ioremap() be checked before
dereferencing these pointers?

>  	info->fix.mmio_start = pinfo->platinum_regs_phys;
>  	info->fix.mmio_len = 0x1000;
>  	info->fix.type = FB_TYPE_PACKED_PIXELS;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1