Thank you for your contribution! Sashiko AI review found 1 potential issue(s) 
to consider:

Pre-existing issues:
- [High] The return values of `ioremap()` and `ioremap_wt()` are not checked in 
`platinumfb_probe()`. If these memory mappings fail, the driver will 
dereference NULL pointers, leading to a kernel panic or memory corruption.
--

--- Patch [1]: [PATCH] fbdev: platinumfb: replace strcpy with strscpy ---
commit 6966c7026a255de8bfc9e604d65d483193521ed1
Author: yuebingkun <[email protected]>

fbdev: platinumfb: replace strcpy with strscpy

strcpy() is deprecated for use on fixed-size buffers. Replace it with
strscpy() to avoid potential buffer overflow issues.

> diff --git a/drivers/video/fbdev/platinumfb.c 
> b/drivers/video/fbdev/platinumfb.c
> index a08d955d9b439..fa27a3a4f05b2 100644
> --- a/drivers/video/fbdev/platinumfb.c
> +++ b/drivers/video/fbdev/platinumfb.c
> @@ -320,7 +320,7 @@ static void platinum_init_info(struct fb_info *info,
>       fb_alloc_cmap(&info->cmap, 256, 0);
>  
>       /* Fill fix common fields */
> -     strcpy(info->fix.id, "platinum");
> +     strscpy(info->fix.id, "platinum", sizeof(info->fix.id));

[Severity: High]
This isn't a bug introduced by this patch, but I noticed there are missing
checks for the return values of memory mapping functions in the same file.

If ioremap() or ioremap_wt() fails during device probe, they return NULL.
This could lead to a NULL pointer dereference in the same function:

drivers/video/fbdev/platinumfb.c:platinumfb_probe() {
        ...
        pinfo->frame_buffer = ioremap_wt(pinfo->rsrc_fb.start, 0x400000);
        pinfo->base_frame_buffer = pinfo->frame_buffer;
        ...
        pinfo->platinum_regs = ioremap(pinfo->rsrc_reg.start, 0x1000);
        ...
        out_be32(&pinfo->platinum_regs->reg[16].r, 
(unsigned)pinfo->frame_buffer_phys);
        ...
        fbuffer = pinfo->base_frame_buffer;
        fbuffer[0x100000] = 0x34;
        ...
}

Should the return values of ioremap_wt() and ioremap() be checked before
dereferencing these pointers?

>       info->fix.mmio_start = pinfo->platinum_regs_phys;
>       info->fix.mmio_len = 0x1000;
>       info->fix.type = FB_TYPE_PACKED_PIXELS;

-- 
Sashiko AI review ยท 
https://sashiko.dev/#/patchset/[email protected]?part=1

Reply via email to