MLK-21590 epdc: fix potential out of array boundary access

The function mxc_epdc_fb_init_hw() could be called more than once when load
the firmware due to some reason. If this case happens, then for following codes,
the array fb_data->fw_str pointed to will be accessed out of bound. It probably
causes kernel crash, or makes fb_data->fw_str get a wrong value, then the driver
may be stuck during the process of loading the firmware.

        if (fb_data->cur_mode) {
                strcat(fb_data->fw_str, "imx/epdc/epdc_");
                strcat(fb_data->fw_str, fb_data->cur_mode->vmode->name);
                strcat(fb_data->fw_str, ".fw");
        }

This patch fixed that by using strcpy instread.

Signed-off-by: Robby Cai <robby.cai@nxp.com>
Reviewed-by: Guoniu.Zhou <guoniu.zhou@nxp.com>

diff --git a/drivers/video/fbdev/mxc/mxc_epdc_fb.c b/drivers/video/fbdev/mxc/mxc_epdc_fb.c
index 7d83126..024370b 100644 (file)
--- a/drivers/video/fbdev/mxc/mxc_epdc_fb.c
+++ b/drivers/video/fbdev/mxc/mxc_epdc_fb.c
@@ -4423,7 +4423,7 @@ static int mxc_epdc_fb_init_hw(struct fb_info *info)
         * Format is "imx/epdc_[panel string].fw"
         */
        if (fb_data->cur_mode) {
-               strcat(fb_data->fw_str, "imx/epdc/epdc_");
+               strcpy(fb_data->fw_str, "imx/epdc/epdc_");
                strcat(fb_data->fw_str, fb_data->cur_mode->vmode->name);
                strcat(fb_data->fw_str, ".fw");
        }

diff --git a/drivers/video/fbdev/mxc/mxc_epdc_v2_fb.c b/drivers/video/fbdev/mxc/mxc_epdc_v2_fb.c
index 91338b5..36447c2 100644 (file)
--- a/drivers/video/fbdev/mxc/mxc_epdc_v2_fb.c
+++ b/drivers/video/fbdev/mxc/mxc_epdc_v2_fb.c
@@ -4853,7 +4853,7 @@ static int mxc_epdc_fb_init_hw(struct fb_info *info)
         * Format is "imx/epdc/epdc_[panel string].fw"
         */
        if (fb_data->cur_mode) {
-               strcat(fb_data->fw_str, "imx/epdc/epdc_");
+               strcpy(fb_data->fw_str, "imx/epdc/epdc_");
                strcat(fb_data->fw_str, fb_data->cur_mode->vmode->name);
                strcat(fb_data->fw_str, ".fw");
        }