Re: [linux-sunxi] [PATCH 2/4] simplefb: Add support for enumerating simplefb dt nodes in /chosen

Hi,

On 11/13/2014 09:34 AM, Geert Uytterhoeven wrote:

Hi Hans,

On Thu, Nov 13, 2014 at 9:27 AM, Hans de Goede [off-list ref] wrote:

quoted

quoted

quoted

+       char name[16];
+       struct device_node *np;
+
+       ret = platform_driver_register(&simplefb_driver);
+       if (ret)
+               return ret;
+
+       for (i = 0; ; i++) {
+               snprintf(name, sizeof(name), "framebuffer%d", i);

This smells like an infinite loop: we can be pretty sure that no
hardware will ever exist with more than 9999 (I think?) framebuffers,
however if that ever happens this'll loop until it runs out of RAM.
Maybe add a suitably high limit to the for loop?

The loop will stop as soon as there are no more framebuffer# nodes in chosen,
so the loop is only infinite if there are infinite nodes in the devicetree,
which would make the devicetree infinitely large, so this will never happen.

If there are 10000 frame buffers, the loop will continue beyond that,
as the index will be truncated to 4 digits due to the size of name[].
It will stop when (signed) i becomes negative, though ;-)

One solution is to increase the size of name[],

This is probably never going to happen, but I'll increase the size of name in v2
anyways.

Regards,

Hans