RFC PATCH remove W83781D_RT ???

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



> no objections. RT was an experiment of mine we should have removed
> long ago.
> 
> what was the bug?

In the 2.6 version of the driver:

static ssize_t
store_rt_reg(struct device *dev, const char *buf, size_t count, int nr)
{
	struct i2c_client *client = to_i2c_client(dev);
	struct w83781d_data *data = i2c_get_clientdata(client);
	u32 val, i;

	down(&data->update_lock);

	for (i = 0; i < count; i++) {
		val = simple_strtoul(buf + count, NULL, 10); <-- BUG HERE

		/* fixme: no bounds checking 0-255 */
		data->rt[nr - 1][i] = val & 0xff;
		w83781d_write_value(client, W83781D_REG_RT_IDX, i);
		w83781d_write_value(client, W83781D_REG_RT_VAL,
				    data->rt[nr - 1][i]);
	}

	up(&data->update_lock);
	return count;
}

"buf" and "count" are provided by sysfs. "buf" points to a buffer of
length "count". "buf + count", by definition, is outside of the buffer,
so there no chance simple_strtoul() returns anything useful (if it
doesn't simply crash).

So this code cannot work, which IMHO is a proof that nobody ever tried
this so we can remove it.

Thanks,
-- 
Jean Delvare



[Index of Archives]     [Linux Kernel]     [Linux Hardware Monitoring]     [Linux USB Devel]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Yosemite Backpacking]

  Powered by Linux