media: video: tegra: fix miscdevice registeration nametegra-l4t-r17.1tegra-l4t-r17-17r1

Allocate driver name string in info struct, rather than passing
a pointer to a stack allocated array when registering a miscdevice.
This prevents 'cat /proc/misc' from dereferencing a dangling
pointer.

Drivers of following devices were updated - ad5816, as364x, dw9718,
imx091, max77387, max77665-flash, ov5693, ov9772, sh532u, ssl3250a
and tps61050.

Change-Id: I2344e6fefabdeda962ea33bc10803881e07ab3f0
Signed-off-by: Shreshtha Sahu <ssahu@nvidia.com>
Reviewed-on: http://git-master/r/256818
GVS: Gerrit_Virtual_Submit
Reviewed-by: Kiran Adduri <kadduri@nvidia.com>
Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>
Reviewed-by: Matthew Pedro <mapedro@nvidia.com>

11 files changed, 91 insertions, 80 deletions

diff --git a/drivers/media/video/tegra/ad5816.c b/drivers/media/video/tegra/ad5816.c
index bddd923c6a1f..5a9bd902b5c9 100644
--- a/drivers/media/video/tegra/ad5816.c
+++ b/drivers/media/video/tegra/ad5816.c
@@ -124,6 +124,7 @@ struct ad5816_info {
 	int pwr_dev;
 	s32 pos;
 	u16 dev_id;
+	char devname[16];
 };
 
 /**
@@ -777,7 +778,6 @@ static int ad5816_probe(
 		const struct i2c_device_id *id)
 {
 	struct ad5816_info *info;
-	char dname[16];
 	int err;
 
 	dev_dbg(&client->dev, "%s\n", __func__);
@@ -835,20 +835,21 @@ static int ad5816_probe(
 	ad5816_sdata_init(info);
 
 	if (info->pdata->dev_name != 0)
-		strcpy(dname, info->pdata->dev_name);
+		strncpy(info->devname, info->pdata->dev_name,
+			sizeof(info->devname) - 1);
 	else
-		strcpy(dname, "ad5816");
+		strncpy(info->devname, "ad5816", sizeof(info->devname) - 1);
 
 	if (info->pdata->num)
-		snprintf(dname, sizeof(dname),
-			"%s.%u", dname, info->pdata->num);
+		snprintf(info->devname, sizeof(info->devname),
+			"%s.%u", info->devname, info->pdata->num);
 
-	info->miscdev.name = dname;
+	info->miscdev.name = info->devname;
 	info->miscdev.fops = &ad5816_fileops;
 	info->miscdev.minor = MISC_DYNAMIC_MINOR;
 	if (misc_register(&info->miscdev)) {
 		dev_err(info->dev, "%s unable to register misc device %s\n",
-			__func__, dname);
+			__func__, info->devname);
 		ad5816_del(info);
 		return -ENODEV;
 	}
diff --git a/drivers/media/video/tegra/as364x.c b/drivers/media/video/tegra/as364x.c
index fc459fb364a2..49d86f04e50c 100644
--- a/drivers/media/video/tegra/as364x.c
+++ b/drivers/media/video/tegra/as364x.c
@@ -150,6 +150,7 @@ struct as364x_info {
 	u8 led_num;
 	u8 led_mask;
 	bool shutdown_complete;
+	char devname[16];
 };
 
 static struct as364x_platform_data as364x_default_pdata = {
@@ -1180,7 +1181,6 @@ static int as364x_probe(
 	const struct i2c_device_id *id)
 {
 	struct as364x_info *info;
-	char dname[16];
 	int err;
 
 	dev_dbg(&client->dev, "%s\n", __func__);
@@ -1234,19 +1234,20 @@ static int as364x_probe(
 			__func__, info->regs.dev_id);
 
 	if (info->pdata->dev_name != 0)
-		strcpy(dname, info->pdata->dev_name);
+		strncpy(info->devname, info->pdata->dev_name,
+			sizeof(info->devname) - 1);
 	else
-		strcpy(dname, "as364x");
+		strncpy(info->devname, "as364x", sizeof(info->devname) - 1);
 	if (info->pdata->num)
-		snprintf(dname, sizeof(dname), "%s.%u",
-			 dname, info->pdata->num);
+		snprintf(info->devname, sizeof(info->devname), "%s.%u",
+			 info->devname, info->pdata->num);
 
-	info->miscdev.name = dname;
+	info->miscdev.name = info->devname;
 	info->miscdev.fops = &as364x_fileops;
 	info->miscdev.minor = MISC_DYNAMIC_MINOR;
 	if (misc_register(&info->miscdev)) {
 		dev_err(&client->dev, "%s unable to register misc device %s\n",
-				__func__, dname);
+				__func__, info->devname);
 		as364x_del(info);
 		return -ENODEV;
 	}
diff --git a/drivers/media/video/tegra/dw9718.c b/drivers/media/video/tegra/dw9718.c
index b8a5988acd71..9557a5b0b1b2 100644
--- a/drivers/media/video/tegra/dw9718.c
+++ b/drivers/media/video/tegra/dw9718.c
@@ -127,6 +127,7 @@ struct dw9718_info {
 	int status;
 	u32 cur_pos;
 	u8 s_mode;
+	char devname[16];
 };
 
 /**
@@ -878,7 +879,6 @@ static int dw9718_probe(
 		const struct i2c_device_id *id)
 {
 	struct dw9718_info *info;
-	char dname[16];
 	int err;
 	dev_dbg(&client->dev, "%s\n", __func__);
 	pr_info("dw9718: probing focuser.\n");
@@ -929,20 +929,21 @@ static int dw9718_probe(
 	}
 
 	if (info->pdata->dev_name != 0)
-		strcpy(dname, info->pdata->dev_name);
+		strncpy(info->devname, info->pdata->dev_name,
+			sizeof(info->devname) - 1);
 	else
-		strcpy(dname, "dw9718");
+		strncpy(info->devname, "dw9718", sizeof(info->devname) - 1);
 
 	if (info->pdata->num)
-		snprintf(dname, sizeof(dname),
-			"%s.%u", dname, info->pdata->num);
+		snprintf(info->devname, sizeof(info->devname),
+			"%s.%u", info->devname, info->pdata->num);
 
-	info->miscdev.name = dname;
+	info->miscdev.name = info->devname;
 	info->miscdev.fops = &dw9718_fileops;
 	info->miscdev.minor = MISC_DYNAMIC_MINOR;
 	if (misc_register(&info->miscdev)) {
 		dev_err(&client->dev, "%s unable to register misc device %s\n",
-			__func__, dname);
+			__func__, info->devname);
 		dw9718_del(info);
 		return -ENODEV;
 	}
diff --git a/drivers/media/video/tegra/imx091.c b/drivers/media/video/tegra/imx091.c
index 59cde73af54d..1321e0624b28 100644
--- a/drivers/media/video/tegra/imx091.c
+++ b/drivers/media/video/tegra/imx091.c
@@ -90,6 +90,7 @@ struct imx091_info {
 	u16	i2c_reg;
 #endif
 	struct nvc_fuseid fuse_id;
+	char devname[16];
 };
 
 struct imx091_reg {
@@ -2817,7 +2818,6 @@ static int imx091_probe(
 	const struct i2c_device_id *id)
 {
 	struct imx091_info *info;
-	char dname[16];
 	unsigned long clock_probe_rate;
 	int err;
 
@@ -2880,18 +2880,19 @@ static int imx091_probe(
 	imx091_edp_register(info);
 
 	if (info->pdata->dev_name != 0)
-		strcpy(dname, info->pdata->dev_name);
+		strncpy(info->devname, info->pdata->dev_name,
+			sizeof(info->devname) - 1);
 	else
-		strcpy(dname, "imx091");
+		strncpy(info->devname, "imx091", sizeof(info->devname) - 1);
 	if (info->pdata->num)
-		snprintf(dname, sizeof(dname), "%s.%u",
-			 dname, info->pdata->num);
-	info->miscdev.name = dname;
+		snprintf(info->devname, sizeof(info->devname), "%s.%u",
+			 info->devname, info->pdata->num);
+	info->miscdev.name = info->devname;
 	info->miscdev.fops = &imx091_fileops;
 	info->miscdev.minor = MISC_DYNAMIC_MINOR;
 	if (misc_register(&info->miscdev)) {
 		dev_err(&client->dev, "%s unable to register misc device %s\n",
-			__func__, dname);
+			__func__, info->devname);
 		imx091_del(info);
 		return -ENODEV;
 	}
diff --git a/drivers/media/video/tegra/max77387.c b/drivers/media/video/tegra/max77387.c
index cd9ab5718847..bb0d643e71c2 100644
--- a/drivers/media/video/tegra/max77387.c
+++ b/drivers/media/video/tegra/max77387.c
@@ -272,6 +272,7 @@ struct max77387_info {
 	u8 ftimer_mode;
 	u8 ttimer_mode;
 	u8 new_timer;
+	char devname[16];
 };
 
 static const struct max77387_caps_struct max77387_caps = {
@@ -1725,7 +1726,6 @@ static int max77387_probe(
 	struct i2c_client *client, const struct i2c_device_id *id)
 {
 	struct max77387_info *info;
-	char dname[16];
 
 	dev_info(&client->dev, "%s\n", __func__);
 
@@ -1777,18 +1777,19 @@ static int max77387_probe(
 	}
 
 	if (info->pdata->dev_name != NULL)
-		strncpy(dname, info->pdata->dev_name, sizeof(dname));
+		strncpy(info->devname, info->pdata->dev_name,
+			sizeof(info->devname) - 1);
 	else
-		strncpy(dname, "max77387", sizeof(dname));
+		strncpy(info->devname, "max77387", sizeof(info->devname) - 1);
 	if (info->pdata->num)
-		snprintf(dname, sizeof(dname), "%s.%u",
-				dname, info->pdata->num);
-	info->miscdev.name = dname;
+		snprintf(info->devname, sizeof(info->devname), "%s.%u",
+				info->devname, info->pdata->num);
+	info->miscdev.name = info->devname;
 	info->miscdev.fops = &max77387_fileops;
 	info->miscdev.minor = MISC_DYNAMIC_MINOR;
 	if (misc_register(&info->miscdev)) {
 		dev_err(&client->dev, "%s unable to register misc device %s\n",
-				__func__, dname);
+				__func__, info->devname);
 		max77387_del(info);
 		return -ENODEV;
 	}
diff --git a/drivers/media/video/tegra/max77665-flash.c b/drivers/media/video/tegra/max77665-flash.c
index 2feee300eb42..c6a2cf25da36 100644
--- a/drivers/media/video/tegra/max77665-flash.c
+++ b/drivers/media/video/tegra/max77665-flash.c
@@ -275,6 +275,7 @@ struct max77665_f_info {
 	u8 ttimer_mode;
 	u8 new_ftimer;
 	u8 new_ttimer;
+	char devname[16];
 };
 
 static const struct max77665_f_caps_struct max77665_f_caps = {
@@ -1550,7 +1551,6 @@ static int max77665_f_probe(struct platform_device *pdev)
 {
 	struct max77665_f_info *info;
 	struct max77665 *maxim;
-	char dname[16];
 
 	dev_info(&pdev->dev, "%s\n", __func__);
 
@@ -1594,18 +1594,19 @@ static int max77665_f_probe(struct platform_device *pdev)
 	mutex_init(&info->mutex);
 
 	if (info->pdata->dev_name != NULL)
-		strcpy(dname, info->pdata->dev_name);
+		strncpy(info->devname, info->pdata->dev_name,
+			sizeof(info->devname) - 1);
 	else
-		strcpy(dname, "max77665_f");
+		strncpy(info->devname, "max77665_f", sizeof(info->devname) - 1);
 	if (info->pdata->num)
-		snprintf(dname, sizeof(dname), "%s.%u",
-				dname, info->pdata->num);
-	info->miscdev.name = dname;
+		snprintf(info->devname, sizeof(info->devname), "%s.%u",
+				info->devname, info->pdata->num);
+	info->miscdev.name = info->devname;
 	info->miscdev.fops = &max77665_f_fileops;
 	info->miscdev.minor = MISC_DYNAMIC_MINOR;
 	if (misc_register(&info->miscdev)) {
 		dev_err(&pdev->dev, "%s unable to register misc device %s\n",
-				__func__, dname);
+				__func__, info->devname);
 		max77665_f_del(info);
 		return -ENODEV;
 	}
diff --git a/drivers/media/video/tegra/ov5693.c b/drivers/media/video/tegra/ov5693.c
index 9caa165b5041..b1a6e28f4b2e 100644
--- a/drivers/media/video/tegra/ov5693.c
+++ b/drivers/media/video/tegra/ov5693.c
@@ -69,6 +69,7 @@ struct ov5693_info {
 	struct regmap *regmap;
 	struct regulator *ext_vcm_vdd;
 	struct ov5693_cal_data cal;
+	char devname[16];
 };
 
 struct ov5693_reg {
@@ -3247,7 +3248,6 @@ static int ov5693_probe(
 	const struct i2c_device_id *id)
 {
 	struct ov5693_info *info;
-	char dname[16];
 	unsigned long clock_probe_rate;
 	int err;
 	static struct regmap_config ad5823_regmap_config = {
@@ -3319,19 +3319,20 @@ static int ov5693_probe(
 			info->pdata->probe_clock(0);
 	}
 	if (info->pdata->dev_name != NULL)
-		strcpy(dname, info->pdata->dev_name);
+		strncpy(info->devname, info->pdata->dev_name,
+			sizeof(info->devname) - 1);
 	else
-		strcpy(dname, "ov5693");
+		strncpy(info->devname, "ov5693", sizeof(info->devname) - 1);
 	if (info->pdata->num)
-		snprintf(dname, sizeof(dname), "%s.%u",
-			 dname, info->pdata->num);
-	info->miscdev.name = dname;
+		snprintf(info->devname, sizeof(info->devname), "%s.%u",
+			 info->devname, info->pdata->num);
+	info->miscdev.name = info->devname;
 	info->miscdev.fops = &ov5693_fileops;
 	info->miscdev.minor = MISC_DYNAMIC_MINOR;
 	info->miscdev.parent = &client->dev;
 	if (misc_register(&info->miscdev)) {
 		dev_err(&client->dev, "%s unable to register misc device %s\n",
-			__func__, dname);
+			__func__, info->devname);
 		ov5693_del(info);
 		return -ENODEV;
 	}
diff --git a/drivers/media/video/tegra/ov9772.c b/drivers/media/video/tegra/ov9772.c
index 9a312b8c489b..f8797c521316 100644
--- a/drivers/media/video/tegra/ov9772.c
+++ b/drivers/media/video/tegra/ov9772.c
@@ -201,6 +201,7 @@ struct ov9772_info {
 	u8 i2c_buf[OV9772_SIZEOF_I2C_BUF];
 	u8 bin_en;
 	struct nvc_fuseid fuse_id;
+	char devname[16];
 };
 
 struct ov9772_reg {
@@ -2198,7 +2199,6 @@ static int ov9772_probe(
 	const struct i2c_device_id *id)
 {
 	struct ov9772_info *info;
-	char dname[16];
 	unsigned long clock_probe_rate;
 	int err;
 
@@ -2261,18 +2261,19 @@ static int ov9772_probe(
 			info->pdata->probe_clock(0);
 	}
 	if (info->pdata->dev_name != 0)
-		strcpy(dname, info->pdata->dev_name);
+		strncpy(info->devname, info->pdata->dev_name,
+			sizeof(info->devname) - 1);
 	else
-		strcpy(dname, "ov9772");
+		strncpy(info->devname, "ov9772", sizeof(info->devname) - 1);
 	if (info->pdata->num)
-		snprintf(dname, sizeof(dname), "%s.%u",
-			 dname, info->pdata->num);
-	info->miscdev.name = dname;
+		snprintf(info->devname, sizeof(info->devname), "%s.%u",
+			 info->devname, info->pdata->num);
+	info->miscdev.name = info->devname;
 	info->miscdev.fops = &ov9772_fileops;
 	info->miscdev.minor = MISC_DYNAMIC_MINOR;
 	if (misc_register(&info->miscdev)) {
 		dev_err(&client->dev, "%s unable to register misc device %s\n",
-			__func__, dname);
+			__func__, info->devname);
 		ov9772_del(info);
 		return -ENODEV;
 	}
diff --git a/drivers/media/video/tegra/sh532u.c b/drivers/media/video/tegra/sh532u.c
index b9ab1f096d9d..2e5fe05fd12b 100644
--- a/drivers/media/video/tegra/sh532u.c
+++ b/drivers/media/video/tegra/sh532u.c
@@ -1,7 +1,7 @@
 /*
  * SH532U focuser driver.
  *
- * Copyright (C) 2011-2012 NVIDIA Corporation.
+ * Copyright (C) 2011-2013 NVIDIA Corporation.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -163,6 +163,7 @@ struct sh532u_info {
 	u32 pos_rel;
 	s16 pos_abs;
 	long pos_time_wr;
+	char devname[16];
 };
 
 static struct sh532u_pdata_info sh532u_default_info = {
@@ -1966,7 +1967,6 @@ static int sh532u_probe(
 	const struct i2c_device_id *id)
 {
 	struct sh532u_info *info;
-	char dname[16];
 	int err;
 
 	info = devm_kzalloc(&client->dev, sizeof(*info), GFP_KERNEL);
@@ -2013,18 +2013,19 @@ static int sh532u_probe(
 	}
 
 	if (info->pdata->dev_name != 0)
-		strcpy(dname, info->pdata->dev_name);
+		strncpy(info->devname, info->pdata->dev_name,
+			 sizeof(info->devname) - 1);
 	else
-		strcpy(dname, "sh532u");
+		strncpy(info->devname, "sh532u", sizeof(info->devname) - 1);
 	if (info->pdata->num)
-		snprintf(dname, sizeof(dname), "%s.%u",
-			 dname, info->pdata->num);
-	info->miscdev.name = dname;
+		snprintf(info->devname, sizeof(info->devname), "%s.%u",
+			 info->devname, info->pdata->num);
+	info->miscdev.name = info->devname;
 	info->miscdev.fops = &sh532u_fileops;
 	info->miscdev.minor = MISC_DYNAMIC_MINOR;
 	if (misc_register(&info->miscdev)) {
 		dev_err(&client->dev, "%s unable to register misc device %s\n",
-			__func__, dname);
+			__func__, info->devname);
 		sh532u_del(info);
 		return -ENODEV;
 	}
diff --git a/drivers/media/video/tegra/ssl3250a.c b/drivers/media/video/tegra/ssl3250a.c
index 2656138099e6..e36d2b36dd85 100644
--- a/drivers/media/video/tegra/ssl3250a.c
+++ b/drivers/media/video/tegra/ssl3250a.c
@@ -1,7 +1,7 @@
 /*
  * ssl3250a.c - ssl3250a flash/torch kernel driver
  *
- * Copyright (C) 2011 NVIDIA Corporation.
+ * Copyright (C) 2011-2013 NVIDIA Corporation.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -164,6 +164,7 @@ struct ssl3250a_info {
 	struct nvc_regulator vreg_i2c;
 	u8 s_mode;
 	struct ssl3250a_info *s_info;
+	char devname[16];
 };
 
 static struct nvc_torch_pin_state ssl3250a_default_pinstate = {
@@ -900,7 +901,6 @@ static int ssl3250a_probe(
 	const struct i2c_device_id *id)
 {
 	struct ssl3250a_info *info;
-	char dname[16];
 	int err;
 
 	dev_dbg(&client->dev, "%s\n", __func__);
@@ -937,18 +937,19 @@ static int ssl3250a_probe(
 	}
 
 	if (info->pdata->dev_name != 0)
-		strcpy(dname, info->pdata->dev_name);
+		strncpy(info->devname, info->pdata->dev_name,
+			sizeof(info->devname) - 1);
 	else
-		strcpy(dname, "ssl3250a");
+		strncpy(info->devname, "ssl3250a", sizeof(info->devname) - 1);
 	if (info->pdata->num)
-		snprintf(dname, sizeof(dname), "%s.%u",
-			 dname, info->pdata->num);
-	info->miscdev.name = dname;
+		snprintf(info->devname, sizeof(info->devname), "%s.%u",
+			 info->devname, info->pdata->num);
+	info->miscdev.name = info->devname;
 	info->miscdev.fops = &ssl3250a_fileops;
 	info->miscdev.minor = MISC_DYNAMIC_MINOR;
 	if (misc_register(&info->miscdev)) {
 		dev_err(&client->dev, "%s unable to register misc device %s\n",
-				__func__, dname);
+				__func__, info->devname);
 		ssl3250a_del(info);
 		return -ENODEV;
 	}
diff --git a/drivers/media/video/tegra/tps61050.c b/drivers/media/video/tegra/tps61050.c
index cc442324fdc7..b13111de1e7e 100644
--- a/drivers/media/video/tegra/tps61050.c
+++ b/drivers/media/video/tegra/tps61050.c
@@ -1,7 +1,7 @@
 /*
  * tps61050.c - tps61050 flash/torch kernel driver
  *
- * Copyright (C) 2011 NVIDIA Corporation.
+ * Copyright (C) 2011-2013 NVIDIA Corporation.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -145,6 +145,7 @@ struct tps61050_info {
 	struct nvc_regulator vreg_i2c;
 	u8 s_mode;
 	struct tps61050_info *s_info;
+	char devname[16];
 };
 
 static struct nvc_torch_pin_state tps61050_default_pinstate = {
@@ -904,7 +905,6 @@ static int tps61050_probe(
 	const struct i2c_device_id *id)
 {
 	struct tps61050_info *info;
-	char dname[16];
 	int err;
 
 	dev_dbg(&client->dev, "%s\n", __func__);
@@ -941,18 +941,19 @@ static int tps61050_probe(
 	}
 
 	if (info->pdata->dev_name != 0)
-		strcpy(dname, info->pdata->dev_name);
+		strncpy(info->devname, info->pdata->dev_name,
+			sizeof(info->devname) - 1);
 	else
-		strcpy(dname, "tps61050");
+		strncpy(info->devname, "tps61050", sizeof(info->devname) - 1);
 	if (info->pdata->num)
-		snprintf(dname, sizeof(dname), "%s.%u",
-			 dname, info->pdata->num);
-	info->miscdev.name = dname;
+		snprintf(info->devname, sizeof(info->devname), "%s.%u",
+			 info->devname, info->pdata->num);
+	info->miscdev.name = info->devname;
 	info->miscdev.fops = &tps61050_fileops;
 	info->miscdev.minor = MISC_DYNAMIC_MINOR;
 	if (misc_register(&info->miscdev)) {
 		dev_err(&client->dev, "%s unable to register misc device %s\n",
-				__func__, dname);
+				__func__, info->devname);
 		tps61050_del(info);
 		return -ENODEV;
 	}