From: kay.sievers@vrfy.org <kay.sievers@vrfy.org>
Date: Thu, 18 Dec 2003 06:33:29 +0000 (-0800)
Subject: [PATCH] bug in udev-remove.c
X-Git-Tag: 010~24
X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=commitdiff_plain;h=a81805b9af899087f3d8367721ac0a51460f692e

[PATCH] bug in udev-remove.c

Uups, we have a bug in udev-remove.c.

udev segfaults with NULL-pointer, if the device is not in the database:

  ./test.block: line 29:  4844 Segmentation fault      $BIN block
  Dec 17 22:47:42 pim udev[4882]: udev_remove_device: '/block/sdy' not found in database, falling back on default name
  Dec 17 22:47:42 pim udev[4882]: udev_remove_device: name is '(null)'
---

diff --git a/udev-remove.c b/udev-remove.c
index 0886c2334..dad4a9857 100644
--- a/udev-remove.c
+++ b/udev-remove.c
@@ -118,8 +118,8 @@ static int delete_node(struct udevice *dev)
  */
 int udev_remove_device(char *path, char *subsystem)
 {
-	char name[100];
 	struct udevice *dev;
+	struct udevice device;
 	char *temp;
 
 	dev = udevdb_get_dev(path);
@@ -128,13 +128,15 @@ int udev_remove_device(char *path, char *subsystem)
 		temp = strrchr(path, '/');
 		if (temp == NULL)
 			return -ENODEV;
-		strncpy(name, &temp[1], sizeof(name));
+		memset(&device, 0, sizeof(device));
+		dev = &device;
+		strncpy(device.name, &temp[1], sizeof(device.name));
 	}
 
 	dbg("name is '%s'", dev->name);
 	udevdb_delete_dev(path);
 
-	sysbus_send_remove(name, path);
+	sysbus_send_remove(dev->name, path);
 
 	return delete_node(dev);
 }