lkml.org 
[lkml]   [2018]   [Mar]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL for 3.18 42/53] sm501fb: don't return zero on failure path in sm501fb_start()
    Date
    From: Alexey Khoroshilov <khoroshilov@ispras.ru>

    [ Upstream commit dc85e9a87420613b3129d5cc5ecd79c58351c546 ]

    If fbmem iomemory mapping failed, sm501fb_start() breaks off
    initialization, deallocates resources, but returns zero.
    As a result, double deallocation can happen in sm501fb_stop().

    Found by Linux Driver Verification project (linuxtesting.org).

    Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
    Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
    Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    ---
    drivers/video/fbdev/sm501fb.c | 1 +
    1 file changed, 1 insertion(+)

    diff --git a/drivers/video/fbdev/sm501fb.c b/drivers/video/fbdev/sm501fb.c
    index 9e74e8fbe074..aa3fdb89043c 100644
    --- a/drivers/video/fbdev/sm501fb.c
    +++ b/drivers/video/fbdev/sm501fb.c
    @@ -1600,6 +1600,7 @@ static int sm501fb_start(struct sm501fb_info *info,
    info->fbmem = ioremap(res->start, resource_size(res));
    if (info->fbmem == NULL) {
    dev_err(dev, "cannot remap framebuffer\n");
    + ret = -ENXIO;
    goto err_mem_res;
    }

    --
    2.14.1
    \
     
     \ /
      Last update: 2018-03-08 06:17    [W:4.482 / U:0.052 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site