lkml.org 
[lkml]   [2021]   [May]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 094/104] video: hgafb: fix potential NULL pointer dereference
    Date
    From: Igor Matheus Andrade Torrente <igormtorrente@gmail.com>

    commit dc13cac4862cc68ec74348a80b6942532b7735fa upstream.

    The return of ioremap if not checked, and can lead to a NULL to be
    assigned to hga_vram. Potentially leading to a NULL pointer
    dereference.

    The fix adds code to deal with this case in the error label and
    changes how the hgafb_probe handles the return of hga_card_detect.

    Cc: Ferenc Bakonyi <fero@drama.obuda.kando.hu>
    Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
    Cc: stable <stable@vger.kernel.org>
    Signed-off-by: Igor Matheus Andrade Torrente <igormtorrente@gmail.com>
    Link: https://lore.kernel.org/r/20210503115736.2104747-40-gregkh@linuxfoundation.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/video/fbdev/hgafb.c | 21 +++++++++++++--------
    1 file changed, 13 insertions(+), 8 deletions(-)

    --- a/drivers/video/fbdev/hgafb.c
    +++ b/drivers/video/fbdev/hgafb.c
    @@ -285,6 +285,8 @@ static int hga_card_detect(void)
    hga_vram_len = 0x08000;

    hga_vram = ioremap(0xb0000, hga_vram_len);
    + if (!hga_vram)
    + return -ENOMEM;

    if (request_region(0x3b0, 12, "hgafb"))
    release_io_ports = 1;
    @@ -344,13 +346,18 @@ static int hga_card_detect(void)
    hga_type_name = "Hercules";
    break;
    }
    - return 1;
    + return 0;
    error:
    if (release_io_ports)
    release_region(0x3b0, 12);
    if (release_io_port)
    release_region(0x3bf, 1);
    - return 0;
    +
    + iounmap(hga_vram);
    +
    + pr_err("hgafb: HGA card not detected.\n");
    +
    + return -EINVAL;
    }

    /**
    @@ -548,13 +555,11 @@ static const struct fb_ops hgafb_ops = {
    static int hgafb_probe(struct platform_device *pdev)
    {
    struct fb_info *info;
    + int ret;

    - if (! hga_card_detect()) {
    - printk(KERN_INFO "hgafb: HGA card not detected.\n");
    - if (hga_vram)
    - iounmap(hga_vram);
    - return -EINVAL;
    - }
    + ret = hga_card_detect();
    + if (!ret)
    + return ret;

    printk(KERN_INFO "hgafb: %s with %ldK of memory detected.\n",
    hga_type_name, hga_vram_len/1024);

    \
     
     \ /
      Last update: 2021-05-24 18:02    [W:2.212 / U:0.052 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site