| From foo@baz Thu Mar 22 14:57:32 CET 2018 |
| From: Alexey Khoroshilov <khoroshilov@ispras.ru> |
| Date: Tue, 2 May 2017 13:47:53 +0200 |
| Subject: sm501fb: don't return zero on failure path in sm501fb_start() |
| |
| From: Alexey Khoroshilov <khoroshilov@ispras.ru> |
| |
| |
| [ Upstream commit dc85e9a87420613b3129d5cc5ecd79c58351c546 ] |
| |
| If fbmem iomemory mapping failed, sm501fb_start() breaks off |
| initialization, deallocates resources, but returns zero. |
| As a result, double deallocation can happen in sm501fb_stop(). |
| |
| Found by Linux Driver Verification project (linuxtesting.org). |
| |
| Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> |
| Cc: Tomi Valkeinen <tomi.valkeinen@ti.com> |
| Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> |
| Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/video/fbdev/sm501fb.c | 1 + |
| 1 file changed, 1 insertion(+) |
| |
| --- a/drivers/video/fbdev/sm501fb.c |
| +++ b/drivers/video/fbdev/sm501fb.c |
| @@ -1600,6 +1600,7 @@ static int sm501fb_start(struct sm501fb_ |
| info->fbmem = ioremap(res->start, resource_size(res)); |
| if (info->fbmem == NULL) { |
| dev_err(dev, "cannot remap framebuffer\n"); |
| + ret = -ENXIO; |
| goto err_mem_res; |
| } |
| |
