Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6449e31d authored by Alexey Khoroshilov's avatar Alexey Khoroshilov Committed by Stefan Richter
Browse files

firewire: nosy: do not ignore errors in ioremap_nocache() 



There is no check if ioremap_nocache() returns a valid pointer.
Potentially it can lead to null pointer dereference.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de> (renamed goto labels)
parent c8d2bc9b

drivers/firewire/nosy.c

+10 −3
Original line number Diff line number Diff line
@@ -566,6 +566,11 @@ add_card(struct pci_dev *dev, const struct pci_device_id *unused) 


	lynx->registers = ioremap_nocache(pci_resource_start(dev, 0),

					  PCILYNX_MAX_REGISTER);

	if (lynx->registers == NULL) {

		dev_err(&dev->dev, "Failed to map registers\n");

		ret = -ENOMEM;

		goto fail_deallocate_lynx;

	}



	lynx->rcv_start_pcl = pci_alloc_consistent(lynx->pci_device,

				sizeof(struct pcl), &lynx->rcv_start_pcl_bus);
@@ -578,7 +583,7 @@ add_card(struct pci_dev *dev, const struct pci_device_id *unused) 
	    lynx->rcv_buffer == NULL) {

		dev_err(&dev->dev, "Failed to allocate receive buffer\n");

		ret = -ENOMEM;

		goto fail_deallocate;

		goto fail_deallocate_buffers;

	}

	lynx->rcv_start_pcl->next	= cpu_to_le32(lynx->rcv_pcl_bus);

	lynx->rcv_pcl->next		= cpu_to_le32(PCL_NEXT_INVALID);
@@ -641,7 +646,7 @@ add_card(struct pci_dev *dev, const struct pci_device_id *unused) 
		dev_err(&dev->dev,

			"Failed to allocate shared interrupt %d\n", dev->irq);

		ret = -EIO;

		goto fail_deallocate;

		goto fail_deallocate_buffers;

	}



	lynx->misc.parent = &dev->dev;
@@ -668,7 +673,7 @@ add_card(struct pci_dev *dev, const struct pci_device_id *unused) 
	reg_write(lynx, PCI_INT_ENABLE, 0);

	free_irq(lynx->pci_device->irq, lynx);



fail_deallocate:

fail_deallocate_buffers:

	if (lynx->rcv_start_pcl)

		pci_free_consistent(lynx->pci_device, sizeof(struct pcl),

				lynx->rcv_start_pcl, lynx->rcv_start_pcl_bus);
@@ -679,6 +684,8 @@ add_card(struct pci_dev *dev, const struct pci_device_id *unused) 
		pci_free_consistent(lynx->pci_device, PAGE_SIZE,

				lynx->rcv_buffer, lynx->rcv_buffer_bus);

	iounmap(lynx->registers);



fail_deallocate_lynx:

	kfree(lynx);



fail_disable: