Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 382e1931 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

fbdev: imsttfb: fix a resource leak in probe 



[ Upstream commit aba6ab57a910ad4b940c2024d15f2cdbf5b7f76b ]

I've re-written the error handling but the bug is that if init_imstt()
fails we need to call iounmap(par->cmap_regs).

Fixes: c75f5a550610 ("fbdev: imsttfb: Fix use after free bug in imsttfb_probe")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: default avatarHelge Deller <deller@gmx.de>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 601d5b6a

drivers/video/fbdev/imsttfb.c

+16 −13
Original line number Diff line number Diff line
@@ -1493,8 +1493,8 @@ static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent) 


	if (!request_mem_region(addr, size, "imsttfb")) {

		printk(KERN_ERR "imsttfb: Can't reserve memory region\n");

		framebuffer_release(info);

		return -ENODEV;

		ret = -ENODEV;

		goto release_info;

	}



	switch (pdev->device) {
@@ -1511,36 +1511,39 @@ static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent) 
			printk(KERN_INFO "imsttfb: Device 0x%x unknown, "

					 "contact maintainer.\n", pdev->device);

			ret = -ENODEV;

			goto error;

			goto release_mem_region;

	}



	info->fix.smem_start = addr;

	info->screen_base = (__u8 *)ioremap(addr, par->ramdac == IBM ?

					    0x400000 : 0x800000);

	if (!info->screen_base)

		goto error;

		goto release_mem_region;

	info->fix.mmio_start = addr + 0x800000;

	par->dc_regs = ioremap(addr + 0x800000, 0x1000);

	if (!par->dc_regs)

		goto error;

		goto unmap_screen_base;

	par->cmap_regs_phys = addr + 0x840000;

	par->cmap_regs = (__u8 *)ioremap(addr + 0x840000, 0x1000);

	if (!par->cmap_regs)

		goto error;

		goto unmap_dc_regs;

	info->pseudo_palette = par->palette;

	ret = init_imstt(info);

	if (ret)

		goto error;

		goto unmap_cmap_regs;



	pci_set_drvdata(pdev, info);

	return ret;

	return 0;



error:

	if (par->dc_regs)

unmap_cmap_regs:

	iounmap(par->cmap_regs);

unmap_dc_regs:

	iounmap(par->dc_regs);

	if (info->screen_base)

unmap_screen_base:

	iounmap(info->screen_base);

release_mem_region:

	release_mem_region(addr, size);

release_info:

	framebuffer_release(info);

	return ret;

}