Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fd8f21c9 authored by Igor Matheus Andrade Torrente's avatar Igor Matheus Andrade Torrente Committed by Greg Kroah-Hartman
Browse files

video: hgafb: fix potential NULL pointer dereference 



commit dc13cac4862cc68ec74348a80b6942532b7735fa upstream.

The return of ioremap if not checked, and can lead to a NULL to be
assigned to hga_vram. Potentially leading to a NULL pointer
dereference.

The fix adds code to deal with this case in the error label and
changes how the hgafb_probe handles the return of hga_card_detect.

Cc: Ferenc Bakonyi <fero@drama.obuda.kando.hu>
Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: default avatarIgor Matheus Andrade Torrente <igormtorrente@gmail.com>
Link: https://lore.kernel.org/r/20210503115736.2104747-40-gregkh@linuxfoundation.org


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 2ca93aca

drivers/video/fbdev/hgafb.c

+13 −8
Original line number Diff line number Diff line
@@ -285,6 +285,8 @@ static int hga_card_detect(void) 
	hga_vram_len  = 0x08000;



	hga_vram = ioremap(0xb0000, hga_vram_len);

	if (!hga_vram)

		return -ENOMEM;



	if (request_region(0x3b0, 12, "hgafb"))

		release_io_ports = 1;
@@ -344,13 +346,18 @@ static int hga_card_detect(void) 
			hga_type_name = "Hercules";

			break;

	}

	return 1;

	return 0;

error:

	if (release_io_ports)

		release_region(0x3b0, 12);

	if (release_io_port)

		release_region(0x3bf, 1);

	return 0;



	iounmap(hga_vram);



	pr_err("hgafb: HGA card not detected.\n");



	return -EINVAL;

}



/**
@@ -548,13 +555,11 @@ static struct fb_ops hgafb_ops = { 
static int hgafb_probe(struct platform_device *pdev)

{

	struct fb_info *info;

	int ret;



	if (! hga_card_detect()) {

		printk(KERN_INFO "hgafb: HGA card not detected.\n");

		if (hga_vram)

			iounmap(hga_vram);

		return -EINVAL;

	}

	ret = hga_card_detect();

	if (!ret)

		return ret;



	printk(KERN_INFO "hgafb: %s with %ldK of memory detected.\n",

		hga_type_name, hga_vram_len/1024);