Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1aca75fc authored by Alexey Khoroshilov's avatar Alexey Khoroshilov Committed by Greg Kroah-Hartman
Browse files

sm501fb: don't return zero on failure path in sm501fb_start() 




[ Upstream commit dc85e9a87420613b3129d5cc5ecd79c58351c546 ]

If fbmem iomemory mapping failed, sm501fb_start() breaks off
initialization, deallocates resources, but returns zero.
As a result, double deallocation can happen in sm501fb_stop().

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: default avatarBartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: default avatarSasha Levin <alexander.levin@microsoft.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 86fafbe4

drivers/video/fbdev/sm501fb.c

+1 −0
Original line number Diff line number Diff line
@@ -1600,6 +1600,7 @@ static int sm501fb_start(struct sm501fb_info *info, 
	info->fbmem = ioremap(res->start, resource_size(res));

	if (info->fbmem == NULL) {

		dev_err(dev, "cannot remap framebuffer\n");

		ret = -ENXIO;

		goto err_mem_res;

	}