Commit e47f8897 authored by Dan Carpenter's avatar Dan Carpenter Committed by sanglipeng
Browse files

fbdev: imsttfb: fix a resource leak in probe 

stable inclusion
from stable-v5.10.201
commit a4dfebec32ec6d420a5506dd56a7834c91be28e4
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I9DFT4

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a4dfebec32ec6d420a5506dd56a7834c91be28e4



--------------------------------

[ Upstream commit aba6ab57a910ad4b940c2024d15f2cdbf5b7f76b ]

I've re-written the error handling but the bug is that if init_imstt()
fails we need to call iounmap(par->cmap_regs).

Fixes: c75f5a55 ("fbdev: imsttfb: Fix use after free bug in imsttfb_probe")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: default avatarHelge Deller <deller@gmx.de>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarsanglipeng <sanglipeng1@jd.com>
parent dd86702b

drivers/video/fbdev/imsttfb.c

+16 −13
Original line number Diff line number Diff line
@@ -1489,8 +1489,8 @@ static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent) 


	if (!request_mem_region(addr, size, "imsttfb")) {

		printk(KERN_ERR "imsttfb: Can't reserve memory region\n");

		framebuffer_release(info);

		return -ENODEV;

		ret = -ENODEV;

		goto release_info;

	}



	switch (pdev->device) {
@@ -1507,36 +1507,39 @@ static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent) 
			printk(KERN_INFO "imsttfb: Device 0x%x unknown, "

					 "contact maintainer.\n", pdev->device);

			ret = -ENODEV;

			goto error;

			goto release_mem_region;

	}



	info->fix.smem_start = addr;

	info->screen_base = (__u8 *)ioremap(addr, par->ramdac == IBM ?

					    0x400000 : 0x800000);

	if (!info->screen_base)

		goto error;

		goto release_mem_region;

	info->fix.mmio_start = addr + 0x800000;

	par->dc_regs = ioremap(addr + 0x800000, 0x1000);

	if (!par->dc_regs)

		goto error;

		goto unmap_screen_base;

	par->cmap_regs_phys = addr + 0x840000;

	par->cmap_regs = (__u8 *)ioremap(addr + 0x840000, 0x1000);

	if (!par->cmap_regs)

		goto error;

		goto unmap_dc_regs;

	info->pseudo_palette = par->palette;

	ret = init_imstt(info);

	if (ret)

		goto error;

		goto unmap_cmap_regs;



	pci_set_drvdata(pdev, info);

	return ret;

	return 0;



error:

	if (par->dc_regs)

unmap_cmap_regs:

	iounmap(par->cmap_regs);

unmap_dc_regs:

	iounmap(par->dc_regs);

	if (info->screen_base)

unmap_screen_base:

	iounmap(info->screen_base);

release_mem_region:

	release_mem_region(addr, size);

release_info:

	framebuffer_release(info);

	return ret;

}