Commit e9f28990 authored Nov 23, 2023 by Dan Carpenter Committed by Zheng Zengkai Nov 23, 2023

fbdev: imsttfb: fix double free in probe()

stable inclusion
from stable-v6.6.2
commit 85fd4eb8f6f85c82a0788cd3daa88cef2568c050
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I8IW7G

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=85fd4eb8f6f85c82a0788cd3daa88cef2568c050



--------------------------------

[ Upstream commit e08c30efda21ef4c0ec084a3a9581c220b442ba9 ]

The init_imstt() function calls framebuffer_release() on error and then
the probe() function calls it again.  It should only be done in probe.

Fixes: 518ecb6a ("fbdev: imsttfb: Fix error path of imsttfb_probe()")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Zheng Zengkai <zhengzengkai@huawei.com>

parent 63be3d48

drivers/video/fbdev/imsttfb.c

+1 −5

Original line number	Diff line number	Diff line
		@@ -1419,7 +1419,6 @@ static int init_imstt(struct fb_info *info)
		if ((info->var.xres * info->var.yres) * (info->var.bits_per_pixel >> 3) > info->fix.smem_len
		\|\| !(compute_imstt_regvals(par, info->var.xres, info->var.yres))) {
		printk("imsttfb: %ux%ux%u not supported\n", info->var.xres, info->var.yres, info->var.bits_per_pixel);
		framebuffer_release(info);
		return -ENODEV;
		}

		@@ -1451,14 +1450,11 @@ static int init_imstt(struct fb_info *info)
		FBINFO_HWACCEL_FILLRECT \|
		FBINFO_HWACCEL_YPAN;

		if (fb_alloc_cmap(&info->cmap, 0, 0)) {
		framebuffer_release(info);
		if (fb_alloc_cmap(&info->cmap, 0, 0))
		return -ENODEV;
		}

		if (register_framebuffer(info) < 0) {
		fb_dealloc_cmap(&info->cmap);
		framebuffer_release(info);
		return -ENODEV;
		}