Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1633327 > unrolled thread
| Started by | Alexey Khoroshilov <khoroshilov@ispras.ru> |
|---|---|
| First post | 2017-04-29 21:40 +0200 |
| Last post | 2017-05-02 13:40 +0200 |
| Articles | 2 — 2 participants |
Back to article view | Back to linux.kernel
[PATCH] m501fb: don't return zero on failure path in sm501fb_start() Alexey Khoroshilov <khoroshilov@ispras.ru> - 2017-04-29 21:40 +0200
Re: [PATCH] m501fb: don't return zero on failure path in sm501fb_start() Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> - 2017-05-02 13:40 +0200
| From | Alexey Khoroshilov <khoroshilov@ispras.ru> |
|---|---|
| Date | 2017-04-29 21:40 +0200 |
| Subject | [PATCH] m501fb: don't return zero on failure path in sm501fb_start() |
| Message-ID | <tBGnN-1QW-37@gated-at.bofh.it> |
If fbmem iomemory mapping failed, sm501fb_start() breaks off
initialization, deallocates resources, but returns zero.
As a result, double deallocation can happen in sm501fb_stop().
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
---
drivers/video/fbdev/sm501fb.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/video/fbdev/sm501fb.c b/drivers/video/fbdev/sm501fb.c
index d80bc8a3200f..67e314fdd947 100644
--- a/drivers/video/fbdev/sm501fb.c
+++ b/drivers/video/fbdev/sm501fb.c
@@ -1600,6 +1600,7 @@ static int sm501fb_start(struct sm501fb_info *info,
info->fbmem = ioremap(res->start, resource_size(res));
if (info->fbmem == NULL) {
dev_err(dev, "cannot remap framebuffer\n");
+ ret = -ENXIO;
goto err_mem_res;
}
--
2.7.4
[toc] | [next] | [standalone]
| From | Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> |
|---|---|
| Date | 2017-05-02 13:40 +0200 |
| Subject | Re: [PATCH] m501fb: don't return zero on failure path in sm501fb_start() |
| Message-ID | <tCEjT-67E-3@gated-at.bofh.it> |
| In reply to | #1633327 |
On Saturday, April 29, 2017 09:33:39 PM Alexey Khoroshilov wrote: > If fbmem iomemory mapping failed, sm501fb_start() breaks off > initialization, deallocates resources, but returns zero. > As a result, double deallocation can happen in sm501fb_stop(). > > Found by Linux Driver Verification project (linuxtesting.org). > > Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> Patch queued for 4.12, thanks. Best regards, -- Bartlomiej Zolnierkiewicz Samsung R&D Institute Poland Samsung Electronics
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web