From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f173.google.com (mail-pg1-f173.google.com [209.85.215.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6271D3876C3 for ; Sun, 7 Jun 2026 09:34:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.173 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780824895; cv=none; b=rjhyI1xyCeRz6K/lDe9JJzr+dm3B61lScaQIM1lCeT0B4ezxZjpTiWYGKIB8Lk6nBaaNwbg/ImGwRrcmh9YMo2K/aiwEwWVaHF0W4Z4e7E0N0rxCwuIBrRgUOoRqFF+6I/v4Q9/t7LZR/+CQykmfDhhLRha3sFCm1p7mtgThrew= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780824895; c=relaxed/simple; bh=XZNO/dMYz7iEoOPztsqYTgBrQMIq5mHqnV3TdOMETxQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=kOzHXjLanmRAom1v/NA0KRL2I3C++jF3i3z1gprYf+WJNV/GnWStCGl1UO/oPgKMFJVaVLrxTthIk58P8mF/jGP1JWSIMlaZ96JiNgyyQyYjwYy/KhBApXmBZS3rg6apxD25YnP1DtP/+V5IbXY5NgkdJMbW6EdsnuP5i+q4W/8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=QGaoe+L6; arc=none smtp.client-ip=209.85.215.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="QGaoe+L6" Received: by mail-pg1-f173.google.com with SMTP id 41be03b00d2f7-c8585c51f1fso1773398a12.1 for ; Sun, 07 Jun 2026 02:34:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780824893; x=1781429693; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=qhNIyFU6pXaHy3wDWlIE/kVbXCP3f3vZ03DuRBWJyCI=; b=QGaoe+L6rZvo+hd64EVeVex9sBDvIZ6RvQBpP5JFSQR4mY2oiAEB8mLLuATRDdTSvE jxFDkCrD4rSHrPi5mFuYI5wczt59NyLQFIp5FT3GVLOpShZpHaweJohEr41/NkkjKTQN k/CRCpwSK9XTYj6C/w/xfEEcyNF0/SdYRAcShw7LZ1YoO7R96YYGlG3SsIhIGkVzDm4E EuZmSJzK8UrogQNn5eWJ8/W6WgrvCuqarURr+ktWPI3eMmEb18tUPeJQtJCFHyyXcePK ZQvL3EcZZuWiMoJNSzU+n5E7kupfVYviBVwZr/GQXbwZdaVbG0cFTv0eFlDNR5DxeJvc jJ6A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780824893; x=1781429693; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=qhNIyFU6pXaHy3wDWlIE/kVbXCP3f3vZ03DuRBWJyCI=; b=NgedgQG+LsSkE2yXjxUgtNikheV3Q0yALESL7ncgCtq65MJl5LOt3JmI8oP1xqs5/W Jytyzu/VY31F2tX6xtGU9oqT+q0w98I2ZzHJ8X0PQOckEyYYoY+OxtBXkEHQMgkgvH5n BIiQRN0KBhFKleZtiixQVA4XlijxD92f/txCeL2/NV22UbzshSSqIHcf6KHuhgdK6X5o EgSVepojg4uh7Mc2QSJ0bVHBukPXycDjBc89R1Vxn1jB4xxQnWAcbDL1W3VkERw9DN9s clZiZnCGQFPyYOEWY73Q4XdMat+SGysAdgLjPPAK+yVmWYqvEiaEce5yvZgcncS2B5hH BSRQ== X-Gm-Message-State: AOJu0YybPqRlXiYNUY9xk5/rNkfximyR+moejZYytuzOnVPVP8FgYh7R y6TQTxv7FbT01QXH8psw5a8V12GyBboay1Qo4Ef9EbrAlzdl78UruT/dNAYecXpKrsc= X-Gm-Gg: Acq92OFU2m/z8IPs4AiwC17PaM4F/XkxHWHBMJ/7rWyfSgZW4hY9ey67wCvIkgPYy3r vsmwYC2h24+s6Y0CQL4PaYn8OHJ31N3Utb0O+dma2/ORPt8yRfJ1mfZYBL8QTtx+TlYBtR/uT2J 3ayEm8oikDWjXWL+QzZamlQXjLY9843FXBDkhPx9cyibchfJTXx3j/Pg2F2pqtas5HwSCxwX1Gx Kid+BnRZjjEnmGjpzj+2C7mKVJNbJIfQuAOPD7i8tg/VAKVmwCGgOD9uv40Elx7oUkULR3mI2Mo EpcUiPKu5sOgGu5vV/U2KL7AAcR7CgrjmnUI1joJnWCxQ3bdeXS/N0tkF3miCeYmTbeTKqRhrwE 4LmU4JYe8uLfZzGihdd03p4G6ogMJuKHLOjF39gnhT+8T31xrHaeVB2nX+LXIAKiF9I6x+b5RyB sjFJL9mw7LVIAQpG3qGFGOzcOcWIyDYWsNKSfuLALgfTbGKTFoVZ/k X-Received: by 2002:a17:903:1b6c:b0:2ba:6601:8e3d with SMTP id d9443c01a7336-2c1ec513601mr88675535ad.9.1780824893482; Sun, 07 Jun 2026 02:34:53 -0700 (PDT) Received: from haichao.tail057a43.ts.net ([2001:da8:e000:1206:5d57:2cec:64ac:50a]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2c164f6d59csm139016845ad.4.2026.06.07.02.34.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 07 Jun 2026 02:34:53 -0700 (PDT) From: Ruoyu Wang To: Dave Penkler Cc: linux-kernel@vger.kernel.org, Ruoyu Wang Subject: [PATCH 2/2] gpib: agilent_82350b: check register mappings Date: Sun, 7 Jun 2026 17:34:45 +0800 Message-ID: <20260607093445.3-3-ruoyuw560@gmail.com> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20260607093445.3-1-ruoyuw560@gmail.com> References: <20260607093445.3-1-ruoyuw560@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit agilent_82350b_generic_attach() maps several PCI BARs and then uses the returned pointers for hardware setup and SRAM testing. Any failed ioremap() can therefore lead to a NULL pointer dereference during attach. Check each mapping and route attach failures through the common detach path. Since detach can now run before all mappings are present, unmap each mapping independently and release PCI regions only after pci_request_regions() succeeded. Signed-off-by: Ruoyu Wang --- drivers/gpib/agilent_82350b/agilent_82350b.c | 80 +++++++++++++++----- drivers/gpib/agilent_82350b/agilent_82350b.h | 1 + 2 files changed, 61 insertions(+), 20 deletions(-) diff --git a/drivers/gpib/agilent_82350b/agilent_82350b.c b/drivers/gpib/agilent_82350b/agilent_82350b.c index 9787c09fa..aae3d54f5 100644 --- a/drivers/gpib/agilent_82350b/agilent_82350b.c +++ b/drivers/gpib/agilent_82350b/agilent_82350b.c @@ -634,68 +634,103 @@ static int agilent_82350b_generic_attach(struct gpib_board *board, dev_dbg(board->gpib_dev, "HP/Agilent 82350A board found\n"); } else { dev_err(board->gpib_dev, "no 82350/82351 board found\n"); - return -ENODEV; + retval = -ENODEV; + goto err_detach; } } } if (pci_enable_device(a_priv->pci_device)) { dev_err(board->gpib_dev, "error enabling pci device\n"); - return -EIO; + retval = -EIO; + goto err_detach; } - if (pci_request_regions(a_priv->pci_device, DRV_NAME)) - return -ENOMEM; + if (pci_request_regions(a_priv->pci_device, DRV_NAME)) { + retval = -ENOMEM; + goto err_detach; + } + a_priv->regions_requested = true; switch (a_priv->model) { case MODEL_82350A: a_priv->plx_base = ioremap(pci_resource_start(a_priv->pci_device, PLX_MEM_REGION), pci_resource_len(a_priv->pci_device, PLX_MEM_REGION)); + if (!a_priv->plx_base) { + retval = -ENOMEM; + goto err_detach; + } dev_dbg(board->gpib_dev, "plx base address remapped to 0x%p\n", a_priv->plx_base); a_priv->gpib_base = ioremap(pci_resource_start(a_priv->pci_device, GPIB_82350A_REGION), pci_resource_len(a_priv->pci_device, GPIB_82350A_REGION)); + if (!a_priv->gpib_base) { + retval = -ENOMEM; + goto err_detach; + } dev_dbg(board->gpib_dev, "chip base address remapped to 0x%p\n", a_priv->gpib_base); tms_priv->mmiobase = a_priv->gpib_base + TMS9914_BASE_REG; a_priv->sram_base = ioremap(pci_resource_start(a_priv->pci_device, SRAM_82350A_REGION), pci_resource_len(a_priv->pci_device, SRAM_82350A_REGION)); + if (!a_priv->sram_base) { + retval = -ENOMEM; + goto err_detach; + } dev_dbg(board->gpib_dev, "sram base address remapped to 0x%p\n", a_priv->sram_base); a_priv->borg_base = ioremap(pci_resource_start(a_priv->pci_device, BORG_82350A_REGION), pci_resource_len(a_priv->pci_device, BORG_82350A_REGION)); + if (!a_priv->borg_base) { + retval = -ENOMEM; + goto err_detach; + } dev_dbg(board->gpib_dev, "borg base address remapped to 0x%p\n", a_priv->borg_base); retval = init_82350a_hardware(board, config); if (retval < 0) - return retval; + goto err_detach; break; case MODEL_82350B: case MODEL_82351A: a_priv->gpib_base = ioremap(pci_resource_start(a_priv->pci_device, GPIB_REGION), pci_resource_len(a_priv->pci_device, GPIB_REGION)); + if (!a_priv->gpib_base) { + retval = -ENOMEM; + goto err_detach; + } dev_dbg(board->gpib_dev, "chip base address remapped to 0x%p\n", a_priv->gpib_base); tms_priv->mmiobase = a_priv->gpib_base + TMS9914_BASE_REG; a_priv->sram_base = ioremap(pci_resource_start(a_priv->pci_device, SRAM_REGION), pci_resource_len(a_priv->pci_device, SRAM_REGION)); + if (!a_priv->sram_base) { + retval = -ENOMEM; + goto err_detach; + } dev_dbg(board->gpib_dev, "sram base address remapped to 0x%p\n", a_priv->sram_base); a_priv->misc_base = ioremap(pci_resource_start(a_priv->pci_device, MISC_REGION), pci_resource_len(a_priv->pci_device, MISC_REGION)); + if (!a_priv->misc_base) { + retval = -ENOMEM; + goto err_detach; + } dev_dbg(board->gpib_dev, "misc base address remapped to 0x%p\n", a_priv->misc_base); break; default: dev_err(board->gpib_dev, "invalid board\n"); - return -ENODEV; + retval = -ENODEV; + goto err_detach; } retval = test_sram(board); if (retval < 0) - return retval; + goto err_detach; if (request_irq(a_priv->pci_device->irq, agilent_82350b_interrupt, IRQF_SHARED, DRV_NAME, board)) { dev_err(board->gpib_dev, "failed to obtain irq %d\n", a_priv->pci_device->irq); - return -EIO; + retval = -EIO; + goto err_detach; } a_priv->irq = a_priv->pci_device->irq; dev_dbg(board->gpib_dev, " IRQ %d\n", a_priv->irq); @@ -730,6 +765,10 @@ static int agilent_82350b_generic_attach(struct gpib_board *board, tms9914_online(board, tms_priv); return 0; + +err_detach: + agilent_82350b_detach(board); + return retval; } static int agilent_82350b_unaccel_attach(struct gpib_board *board, @@ -756,20 +795,21 @@ static void agilent_82350b_detach(struct gpib_board *board) tms_priv = &a_priv->tms9914_priv; if (a_priv->irq) free_irq(a_priv->irq, board); - if (a_priv->gpib_base) { + if (a_priv->gpib_base) tms9914_board_reset(tms_priv); - if (a_priv->misc_base) - iounmap(a_priv->misc_base); - if (a_priv->borg_base) - iounmap(a_priv->borg_base); - if (a_priv->sram_base) - iounmap(a_priv->sram_base); - if (a_priv->gpib_base) - iounmap(a_priv->gpib_base); - if (a_priv->plx_base) - iounmap(a_priv->plx_base); + + if (a_priv->misc_base) + iounmap(a_priv->misc_base); + if (a_priv->borg_base) + iounmap(a_priv->borg_base); + if (a_priv->sram_base) + iounmap(a_priv->sram_base); + if (a_priv->gpib_base) + iounmap(a_priv->gpib_base); + if (a_priv->plx_base) + iounmap(a_priv->plx_base); + if (a_priv->regions_requested) pci_release_regions(a_priv->pci_device); - } if (a_priv->pci_device) pci_dev_put(a_priv->pci_device); } diff --git a/drivers/gpib/agilent_82350b/agilent_82350b.h b/drivers/gpib/agilent_82350b/agilent_82350b.h index ef8419572..aa40777fd 100644 --- a/drivers/gpib/agilent_82350b/agilent_82350b.h +++ b/drivers/gpib/agilent_82350b/agilent_82350b.h @@ -54,6 +54,7 @@ struct agilent_82350b_priv { unsigned short card_mode_bits; unsigned short event_status_bits; enum board_model model; + bool regions_requested; bool using_fifos; }; -- 2.51.0