* [PATCH] m501fb: don't return zero on failure path in sm501fb_start() @ 2017-04-29 19:33 ` Alexey Khoroshilov 2017-05-02 11:29 ` Bartlomiej Zolnierkiewicz 0 siblings, 1 reply; 2+ messages in thread From: Alexey Khoroshilov @ 2017-04-29 19:33 UTC (permalink / raw) To: Bartlomiej Zolnierkiewicz, Tomi Valkeinen Cc: Alexey Khoroshilov, linux-fbdev, linux-kernel, ldv-project If fbmem iomemory mapping failed, sm501fb_start() breaks off initialization, deallocates resources, but returns zero. As a result, double deallocation can happen in sm501fb_stop(). Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> --- drivers/video/fbdev/sm501fb.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/video/fbdev/sm501fb.c b/drivers/video/fbdev/sm501fb.c index d80bc8a3200f..67e314fdd947 100644 --- a/drivers/video/fbdev/sm501fb.c +++ b/drivers/video/fbdev/sm501fb.c @@ -1600,6 +1600,7 @@ static int sm501fb_start(struct sm501fb_info *info, info->fbmem = ioremap(res->start, resource_size(res)); if (info->fbmem == NULL) { dev_err(dev, "cannot remap framebuffer\n"); + ret = -ENXIO; goto err_mem_res; } -- 2.7.4 ^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH] m501fb: don't return zero on failure path in sm501fb_start() 2017-04-29 19:33 ` [PATCH] m501fb: don't return zero on failure path in sm501fb_start() Alexey Khoroshilov @ 2017-05-02 11:29 ` Bartlomiej Zolnierkiewicz 0 siblings, 0 replies; 2+ messages in thread From: Bartlomiej Zolnierkiewicz @ 2017-05-02 11:29 UTC (permalink / raw) To: Alexey Khoroshilov; +Cc: Tomi Valkeinen, linux-fbdev, linux-kernel, ldv-project On Saturday, April 29, 2017 09:33:39 PM Alexey Khoroshilov wrote: > If fbmem iomemory mapping failed, sm501fb_start() breaks off > initialization, deallocates resources, but returns zero. > As a result, double deallocation can happen in sm501fb_stop(). > > Found by Linux Driver Verification project (linuxtesting.org). > > Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> Patch queued for 4.12, thanks. Best regards, -- Bartlomiej Zolnierkiewicz Samsung R&D Institute Poland Samsung Electronics ^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-05-02 11:29 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <CGME20170429193354epcas1p49764e384389a15121894ef6a032b791f@epcas1p4.samsung.com>
2017-04-29 19:33 ` [PATCH] m501fb: don't return zero on failure path in sm501fb_start() Alexey Khoroshilov
2017-05-02 11:29 ` Bartlomiej Zolnierkiewicz
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®