From patchwork Thu Apr 14 13:11:17 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 562302 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 15ACDC41535 for ; Thu, 14 Apr 2022 14:00:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345895AbiDNNyo (ORCPT ); Thu, 14 Apr 2022 09:54:44 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34732 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S244542AbiDNNqX (ORCPT ); Thu, 14 Apr 2022 09:46:23 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 539A03E5CF; Thu, 14 Apr 2022 06:43:44 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id CB63AB828E6; Thu, 14 Apr 2022 13:43:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 190C7C385A1; Thu, 14 Apr 2022 13:43:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649943821; bh=4pm0G3USxRvKEi6HUBlG9gAVAVKFBCngUYORUfw9HaE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WLUDSvBwTn5tHEfnXvtShrN1+jkFccbKbXBDwf9lBcg7G3IwTtTrSx2H5gnl4pCWc 5RwZ9gdfgzDH1VPaZsvUFWBvUJL2N/ExOTpWT3nNo9L0wWPue9G/3hLAdLCl0SJpsh CgHoWB1GaXW0X2K7iN5s22IQqcQcNQvY6ViBgnIs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Evgeny Novikov , Kirill Shilimanov , Helge Deller , Sasha Levin Subject: [PATCH 5.4 292/475] video: fbdev: w100fb: Reset global state Date: Thu, 14 Apr 2022 15:11:17 +0200 Message-Id: <20220414110903.268074001@linuxfoundation.org> X-Mailer: git-send-email 2.35.2 In-Reply-To: <20220414110855.141582785@linuxfoundation.org> References: <20220414110855.141582785@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Evgeny Novikov [ Upstream commit 8738ddcac644964ae128ccd3d80d48773c8d528e ] w100fb_probe() did not reset the global state to its initial state. This can result in invocation of iounmap() even when there was not the appropriate successful call of ioremap(). For instance, this may be the case if first probe fails after two successful ioremap() while second probe fails when first ioremap() fails. The similar issue is with w100fb_remove(). The patch fixes both bugs. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Evgeny Novikov Co-developed-by: Kirill Shilimanov Signed-off-by: Kirill Shilimanov Signed-off-by: Helge Deller Signed-off-by: Sasha Levin --- drivers/video/fbdev/w100fb.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/drivers/video/fbdev/w100fb.c b/drivers/video/fbdev/w100fb.c index e30f9427b335..52ec80bbfe5e 100644 --- a/drivers/video/fbdev/w100fb.c +++ b/drivers/video/fbdev/w100fb.c @@ -770,12 +770,18 @@ int w100fb_probe(struct platform_device *pdev) fb_dealloc_cmap(&info->cmap); kfree(info->pseudo_palette); } - if (remapped_fbuf != NULL) + if (remapped_fbuf != NULL) { iounmap(remapped_fbuf); - if (remapped_regs != NULL) + remapped_fbuf = NULL; + } + if (remapped_regs != NULL) { iounmap(remapped_regs); - if (remapped_base != NULL) + remapped_regs = NULL; + } + if (remapped_base != NULL) { iounmap(remapped_base); + remapped_base = NULL; + } if (info) framebuffer_release(info); return err; @@ -795,8 +801,11 @@ static int w100fb_remove(struct platform_device *pdev) fb_dealloc_cmap(&info->cmap); iounmap(remapped_base); + remapped_base = NULL; iounmap(remapped_regs); + remapped_regs = NULL; iounmap(remapped_fbuf); + remapped_fbuf = NULL; framebuffer_release(info);