Return-Path: Received: from mail-cys01nam02on0096.outbound.protection.outlook.com ([104.47.37.96]:45952 "EHLO NAM02-CY1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S966507AbeCHFHD (ORCPT ); Thu, 8 Mar 2018 00:07:03 -0500 From: Sasha Levin To: "linux-kernel@vger.kernel.org" , "stable@vger.kernel.org" CC: Alexey Khoroshilov , Tomi Valkeinen , Bartlomiej Zolnierkiewicz , Sasha Levin Subject: [PATCH AUTOSEL for 4.4 072/101] sm501fb: don't return zero on failure path in sm501fb_start() Date: Thu, 8 Mar 2018 05:02:02 +0000 Message-ID: <20180308050023.8548-72-alexander.levin@microsoft.com> References: <20180308050023.8548-1-alexander.levin@microsoft.com> In-Reply-To: <20180308050023.8548-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: From: Alexey Khoroshilov [ Upstream commit dc85e9a87420613b3129d5cc5ecd79c58351c546 ] If fbmem iomemory mapping failed, sm501fb_start() breaks off initialization, deallocates resources, but returns zero. As a result, double deallocation can happen in sm501fb_stop(). Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov Cc: Tomi Valkeinen Signed-off-by: Bartlomiej Zolnierkiewicz Signed-off-by: Sasha Levin --- drivers/video/fbdev/sm501fb.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/video/fbdev/sm501fb.c b/drivers/video/fbdev/sm501fb.c index d0a4e2f79a57..d215faacce04 100644 --- a/drivers/video/fbdev/sm501fb.c +++ b/drivers/video/fbdev/sm501fb.c @@ -1600,6 +1600,7 @@ static int sm501fb_start(struct sm501fb_info *info, info->fbmem =3D ioremap(res->start, resource_size(res)); if (info->fbmem =3D=3D NULL) { dev_err(dev, "cannot remap framebuffer\n"); + ret =3D -ENXIO; goto err_mem_res; } =20 --=20 2.14.1