drivers/video/fbcmap.c kmalloc audit

1/1

 	    cmap->transp = NULL;
     }
@@ -113,6 +113,17 @@
     cmap->len = len;
     fb_copy_cmap(fb_default_cmap(len), cmap, 0);
     return 0;
+    cmap->red = cmap->green = cmap->blue = cmap->transp = NULL;
+    cmap->len = 0;
+    return -1;
         vga16fb.screen_base = ioremap(VGA_FB_PHYS, VGA_FB_PHYS_LEN);
 {
     unregister_framebuffer(&vga16fb);
     iounmap(vga16fb.screen_base);
+    fb_dealloc_cmap(&vga16fb.cmap);
     /* XXX unshare VGA regions */
@@ -98,14 +98,14 @@
 	if (!len)
 	    return 0;
 	if (!(cmap->red = kmalloc(size, GFP_ATOMIC)))
-	    return -1;
+	    goto err_red;
 	if (!(cmap->green = kmalloc(size, GFP_ATOMIC)))
-	    return -1;
+	    goto err_green;
 	if (!(cmap->blue = kmalloc(size, GFP_ATOMIC)))
-	    return -1;
+	    goto err_blue;
 	if (transp) {
 	    if (!(cmap->transp = kmalloc(size, GFP_ATOMIC)))
-		return -1;
+		goto err_transp;
 	} else
 	    cmap->transp = NULL;
     }

@@ -113,6 +113,17 @@
     cmap->len = len;
     fb_copy_cmap(fb_default_cmap(len), cmap, 0);
     return 0;
+

+ err_transp:
+    kfree(cmap->blue);
+ err_blue:
+    kfree(cmap->green);
+ err_green:
+    kfree(cmap->red);
+ err_red:
+    cmap->red = cmap->green = cmap->blue = cmap->transp = NULL;
+    cmap->len = 0;
+    return -1;

|+ err_transp:
|+    kfree(cmap->blue);
|+ err_blue:
|+    kfree(cmap->green);
|+ err_green:
|+    kfree(cmap->red);
|+ err_red:
|+    cmap->red = cmap->green = cmap->blue = cmap->transp = NULL;
|+    cmap->len = 0;
|+    return -1;  <--+
                     |
Daniele.




"I could have made money this way, and perhaps amused myself writing code. 
But I knew that at the end of my career, I would look back on years of 
building walls to divide people, and feel I had spent my life making the 
world a worse place."                               
                                                          Richard Stallman

_______________________________________________
Kernel-janitors mailing list
[email protected]
http://lists.osdl.org/mailman/listinfo/kernel-janitors
| 
| |+ err_transp:
| |+    kfree(cmap->blue);
| |+ err_blue:
| |+    kfree(cmap->green);
| |+ err_green:
| |+    kfree(cmap->red);
| |+ err_red:
| |+    cmap->red = cmap->green = cmap->blue = cmap->transp = NULL;
| |+    cmap->len = 0;
| |+    return -1;  <--+
|                      |
| ---------------------+
| |
| +-> IMHO "return -1" should be replaced with "return -ENOMEM"
|On Tue, 27 Jan 2004 22:54:19 +0100 Daniele Bellucci <[email protected]> wrote:
|
|| 
|| |+ err_transp:
|| |+    kfree(cmap->blue);
|| |+ err_blue:
|| |+    kfree(cmap->green);
|| |+ err_green:
|| |+    kfree(cmap->red);
|| |+ err_red:
|| |+    cmap->red = cmap->green = cmap->blue = cmap->transp = NULL;
|| |+    cmap->len = 0;
|| |+    return -1;  <--+
||                      |
|| ---------------------+
|| |
|| +-> IMHO "return -1" should be replaced with "return -ENOMEM"
|
|
|Maybe in theory.  In practice it is documented to return 0 for
|success or -1 on error.  Changing that would require auditing all
|callers of it....
Daniele.




"I could have made money this way, and perhaps amused myself writing code. 
But I knew that at the end of my career, I would look back on years of 
building walls to divide people, and feel I had spent my life making the 
world a worse place."                               
                                                          Richard Stallman

_______________________________________________
Kernel-janitors mailing list
[email protected]
http://lists.osdl.org/mailman/listinfo/kernel-janitors
 {
         struct fb_info *info = &rinfo->info;
         var = radeonfb_default_var;
         if ((radeon_init_disp_var(rinfo, &var)) < 0)
 	var.activate = FB_ACTIVATE_NOW;
         return 0;
 {
         struct radeonfb_info *rinfo = pci_get_drvdata(pdev);
- 
+        struct fb_info *info = &rinfo->info;
+
         if (!rinfo)
                 return;
         unregister_framebuffer ((struct fb_info *) rinfo);
-                
+	fb_dealloc_cmap(&info->cmap);
         iounmap ((void*)rinfo->mmio_base);
         iounmap ((void*)rinfo->fb_base);
@@ -2806,7 +2809,9 @@
 {
 	struct radeonfb_info *rinfo;
 	struct radeon_chip_info *rci = &radeon_chip_info[ent->driver_data];
+        struct fb_info *info;

 	/* map the regions */
 	rinfo->mmio_base = (unsigned long) ioremap (rinfo->mmio_base_phys,
 RADEON_REGSIZE);

@@ -100,14 +100,6 @@
 #define DEFRW()		mb()
 #endif
 
-#ifndef MIN
-#define MIN(a,b) ((a)<(b)?(a):(b))
-#endif
-
-#ifndef MAX
-#define MAX(a,b) ((a)>(b)?(a):(b))
-#endif
-
 #define VIDEO_MASK	0x00011e7f	/* r/w values for VIDEO_CONTROL */
 
 #define PM2FF_ACCEL		(1L<<0)

@@ -1847,8 +1839,8 @@
 	if (pm2fb_options.flags & OPTF_YPAN) {
 		i->current_par.height=i->regions.fb_size/
 			(i->current_par.width*i->current_par.depth/8);
-		i->current_par.height=MIN(i->current_par.height,2047);
-		i->current_par.height=MAX(i->current_par.height,
+		i->current_par.height=min(i->current_par.height,(u32)2047);
+		i->current_par.height=max(i->current_par.height,
 					  pm2fb_options.user_mode.height);
 	}
 }


drivers/video/fbcmap.c kmalloc audit

Leann Ogasawara

Leann Ogasawara

Arnaldo Carvalho de Melo

Daniele Bellucci

Randy.Dunlap

Daniele Bellucci

Leann Ogasawara

Leann Ogasawara

Leann Ogasawara

Leann Ogasawara

Leann Ogasawara

Domen Puncer

Michael Veeck

Leann Ogasawara