Skip to content

Commit

Permalink
video: hgafb: fix potential NULL pointer dereference
Browse files Browse the repository at this point in the history
The return of ioremap if not checked, and can lead to a NULL to be
assigned to hga_vram. Potentially leading to a NULL pointer
dereference.

The fix adds code to deal with this case in the error label and
changes how the hgafb_probe handles the return of hga_card_detect.

Cc: Ferenc Bakonyi <fero@drama.obuda.kando.hu>
Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Igor Matheus Andrade Torrente <igormtorrente@gmail.com>
Link: https://lore.kernel.org/r/20210503115736.2104747-40-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  • Loading branch information
Igor Matheus Andrade Torrente authored and Greg Kroah-Hartman committed May 13, 2021
1 parent 58c0cc2 commit dc13cac
Showing 1 changed file with 13 additions and 8 deletions.
21 changes: 13 additions & 8 deletions drivers/video/fbdev/hgafb.c
Original file line number Diff line number Diff line change
@@ -285,6 +285,8 @@ static int hga_card_detect(void)
hga_vram_len = 0x08000;

hga_vram = ioremap(0xb0000, hga_vram_len);
if (!hga_vram)
return -ENOMEM;

if (request_region(0x3b0, 12, "hgafb"))
release_io_ports = 1;
@@ -344,13 +346,18 @@ static int hga_card_detect(void)
hga_type_name = "Hercules";
break;
}
return 1;
return 0;
error:
if (release_io_ports)
release_region(0x3b0, 12);
if (release_io_port)
release_region(0x3bf, 1);
return 0;

iounmap(hga_vram);

pr_err("hgafb: HGA card not detected.\n");

return -EINVAL;
}

/**
@@ -548,13 +555,11 @@ static const struct fb_ops hgafb_ops = {
static int hgafb_probe(struct platform_device *pdev)
{
struct fb_info *info;
int ret;

if (! hga_card_detect()) {
printk(KERN_INFO "hgafb: HGA card not detected.\n");
if (hga_vram)
iounmap(hga_vram);
return -EINVAL;
}
ret = hga_card_detect();
if (!ret)
return ret;

printk(KERN_INFO "hgafb: %s with %ldK of memory detected.\n",
hga_type_name, hga_vram_len/1024);

0 comments on commit dc13cac

Please sign in to comment.