From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Ferenc Bakonyi <fero@drama.obuda.kando.hu>,
Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>,
Igor Matheus Andrade Torrente <igormtorrente@gmail.com>
Subject: [PATCH 4.19 45/49] video: hgafb: fix potential NULL pointer dereference
Date: Mon, 24 May 2021 17:25:56 +0200 [thread overview]
Message-ID: <20210524152325.825916178@linuxfoundation.org> (raw)
In-Reply-To: <20210524152324.382084875@linuxfoundation.org>
From: Igor Matheus Andrade Torrente <igormtorrente@gmail.com>
commit dc13cac4862cc68ec74348a80b6942532b7735fa upstream.
The return of ioremap if not checked, and can lead to a NULL to be
assigned to hga_vram. Potentially leading to a NULL pointer
dereference.
The fix adds code to deal with this case in the error label and
changes how the hgafb_probe handles the return of hga_card_detect.
Cc: Ferenc Bakonyi <fero@drama.obuda.kando.hu>
Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Igor Matheus Andrade Torrente <igormtorrente@gmail.com>
Link: https://lore.kernel.org/r/20210503115736.2104747-40-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/hgafb.c | 21 +++++++++++++--------
1 file changed, 13 insertions(+), 8 deletions(-)
--- a/drivers/video/fbdev/hgafb.c
+++ b/drivers/video/fbdev/hgafb.c
@@ -285,6 +285,8 @@ static int hga_card_detect(void)
hga_vram_len = 0x08000;
hga_vram = ioremap(0xb0000, hga_vram_len);
+ if (!hga_vram)
+ return -ENOMEM;
if (request_region(0x3b0, 12, "hgafb"))
release_io_ports = 1;
@@ -344,13 +346,18 @@ static int hga_card_detect(void)
hga_type_name = "Hercules";
break;
}
- return 1;
+ return 0;
error:
if (release_io_ports)
release_region(0x3b0, 12);
if (release_io_port)
release_region(0x3bf, 1);
- return 0;
+
+ iounmap(hga_vram);
+
+ pr_err("hgafb: HGA card not detected.\n");
+
+ return -EINVAL;
}
/**
@@ -548,13 +555,11 @@ static struct fb_ops hgafb_ops = {
static int hgafb_probe(struct platform_device *pdev)
{
struct fb_info *info;
+ int ret;
- if (! hga_card_detect()) {
- printk(KERN_INFO "hgafb: HGA card not detected.\n");
- if (hga_vram)
- iounmap(hga_vram);
- return -EINVAL;
- }
+ ret = hga_card_detect();
+ if (!ret)
+ return ret;
printk(KERN_INFO "hgafb: %s with %ldK of memory detected.\n",
hga_type_name, hga_vram_len/1024);
next prev parent reply other threads:[~2021-05-24 15:50 UTC|newest]
Thread overview: 58+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-24 15:25 [PATCH 4.19 00/49] 4.19.192-rc1 review Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 01/49] firmware: arm_scpi: Prevent the ternary sign expansion bug Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 02/49] openrisc: Fix a memory leak Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 03/49] RDMA/rxe: Clear all QP fields if creation failed Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 04/49] scsi: qla2xxx: Fix error return code in qla82xx_write_flash_dword() Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 05/49] RDMA/mlx5: Recover from fatal event in dual port mode Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 06/49] platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 07/49] ptrace: make ptrace() fail if the tracee changed its pid unexpectedly Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 08/49] nvmet: seset ns->file when open fails Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 09/49] locking/mutex: clear MUTEX_FLAGS if wait_list is empty due to signal Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 10/49] cifs: fix memory leak in smb2_copychunk_range Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 11/49] ALSA: dice: fix stream format for TC Electronic Konnekt Live at high sampling transfer frequency Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 12/49] ALSA: line6: Fix racy initialization of LINE6 MIDI Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 13/49] ALSA: dice: fix stream format at middle sampling rate for Alesis iO 26 Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 14/49] ALSA: usb-audio: Validate MS endpoint descriptors Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 15/49] ALSA: bebob/oxfw: fix Kconfig entry for Mackie d.2 Pro Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 16/49] Revert "ALSA: sb8: add a check for request_region" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 17/49] ALSA: hda/realtek: reset eapd coeff to default value for alc287 Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 18/49] ALSA: hda/realtek: Add some CLOVE SSIDs of ALC293 Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 19/49] Revert "rapidio: fix a NULL pointer dereference when create_workqueue() fails" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 20/49] rapidio: handle create_workqueue() failure Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 21/49] Revert "serial: mvebu-uart: Fix to avoid a potential NULL pointer dereference" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 22/49] xen-pciback: reconfigure also from backend watch handler Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 23/49] dm snapshot: fix a crash when an origin has no snapshots Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 24/49] dm snapshot: fix crash with transient storage and zero chunk size Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 25/49] Revert "video: hgafb: fix potential NULL pointer dereference" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 26/49] Revert "net: stmicro: fix a missing check of clk_prepare" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 27/49] Revert "leds: lp5523: fix a missing check of return value of lp55xx_read" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 28/49] Revert "hwmon: (lm80) fix a missing check of bus read in lm80 probe" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 29/49] Revert "video: imsttfb: fix potential NULL pointer dereferences" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 30/49] Revert "ecryptfs: replace BUG_ON with error handling code" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 31/49] Revert "scsi: ufs: fix a missing check of devm_reset_control_get" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 32/49] Revert "gdrom: fix a memory leak bug" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 33/49] cdrom: gdrom: deallocate struct gdrom_unit fields in remove_gdrom Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 34/49] cdrom: gdrom: initialize global variable at init time Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 35/49] Revert "media: rcar_drif: fix a memory disclosure" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 36/49] Revert "rtlwifi: fix a potential NULL pointer dereference" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 37/49] Revert "qlcnic: Avoid " Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 38/49] Revert "niu: fix missing checks of niu_pci_eeprom_read" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 39/49] ethernet: sun: niu: fix missing checks of niu_pci_eeprom_read() Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 40/49] net: stmicro: handle clk_prepare() failure during init Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 41/49] scsi: ufs: handle cleanup correctly on devm_reset_control_get error Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 42/49] net: rtlwifi: properly check for alloc_workqueue() failure Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 43/49] leds: lp5523: check return value of lp5xx_read and jump to cleanup code Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 44/49] qlcnic: Add null check after calling netdev_alloc_skb Greg Kroah-Hartman
2021-05-24 15:25 ` Greg Kroah-Hartman [this message]
2021-05-24 15:25 ` [PATCH 4.19 46/49] vgacon: Record video mode changes with VT_RESIZEX Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 47/49] vt: Fix character height handling " Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.19 48/49] tty: vt: always invoke vc->vc_sw->con_resize callback Greg Kroah-Hartman
2021-05-24 15:26 ` [PATCH 4.19 49/49] x86/Xen: swap NX determination and GDT setup on BSP Greg Kroah-Hartman
2021-05-25 5:11 ` Juergen Gross
2021-05-25 6:55 ` Greg Kroah-Hartman
2021-05-24 22:05 ` [PATCH 4.19 00/49] 4.19.192-rc1 review Shuah Khan
2021-05-25 8:14 ` Naresh Kamboju
2021-05-25 14:20 ` Sudip Mukherjee
2021-05-25 14:32 ` Pavel Machek
2021-05-25 21:23 ` Guenter Roeck
2021-05-26 1:02 ` Samuel Zou
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210524152325.825916178@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=b.zolnierkie@samsung.com \
--cc=fero@drama.obuda.kando.hu \
--cc=igormtorrente@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).