linux-kernel - [PATCH] mtd: gpio-addr-flash: add missing iounmap in probe/remove

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1437842963-8107-1-git-send-email-khoroshilov@ispras.ru>
Date:	Sat, 25 Jul 2015 23:49:23 +0700
From:	Alexey Khoroshilov <khoroshilov@...ras.ru>
To:	David Woodhouse <dwmw2@...radead.org>,
	Brian Norris <computersforpeace@...il.com>,
	Mike Frysinger <vapier@...too.org>
Cc:	Alexey Khoroshilov <khoroshilov@...ras.ru>,
	linux-mtd@...ts.infradead.org, linux-kernel@...r.kernel.org,
	ldv-project@...uxtesting.org
Subject: [PATCH] mtd: gpio-addr-flash: add missing iounmap in probe/remove

There is no iounmap(state->map.virt) in gpio_flash_remove() and
in gpio_flash_probe() error handling code.

By the way the patch adds checks for error code of ioremap() and
mtd_device_parse_register().

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@...ras.ru>
---
 drivers/mtd/maps/gpio-addr-flash.c | 35 +++++++++++++++++++++++++++--------
 1 file changed, 27 insertions(+), 8 deletions(-)

diff --git a/drivers/mtd/maps/gpio-addr-flash.c b/drivers/mtd/maps/gpio-addr-flash.c
index 2fb346091af2..6b9e47d65f08 100644
--- a/drivers/mtd/maps/gpio-addr-flash.c
+++ b/drivers/mtd/maps/gpio-addr-flash.c
@@ -208,6 +208,7 @@ static int gpio_flash_probe(struct platform_device *pdev)
 	struct resource *memory;
 	struct resource *gpios;
 	struct async_state *state;
+	int ret;
 
 	pdata = dev_get_platdata(&pdev->dev);
 	memory = platform_get_resource(pdev, IORESOURCE_MEM, 0);
@@ -242,6 +243,11 @@ static int gpio_flash_probe(struct platform_device *pdev)
 	state->map.phys       = NO_XIP;
 	state->map.map_priv_1 = (unsigned long)state;
 
+	if (!state->map.virt) {
+		ret = -ENODEV;
+		goto err_ioremap;
+	}
+
 	platform_set_drvdata(pdev, state);
 
 	i = 0;
@@ -251,8 +257,8 @@ static int gpio_flash_probe(struct platform_device *pdev)
 				state->gpio_addrs[i]);
 			while (i--)
 				gpio_free(state->gpio_addrs[i]);
-			kfree(state);
-			return -EBUSY;
+			ret = -EBUSY;
+			goto err_gpio;
 		}
 		gpio_direction_output(state->gpio_addrs[i], 0);
 	} while (++i < state->gpio_count);
@@ -261,28 +267,41 @@ static int gpio_flash_probe(struct platform_device *pdev)
 		state->map.bankwidth * 8);
 	state->mtd = do_map_probe(memory->name, &state->map);
 	if (!state->mtd) {
-		for (i = 0; i < state->gpio_count; ++i)
-			gpio_free(state->gpio_addrs[i]);
-		kfree(state);
-		return -ENXIO;
+		ret = -ENXIO;
+		goto err_mtdmap;
 	}
 
 
-	mtd_device_parse_register(state->mtd, part_probe_types, NULL,
-				  pdata->parts, pdata->nr_parts);
+	ret = mtd_device_parse_register(state->mtd, part_probe_types, NULL,
+					pdata->parts, pdata->nr_parts);
+	if (ret)
+		goto err_mtdreg;
 
 	return 0;
+
+err_mtdreg:
+	map_destroy(state->mtd);
+err_mtdmap:
+	for (i = 0; i < state->gpio_count; ++i)
+		gpio_free(state->gpio_addrs[i]);
+err_gpio:
+	iounmap(state->map.virt);
+err_ioremap:
+	kfree(state);
+	return ret;
 }
 
 static int gpio_flash_remove(struct platform_device *pdev)
 {
 	struct async_state *state = platform_get_drvdata(pdev);
 	size_t i = 0;
+
 	do {
 		gpio_free(state->gpio_addrs[i]);
 	} while (++i < state->gpio_count);
 	mtd_device_unregister(state->mtd);
 	map_destroy(state->mtd);
+	iounmap(state->map.virt);
 	kfree(state);
 	return 0;
 }
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/