aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAlexey Khoroshilov <khoroshilov@ispras.ru>2014-11-01 01:40:47 +0300
committerTomi Valkeinen <tomi.valkeinen@ti.com>2014-11-06 16:41:36 +0200
commit816764859a5347315cb2f1578cf0252ee129c128 (patch)
treee8a065da665352fcbc1b63712b80651f75fd07da
parentd301a5ac1688bf99039adb10b4516b465f1f7a83 (diff)
m501fb: don't return zero on failure path in sm501fb_probe()
If no framebuffers found, sm501fb_probe() breaks off initialization, deallocates sm501fb_info, but returns zero. As a result, use after free can happen in sm501fb_remove(). The patch adds -ENODEV as a return value in this case. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
-rw-r--r--drivers/video/fbdev/sm501fb.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/video/fbdev/sm501fb.c b/drivers/video/fbdev/sm501fb.c
index 9e74e8f..8b98b01 100644
--- a/drivers/video/fbdev/sm501fb.c
+++ b/drivers/video/fbdev/sm501fb.c
@@ -1988,6 +1988,7 @@ static int sm501fb_probe(struct platform_device *pdev)
if (info->fb[HEAD_PANEL] == NULL &&
info->fb[HEAD_CRT] == NULL) {
dev_err(dev, "no framebuffers found\n");
+ ret = -ENODEV;
goto err_alloc;
}