sm501fb: don't return zero on failure path in sm501fb_start()
If fbmem iomemory mapping failed, sm501fb_start() breaks off initialization, deallocates resources, but returns zero. As a result, double deallocation can happen in sm501fb_stop(). Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> Cc: Tomi Valkeinen <tomi.valkeinen@ti.com> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
This commit is contained in:
parent
45f580c42e
commit
dc85e9a874
|
@ -1600,6 +1600,7 @@ static int sm501fb_start(struct sm501fb_info *info,
|
|||
info->fbmem = ioremap(res->start, resource_size(res));
|
||||
if (info->fbmem == NULL) {
|
||||
dev_err(dev, "cannot remap framebuffer\n");
|
||||
ret = -ENXIO;
|
||||
goto err_mem_res;
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in a new issue