Skip to content

Commit 6449e31

Browse files
khoroshilovStefan Richter
authored andcommitted
firewire: nosy: do not ignore errors in ioremap_nocache()
There is no check if ioremap_nocache() returns a valid pointer. Potentially it can lead to null pointer dereference. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de> (renamed goto labels)
1 parent c8d2bc9 commit 6449e31

1 file changed

Lines changed: 10 additions & 3 deletions

File tree

drivers/firewire/nosy.c

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -566,6 +566,11 @@ add_card(struct pci_dev *dev, const struct pci_device_id *unused)
566566

567567
lynx->registers = ioremap_nocache(pci_resource_start(dev, 0),
568568
PCILYNX_MAX_REGISTER);
569+
if (lynx->registers == NULL) {
570+
dev_err(&dev->dev, "Failed to map registers\n");
571+
ret = -ENOMEM;
572+
goto fail_deallocate_lynx;
573+
}
569574

570575
lynx->rcv_start_pcl = pci_alloc_consistent(lynx->pci_device,
571576
sizeof(struct pcl), &lynx->rcv_start_pcl_bus);
@@ -578,7 +583,7 @@ add_card(struct pci_dev *dev, const struct pci_device_id *unused)
578583
lynx->rcv_buffer == NULL) {
579584
dev_err(&dev->dev, "Failed to allocate receive buffer\n");
580585
ret = -ENOMEM;
581-
goto fail_deallocate;
586+
goto fail_deallocate_buffers;
582587
}
583588
lynx->rcv_start_pcl->next = cpu_to_le32(lynx->rcv_pcl_bus);
584589
lynx->rcv_pcl->next = cpu_to_le32(PCL_NEXT_INVALID);
@@ -641,7 +646,7 @@ add_card(struct pci_dev *dev, const struct pci_device_id *unused)
641646
dev_err(&dev->dev,
642647
"Failed to allocate shared interrupt %d\n", dev->irq);
643648
ret = -EIO;
644-
goto fail_deallocate;
649+
goto fail_deallocate_buffers;
645650
}
646651

647652
lynx->misc.parent = &dev->dev;
@@ -668,7 +673,7 @@ add_card(struct pci_dev *dev, const struct pci_device_id *unused)
668673
reg_write(lynx, PCI_INT_ENABLE, 0);
669674
free_irq(lynx->pci_device->irq, lynx);
670675

671-
fail_deallocate:
676+
fail_deallocate_buffers:
672677
if (lynx->rcv_start_pcl)
673678
pci_free_consistent(lynx->pci_device, sizeof(struct pcl),
674679
lynx->rcv_start_pcl, lynx->rcv_start_pcl_bus);
@@ -679,6 +684,8 @@ add_card(struct pci_dev *dev, const struct pci_device_id *unused)
679684
pci_free_consistent(lynx->pci_device, PAGE_SIZE,
680685
lynx->rcv_buffer, lynx->rcv_buffer_bus);
681686
iounmap(lynx->registers);
687+
688+
fail_deallocate_lynx:
682689
kfree(lynx);
683690

684691
fail_disable:

0 commit comments

Comments
 (0)