fbdev: imsttfb: fix a resource leak in probe

I've re-written the error handling but the bug is that if init_imstt()
fails we need to call iounmap(par->cmap_regs).

Fixes: c75f5a550610 ("fbdev: imsttfb: Fix use after free bug in imsttfb_probe")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Helge Deller <deller@gmx.de>

diff --git a/drivers/video/fbdev/imsttfb.c b/drivers/video/fbdev/imsttfb.c
index acb943f857000e3305812b1e9935bee039eed945..660499260f4651547fe5af38bf26999b4e794fda 100644 (file)
--- a/drivers/video/fbdev/imsttfb.c
+++ b/drivers/video/fbdev/imsttfb.c
@@ -1496,8 +1496,8 @@ static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
        if (!request_mem_region(addr, size, "imsttfb")) {
                printk(KERN_ERR "imsttfb: Can't reserve memory region\n");
-               framebuffer_release(info);
-               return -ENODEV;
+               ret = -ENODEV;
+               goto release_info;
        }
 
        switch (pdev->device) {
@@ -1514,36 +1514,39 @@ static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                        printk(KERN_INFO "imsttfb: Device 0x%x unknown, "
                                         "contact maintainer.\n", pdev->device);
                        ret = -ENODEV;
-                       goto error;
+                       goto release_mem_region;
        }
 
        info->fix.smem_start = addr;
        info->screen_base = (__u8 *)ioremap(addr, par->ramdac == IBM ?
                                            0x400000 : 0x800000);
        if (!info->screen_base)
-               goto error;
+               goto release_mem_region;
        info->fix.mmio_start = addr + 0x800000;
        par->dc_regs = ioremap(addr + 0x800000, 0x1000);
        if (!par->dc_regs)
-               goto error;
+               goto unmap_screen_base;
        par->cmap_regs_phys = addr + 0x840000;
        par->cmap_regs = (__u8 *)ioremap(addr + 0x840000, 0x1000);
        if (!par->cmap_regs)
-               goto error;
+               goto unmap_dc_regs;
        info->pseudo_palette = par->palette;
        ret = init_imstt(info);
        if (ret)
-               goto error;
+               goto unmap_cmap_regs;
 
        pci_set_drvdata(pdev, info);
-       return ret;
+       return 0;
 
-error:
-       if (par->dc_regs)
-               iounmap(par->dc_regs);
-       if (info->screen_base)
-               iounmap(info->screen_base);
+unmap_cmap_regs:
+       iounmap(par->cmap_regs);
+unmap_dc_regs:
+       iounmap(par->dc_regs);
+unmap_screen_base:
+       iounmap(info->screen_base);
+release_mem_region:
        release_mem_region(addr, size);
+release_info:
        framebuffer_release(info);
        return ret;
 }