video: hgafb: fix potential NULL pointer dereference

commit dc13cac4862cc68ec74348a80b6942532b7735fa upstream.

The return of ioremap if not checked, and can lead to a NULL to be
assigned to hga_vram. Potentially leading to a NULL pointer
dereference.

The fix adds code to deal with this case in the error label and
changes how the hgafb_probe handles the return of hga_card_detect.

Cc: Ferenc Bakonyi <fero@drama.obuda.kando.hu>
Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Igor Matheus Andrade Torrente <igormtorrente@gmail.com>
Link: https://lore.kernel.org/r/20210503115736.2104747-40-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/video/fbdev/hgafb.c b/drivers/video/fbdev/hgafb.c
index 4630285..b2b9961 100644 (file)
--- a/drivers/video/fbdev/hgafb.c
+++ b/drivers/video/fbdev/hgafb.c
@@ -285,6 +285,8 @@ static int hga_card_detect(void)
        hga_vram_len  = 0x08000;
 
        hga_vram = ioremap(0xb0000, hga_vram_len);
+       if (!hga_vram)
+               return -ENOMEM;
 
        if (request_region(0x3b0, 12, "hgafb"))
                release_io_ports = 1;
@@ -344,13 +346,18 @@ static int hga_card_detect(void)
                        hga_type_name = "Hercules";
                        break;
        }
-       return 1;
+       return 0;
 error:
        if (release_io_ports)
                release_region(0x3b0, 12);
        if (release_io_port)
                release_region(0x3bf, 1);
-       return 0;
+
+       iounmap(hga_vram);
+
+       pr_err("hgafb: HGA card not detected.\n");
+
+       return -EINVAL;
 }
 
 /**
@@ -548,13 +555,11 @@ static struct fb_ops hgafb_ops = {
 static int hgafb_probe(struct platform_device *pdev)
 {
        struct fb_info *info;
+       int ret;
 
-       if (! hga_card_detect()) {
-               printk(KERN_INFO "hgafb: HGA card not detected.\n");
-               if (hga_vram)
-                       iounmap(hga_vram);
-               return -EINVAL;
-       }
+       ret = hga_card_detect();
+       if (!ret)
+               return ret;
 
        printk(KERN_INFO "hgafb: %s with %ldK of memory detected.\n",
                hga_type_name, hga_vram_len/1024);