[PATCH v2] drm/bochs: fix ioremap leak of mmio in bochs

Gencen Gan gangecen at hust.edu.cn
Sat Apr 1 18:55:43 UTC 2023


From: Gan Gecen <gangecen at hust.edu.cn>

Smatch reports:

	drivers/gpu/drm/tiny/bochs.c:290 bochs_hw_init()
	warn: 'bochs->mmio' from ioremap() not released on
	lines: 246,250,254.

In the function bochs_load() that calls bochs_hw_init()
only, if bochs_hw_init(dev) returns -ENODEV(-19), it
will jumps to err_free_dev instead of err_hw_fini, so
bochs->mmio won't be freed.

We just need to release mmio in the corresponding error
handling.

Signed-off-by: Gan Gecen <gangecen at hust.edu.cn>
---
v1->v2: Change the strategy for fixing this
issue to manually release mmio by iounmap 
instead of changing ioremap to devm_ioremap.
 drivers/gpu/drm/tiny/bochs.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/tiny/bochs.c b/drivers/gpu/drm/tiny/bochs.c
index 024346054c70..46abed11c163 100644
--- a/drivers/gpu/drm/tiny/bochs.c
+++ b/drivers/gpu/drm/tiny/bochs.c
@@ -243,15 +243,20 @@ static int bochs_hw_init(struct drm_device *dev)
 		* 64 * 1024;
 	if ((id & 0xfff0) != VBE_DISPI_ID0) {
 		DRM_ERROR("ID mismatch\n");
+		iounmap(bochs->mmio);
 		return -ENODEV;
 	}
 
-	if ((pdev->resource[0].flags & IORESOURCE_MEM) == 0)
+	if ((pdev->resource[0].flags & IORESOURCE_MEM) == 0) {
+		iounmap(bochs->mmio);
 		return -ENODEV;
+	}
 	addr = pci_resource_start(pdev, 0);
 	size = pci_resource_len(pdev, 0);
-	if (addr == 0)
+	if (addr == 0) {
+		iounmap(bochs->mmio);
 		return -ENODEV;
+	}
 	if (size != mem) {
 		DRM_ERROR("Size mismatch: pci=%ld, bochs=%ld\n",
 			size, mem);
-- 
2.34.1



More information about the dri-devel mailing list