Commit d51c60a4 authored by Wang Jun's avatar Wang Jun Committed by Hans Verkuil
Browse files

media: saa7164: add ioremap return checks and cleanups 



Add checks for ioremap return values in saa7164_dev_setup(). If
ioremap for BAR0 or BAR2 fails, release the already allocated PCI
memory regions, remove the device from the global list, decrement
the device count, and return -ENODEV.

This prevents potential null pointer dereferences and ensures proper
cleanup on memory mapping failures.

Fixes: 443c1228 ("V4L/DVB (12923): SAA7164: Add support for the NXP SAA7164 silicon")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarWang Jun <1742789905@qq.com>
Signed-off-by: default avatarHans Verkuil <hverkuil+cisco@kernel.org>
parent 8ea21435

drivers/media/pci/saa7164/saa7164-core.c

+35 −12
Original line number Diff line number Diff line
@@ -888,6 +888,15 @@ static int get_resources(struct saa7164_dev *dev) 
	return -EBUSY;

}



static void release_resources(struct saa7164_dev *dev)

{

	release_mem_region(pci_resource_start(dev->pci, 0),

			   pci_resource_len(dev->pci, 0));



	release_mem_region(pci_resource_start(dev->pci, 2),

			   pci_resource_len(dev->pci, 2));

}



static int saa7164_port_init(struct saa7164_dev *dev, int portnr)

{

	struct saa7164_port *port = NULL;
@@ -947,9 +956,9 @@ static int saa7164_dev_setup(struct saa7164_dev *dev) 


	snprintf(dev->name, sizeof(dev->name), "saa7164[%d]", dev->nr);



	mutex_lock(&devlist);

	scoped_guard(mutex, &devlist) {

		list_add_tail(&dev->devlist, &saa7164_devlist);

	mutex_unlock(&devlist);

	}



	/* board config */

	dev->board = UNSET;
@@ -996,11 +1005,17 @@ static int saa7164_dev_setup(struct saa7164_dev *dev) 
	}



	/* PCI/e allocations */

	dev->lmmio = ioremap(pci_resource_start(dev->pci, 0),

			     pci_resource_len(dev->pci, 0));

	dev->lmmio = pci_ioremap_bar(dev->pci, 0);

	if (!dev->lmmio) {

		dev_err(&dev->pci->dev, "Failed to remap MMIO BAR 0\n");

		goto err_ioremap_bar0;

	}



	dev->lmmio2 = ioremap(pci_resource_start(dev->pci, 2),

			     pci_resource_len(dev->pci, 2));

	dev->lmmio2 = pci_ioremap_bar(dev->pci, 2);

	if (!dev->lmmio2) {

		dev_err(&dev->pci->dev, "Failed to remap MMIO BAR 2\n");

		goto err_ioremap_bar2;

	}



	dev->bmmio = (u8 __iomem *)dev->lmmio;

	dev->bmmio2 = (u8 __iomem *)dev->lmmio2;
@@ -1019,17 +1034,25 @@ static int saa7164_dev_setup(struct saa7164_dev *dev) 
	saa7164_pci_quirks(dev);



	return 0;



err_ioremap_bar2:

	iounmap(dev->lmmio);

err_ioremap_bar0:

	release_resources(dev);



	scoped_guard(mutex, &devlist) {

		list_del(&dev->devlist);

	}

	saa7164_devcount--;



	return -ENODEV;

}



static void saa7164_dev_unregister(struct saa7164_dev *dev)

{

	dprintk(1, "%s()\n", __func__);



	release_mem_region(pci_resource_start(dev->pci, 0),

		pci_resource_len(dev->pci, 0));



	release_mem_region(pci_resource_start(dev->pci, 2),

		pci_resource_len(dev->pci, 2));

	release_resources(dev);



	if (!atomic_dec_and_test(&dev->refcount))

		return;