[PATCH 08/10] dmaengine: bestcomm: Check rh_create() return value in bcom_sram_init()

[Lee Jones <lee@kernel.org>]

rh_create() returns ERR_PTR(-ENOMEM) on allocation failure.
bcom_sram_init() assigns this return value directly to bcom_sram->rh
without checking IS_ERR() and passes it to rh_attach_region(), which
dereferences the error pointer.

Check IS_ERR(bcom_sram->rh) after rh_create() and unmap the SRAM region
on failure.

Fixes: 2f9ea1bde0d1 ("[POWERPC] bestcomm: core bestcomm support for Freescale MPC5200")
Closes: https://sashiko.dev/#/bug/linux-c3caaf6f-9a88-4451-b40e-d061c1fdeabd
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/dma/bestcomm/sram.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/dma/bestcomm/sram.c b/drivers/dma/bestcomm/sram.c
index 09ef5142c26c..df4d90cee465 100644
--- a/drivers/dma/bestcomm/sram.c
+++ b/drivers/dma/bestcomm/sram.c
@@ -88,6 +88,10 @@ int bcom_sram_init(struct device_node *sram_node, char *owner)
 
 	/* Create an rheap (defaults to 32 bits word alignment) */
 	bcom_sram->rh = rh_create(4);
+	if (IS_ERR(bcom_sram->rh)) {
+		rv = PTR_ERR(bcom_sram->rh);
+		goto error_unmap;
+	}
 
 	/* Attach the free zones */
 	regaddr_p = NULL;
@@ -111,6 +115,8 @@ int bcom_sram_init(struct device_node *sram_node, char *owner)
 
 	return 0;
 
+error_unmap:
+	iounmap((void __iomem *)bcom_sram->base_virt);
 error_release:
 	release_mem_region(res.start, resource_size(&res));
 error_free:
-- 
2.56.0.567.gdb80ae8cd5-goog