[PATCH] Leak in vesafb

[PATCH] Leak in vesafb

[Felipe W Damasio]

[-- Attachment #1: Type: text/plain, Size: 349 bytes --]

	Hi Andrew,

	Patch against 2.6.0-test6.

	Releases a previous request'ed_mem_region. Found by smatch.

	Since it didn't checked the return value of request_region, I'm not 
sure we should free it here...since (as it says on the driver), 
"vgacon probably has this region already".

	Andrew, I'd appreciate you could review this..

	Thanks.

Felipe

[-- Attachment #2: vesafb-leak.patch --]
[-- Type: text/plain, Size: 510 bytes --]

--- linux-2.6.0-test6/drivers/video/vesafb.c.orig	2003-10-06 18:22:13.000000000 -0300
+++ linux-2.6.0-test6/drivers/video/vesafb.c	2003-10-06 18:23:35.000000000 -0300
@@ -366,8 +366,10 @@
 
 	fb_alloc_cmap(&fb_info.cmap, video_cmap_len, 0);
 
-	if (register_framebuffer(&fb_info)<0)
+	if (register_framebuffer(&fb_info)<0) {
+		release_mem_region(vesafb_fix.smem_start, vesafb_fix.smem_len);
 		return -EINVAL;
+	}
 
 	printk(KERN_INFO "fb%d: %s frame buffer device\n",
 	       fb_info.node, fb_info.fix.id);

Re: [PATCH] Leak in vesafb

[Felipe W Damasio]

[-- Attachment #1: Type: text/plain, Size: 524 bytes --]



Felipe W Damasio wrote:
>     Hi Andrew,
> 
>     Patch against 2.6.0-test6.
> 
>     Releases a previous request'ed_mem_region. Found by smatch.
> 
>     Since it didn't checked the return value of request_region, I'm not 
> sure we should free it here...since (as it says on the driver), "vgacon 
> probably has this region already".
> 
>     Andrew, I'd appreciate you could review this..

	Also, this updated patch also iounmap fb_info.screen_base, since 
we're about to return -EINVAL on vesa_init.

	Cheers,

Felipe

[-- Attachment #2: vesafb-leak.patch --]
[-- Type: text/plain, Size: 543 bytes --]

--- linux-2.6.0-test6/drivers/video/vesafb.c.orig	2003-10-06 18:22:13.000000000 -0300
+++ linux-2.6.0-test6/drivers/video/vesafb.c	2003-10-06 18:33:39.000000000 -0300
@@ -366,8 +366,11 @@
 
 	fb_alloc_cmap(&fb_info.cmap, video_cmap_len, 0);
 
-	if (register_framebuffer(&fb_info)<0)
+	if (register_framebuffer(&fb_info)<0) {
+		release_mem_region(vesafb_fix.smem_start, vesafb_fix.smem_len);
+		iounmap(fb_info.screen_base);
 		return -EINVAL;
+	}
 
 	printk(KERN_INFO "fb%d: %s frame buffer device\n",
 	       fb_info.node, fb_info.fix.id);