[PATCH v2] drm/bochs: fix ioremap leak of mmio in bochs

From: Gencen Gan
Date: Sat Apr 01 2023 - 14:57:36 EST


From: Gan Gecen <gangecen@xxxxxxxxxxx>

Smatch reports:

drivers/gpu/drm/tiny/bochs.c:290 bochs_hw_init()
warn: 'bochs->mmio' from ioremap() not released on
lines: 246,250,254.

In the function bochs_load() that calls bochs_hw_init()
only, if bochs_hw_init(dev) returns -ENODEV(-19), it
will jumps to err_free_dev instead of err_hw_fini, so
bochs->mmio won't be freed.

We just need to release mmio in the corresponding error
handling.

Signed-off-by: Gan Gecen <gangecen@xxxxxxxxxxx>
---
v1->v2: Change the strategy for fixing this
issue to manually release mmio by iounmap
instead of changing ioremap to devm_ioremap.
drivers/gpu/drm/tiny/bochs.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/tiny/bochs.c b/drivers/gpu/drm/tiny/bochs.c
index 024346054c70..46abed11c163 100644
--- a/drivers/gpu/drm/tiny/bochs.c
+++ b/drivers/gpu/drm/tiny/bochs.c
@@ -243,15 +243,20 @@ static int bochs_hw_init(struct drm_device *dev)
* 64 * 1024;
if ((id & 0xfff0) != VBE_DISPI_ID0) {
DRM_ERROR("ID mismatch\n");
+ iounmap(bochs->mmio);
return -ENODEV;
}

- if ((pdev->resource[0].flags & IORESOURCE_MEM) == 0)
+ if ((pdev->resource[0].flags & IORESOURCE_MEM) == 0) {
+ iounmap(bochs->mmio);
return -ENODEV;
+ }
addr = pci_resource_start(pdev, 0);
size = pci_resource_len(pdev, 0);
- if (addr == 0)
+ if (addr == 0) {
+ iounmap(bochs->mmio);
return -ENODEV;
+ }
if (size != mem) {
DRM_ERROR("Size mismatch: pci=%ld, bochs=%ld\n",
size, mem);
--
2.34.1