Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Gencen Gan <gangecen@hust.edu.cn>
To:     Gerd Hoffmann <kraxel@redhat.com>,
        David Airlie <airlied@gmail.com>,
        Daniel Vetter <daniel@ffwll.ch>
Cc:     Gan Gecen <gangecen@hust.edu.cn>,
        virtualization@lists.linux-foundation.org,
        dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org
Subject: [PATCH v2] drm/bochs: fix ioremap leak of mmio in bochs
Date:   Sun,  2 Apr 2023 02:55:43 +0800
Message-Id: <20230401185544.3027703-1-gangecen@hust.edu.cn>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

From: Gan Gecen <gangecen@hust.edu.cn>

Smatch reports:

	drivers/gpu/drm/tiny/bochs.c:290 bochs_hw_init()
	warn: 'bochs->mmio' from ioremap() not released on
	lines: 246,250,254.

In the function bochs_load() that calls bochs_hw_init()
only, if bochs_hw_init(dev) returns -ENODEV(-19), it
will jumps to err_free_dev instead of err_hw_fini, so
bochs->mmio won't be freed.

We just need to release mmio in the corresponding error
handling.

Signed-off-by: Gan Gecen <gangecen@hust.edu.cn>
---
v1->v2: Change the strategy for fixing this
issue to manually release mmio by iounmap 
instead of changing ioremap to devm_ioremap.
 drivers/gpu/drm/tiny/bochs.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/tiny/bochs.c b/drivers/gpu/drm/tiny/bochs.c
index 024346054c70..46abed11c163 100644
--- a/drivers/gpu/drm/tiny/bochs.c
+++ b/drivers/gpu/drm/tiny/bochs.c
@@ -243,15 +243,20 @@ static int bochs_hw_init(struct drm_device *dev)
 		* 64 * 1024;
 	if ((id & 0xfff0) != VBE_DISPI_ID0) {
 		DRM_ERROR("ID mismatch\n");
+		iounmap(bochs->mmio);
 		return -ENODEV;
 	}
 
-	if ((pdev->resource[0].flags & IORESOURCE_MEM) == 0)
+	if ((pdev->resource[0].flags & IORESOURCE_MEM) == 0) {
+		iounmap(bochs->mmio);
 		return -ENODEV;
+	}
 	addr = pci_resource_start(pdev, 0);
 	size = pci_resource_len(pdev, 0);
-	if (addr == 0)
+	if (addr == 0) {
+		iounmap(bochs->mmio);
 		return -ENODEV;
+	}
 	if (size != mem) {
 		DRM_ERROR("Size mismatch: pci=%ld, bochs=%ld\n",
 			size, mem);
-- 
2.34.1