ines_gpib_config() maps attribute memory with ioremap() and immediately
writes the IO window base via writeb(). ioremap() can return NULL; writing
through that pointer is a NULL pointer dereference.
Check the mapping, report the error, and unwind the PCMCIA configuration
on failure.
Fixes: bb1bd92fa0f2 ("staging: gpib: Add ines GPIB driver")
Signed-off-by: Linkai Gong <gonglinkai@kylinos.cn>
---
drivers/gpib/ines/ines_gpib.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/gpib/ines/ines_gpib.c b/drivers/gpib/ines/ines_gpib.c
index 3562f3184c28..d7f2a42d063a 100644
--- a/drivers/gpib/ines/ines_gpib.c
+++ b/drivers/gpib/ines/ines_gpib.c
@@ -1226,6 +1226,11 @@ static int ines_gpib_config(struct pcmcia_device *link)
return -ENODEV;
}
virt = ioremap(link->resource[2]->start, resource_size(link->resource[2]));
+ if (!virt) {
+ dev_err(&link->dev, "Could not map I/O memory\n");
+ ines_gpib_release(link);
+ return -ENOMEM;
+ }
writeb((link->resource[2]->start >> 2) & 0xff, virt + 0xf0); // IOWindow base
iounmap(virt);
--
2.25.1