The function viafb_lcd_get_mobile_state() calls ioremap() without
checking the return value. If ioremap() fails (returns NULL), the
subsequent readw() will cause a NULL pointer dereference.

This patch adds a proper NULL check after ioremap() and returns
-ENOMEM in case of failure.

Signed-off-by: Wang Jun <1742789905@qq.com>
---
 drivers/video/fbdev/via/lcd.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/video/fbdev/via/lcd.c b/drivers/video/fbdev/via/lcd.c
index 8673fced8749..91359d2b64fb 100644
--- a/drivers/video/fbdev/via/lcd.c
+++ b/drivers/video/fbdev/via/lcd.c
@@ -954,6 +954,10 @@ bool viafb_lcd_get_mobile_state(bool *mobile)
 	u16 start_pattern;
 
 	biosptr = ioremap(romaddr, 0x10000);
+	if (!biosptr) {
+		DEBUG_MSG(KERN_ERR " Failed to remap BIOS memory\n");
+		return false;
+	}
 	start_pattern = readw(biosptr);
 
 	/* Compare pattern */
-- 
2.43.0

On 3/10/26 02:14, Wang Jun wrote:
> The function viafb_lcd_get_mobile_state() calls ioremap() without
> checking the return value. If ioremap() fails (returns NULL), the
> subsequent readw() will cause a NULL pointer dereference.

correct.

> This patch adds a proper NULL check after ioremap() 

yes.

> and returns
> -ENOMEM in case of failure.

You return "false", not -ENOMEM.

Anyway, I corrected this, dropped the DEBUG_MSG() call and applied it
to the fbdev git tree.

Thanks!
Helge

  
> Signed-off-by: Wang Jun <1742789905@qq.com>
> ---
>   drivers/video/fbdev/via/lcd.c | 4 ++++
>   1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/video/fbdev/via/lcd.c b/drivers/video/fbdev/via/lcd.c
> index 8673fced8749..91359d2b64fb 100644
> --- a/drivers/video/fbdev/via/lcd.c
> +++ b/drivers/video/fbdev/via/lcd.c
> @@ -954,6 +954,10 @@ bool viafb_lcd_get_mobile_state(bool *mobile)
>   	u16 start_pattern;
>   
>   	biosptr = ioremap(romaddr, 0x10000);
> +	if (!biosptr) {
> +		DEBUG_MSG(KERN_ERR " Failed to remap BIOS memory\n");
> +		return false;
> +	}
>   	start_pattern = readw(biosptr);
>   
>   	/* Compare pattern */