Thread (2 messages) flat view 2 messages, 2 authors, 2026-03-10
STALE197d

[PATCH] video/fbdev/via: check ioremap return value in viafb_lcd_get_mobile_state

From: Wang Jun <hidden>
Date: 2026-03-10 01:14:36
Also in: dri-devel, lkml
Subsystem: framebuffer layer, the rest, via unichrome(pro)/chrome9 framebuffer driver · Maintainers: Helge Deller, Linus Torvalds, Florian Tobias Schandinat

The function viafb_lcd_get_mobile_state() calls ioremap() without
checking the return value. If ioremap() fails (returns NULL), the
subsequent readw() will cause a NULL pointer dereference.

This patch adds a proper NULL check after ioremap() and returns
-ENOMEM in case of failure.

Signed-off-by: Wang Jun <redacted>
---
 drivers/video/fbdev/via/lcd.c | 4 ++++
 1 file changed, 4 insertions(+)
diff --git a/drivers/video/fbdev/via/lcd.c b/drivers/video/fbdev/via/lcd.c
index 8673fced8749..91359d2b64fb 100644
--- a/drivers/video/fbdev/via/lcd.c
+++ b/drivers/video/fbdev/via/lcd.c
@@ -954,6 +954,10 @@ bool viafb_lcd_get_mobile_state(bool *mobile)
 	u16 start_pattern;
 
 	biosptr = ioremap(romaddr, 0x10000);
+	if (!biosptr) {
+		DEBUG_MSG(KERN_ERR " Failed to remap BIOS memory\n");
+		return false;
+	}
 	start_pattern = readw(biosptr);
 
 	/* Compare pattern */
-- 
2.43.0
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help