Patch "video: fbdev: w100fb: Reset global state" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    video: fbdev: w100fb: Reset global state

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     video-fbdev-w100fb-reset-global-state.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit d85a1b03883470f2b9fad8c5d4d1a51ac33922f7
Author: Evgeny Novikov <novikov@xxxxxxxxx>
Date:   Wed Aug 11 19:58:26 2021 +0300

    video: fbdev: w100fb: Reset global state
    
    [ Upstream commit 8738ddcac644964ae128ccd3d80d48773c8d528e ]
    
    w100fb_probe() did not reset the global state to its initial state. This
    can result in invocation of iounmap() even when there was not the
    appropriate successful call of ioremap(). For instance, this may be the
    case if first probe fails after two successful ioremap() while second
    probe fails when first ioremap() fails. The similar issue is with
    w100fb_remove(). The patch fixes both bugs.
    
    Found by Linux Driver Verification project (linuxtesting.org).
    
    Signed-off-by: Evgeny Novikov <novikov@xxxxxxxxx>
    Co-developed-by: Kirill Shilimanov <kirill.shilimanov@xxxxxxxxxx>
    Signed-off-by: Kirill Shilimanov <kirill.shilimanov@xxxxxxxxxx>
    Signed-off-by: Helge Deller <deller@xxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/video/fbdev/w100fb.c b/drivers/video/fbdev/w100fb.c
index d96ab28f8ce4..4e641a780726 100644
--- a/drivers/video/fbdev/w100fb.c
+++ b/drivers/video/fbdev/w100fb.c
@@ -770,12 +770,18 @@ static int w100fb_probe(struct platform_device *pdev)
 		fb_dealloc_cmap(&info->cmap);
 		kfree(info->pseudo_palette);
 	}
-	if (remapped_fbuf != NULL)
+	if (remapped_fbuf != NULL) {
 		iounmap(remapped_fbuf);
-	if (remapped_regs != NULL)
+		remapped_fbuf = NULL;
+	}
+	if (remapped_regs != NULL) {
 		iounmap(remapped_regs);
-	if (remapped_base != NULL)
+		remapped_regs = NULL;
+	}
+	if (remapped_base != NULL) {
 		iounmap(remapped_base);
+		remapped_base = NULL;
+	}
 	if (info)
 		framebuffer_release(info);
 	return err;
@@ -795,8 +801,11 @@ static int w100fb_remove(struct platform_device *pdev)
 	fb_dealloc_cmap(&info->cmap);
 
 	iounmap(remapped_base);
+	remapped_base = NULL;
 	iounmap(remapped_regs);
+	remapped_regs = NULL;
 	iounmap(remapped_fbuf);
+	remapped_fbuf = NULL;
 
 	framebuffer_release(info);