media: saa7164: add ioremap return checks and cleanups

Add checks for ioremap return values in saa7164_dev_setup(). If
ioremap for BAR0 or BAR2 fails, release the already allocated PCI
memory regions, remove the device from the global list, decrement
the device count, and return -ENODEV.

This prevents potential null pointer dereferences and ensures proper
cleanup on memory mapping failures.

Fixes: 443c1228d505 ("V4L/DVB (12923): SAA7164: Add support for the NXP SAA7164 silicon")
Cc: stable@vger.kernel.org
Signed-off-by: Wang Jun <1742789905@qq.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

diff --git a/drivers/media/pci/saa7164/saa7164-core.c b/drivers/media/pci/saa7164/saa7164-core.c
index 74406d5ea0a507d30fb82e8a1a6e94a34dca8182..6bcde506adf506f0371d68df147a7c8c127eb81d 100644 (file)
--- a/drivers/media/pci/saa7164/saa7164-core.c
+++ b/drivers/media/pci/saa7164/saa7164-core.c
@@ -888,6 +888,15 @@ static int get_resources(struct saa7164_dev *dev)
        return -EBUSY;
 }
 
+static void release_resources(struct saa7164_dev *dev)
+{
+       release_mem_region(pci_resource_start(dev->pci, 0),
+                          pci_resource_len(dev->pci, 0));
+
+       release_mem_region(pci_resource_start(dev->pci, 2),
+                          pci_resource_len(dev->pci, 2));
+}
+
 static int saa7164_port_init(struct saa7164_dev *dev, int portnr)
 {
        struct saa7164_port *port = NULL;
@@ -947,9 +956,9 @@ static int saa7164_dev_setup(struct saa7164_dev *dev)
 
        snprintf(dev->name, sizeof(dev->name), "saa7164[%d]", dev->nr);
 
-       mutex_lock(&devlist);
-       list_add_tail(&dev->devlist, &saa7164_devlist);
-       mutex_unlock(&devlist);
+       scoped_guard(mutex, &devlist) {
+               list_add_tail(&dev->devlist, &saa7164_devlist);
+       }
 
        /* board config */
        dev->board = UNSET;
@@ -996,11 +1005,17 @@ static int saa7164_dev_setup(struct saa7164_dev *dev)
        }
 
        /* PCI/e allocations */
-       dev->lmmio = ioremap(pci_resource_start(dev->pci, 0),
-                            pci_resource_len(dev->pci, 0));
+       dev->lmmio = pci_ioremap_bar(dev->pci, 0);
+       if (!dev->lmmio) {
+               dev_err(&dev->pci->dev, "Failed to remap MMIO BAR 0\n");
+               goto err_ioremap_bar0;
+       }
 
-       dev->lmmio2 = ioremap(pci_resource_start(dev->pci, 2),
-                            pci_resource_len(dev->pci, 2));
+       dev->lmmio2 = pci_ioremap_bar(dev->pci, 2);
+       if (!dev->lmmio2) {
+               dev_err(&dev->pci->dev, "Failed to remap MMIO BAR 2\n");
+               goto err_ioremap_bar2;
+       }
 
        dev->bmmio = (u8 __iomem *)dev->lmmio;
        dev->bmmio2 = (u8 __iomem *)dev->lmmio2;
@@ -1019,17 +1034,25 @@ static int saa7164_dev_setup(struct saa7164_dev *dev)
        saa7164_pci_quirks(dev);
 
        return 0;
+
+err_ioremap_bar2:
+       iounmap(dev->lmmio);
+err_ioremap_bar0:
+       release_resources(dev);
+
+       scoped_guard(mutex, &devlist) {
+               list_del(&dev->devlist);
+       }
+       saa7164_devcount--;
+
+       return -ENODEV;
 }
 
 static void saa7164_dev_unregister(struct saa7164_dev *dev)
 {
        dprintk(1, "%s()\n", __func__);
 
-       release_mem_region(pci_resource_start(dev->pci, 0),
-               pci_resource_len(dev->pci, 0));
-
-       release_mem_region(pci_resource_start(dev->pci, 2),
-               pci_resource_len(dev->pci, 2));
+       release_resources(dev);
 
        if (!atomic_dec_and_test(&dev->refcount))
                return;