If no framebuffers found, sm501fb_probe() breaks off initialization,
deallocates sm501fb_info, but returns zero. As a result, use after free
can happen in sm501fb_remove().
The patch adds -ENODEV as a return value in this case.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
if (info->fb[HEAD_PANEL] == NULL &&
info->fb[HEAD_CRT] == NULL) {
dev_err(dev, "no framebuffers found\n");
+ ret = -ENODEV;
goto err_alloc;
}