Skip to content

Commit

Permalink
udlfb: fix some inconsistent NULL checking
Browse files Browse the repository at this point in the history
In the current kernel, then kzalloc() can't fail for small allocations,
but if it did fail then we would have a NULL dereference in the error
handling.  Also in dlfb_usb_disconnect() if "info" were NULL then it
would cause an Oops inside the unregister_framebuffer() function but it
can't be NULL so let's remove that check.

Fixes: 68a958a ("udlfb: handle unplug properly")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Bernie Thompson <bernie@plugable.com>
Cc: Mikulas Patocka <mpatocka@redhat.com>
Cc: Alexey Khoroshilov <khoroshilov@ispras.ru>
Cc: Colin Ian King <colin.king@canonical.com>
Cc: Wen Yang <wen.yang99@zte.com.cn>
[b.zolnierkie: added "Fixes:" tag]
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
  • Loading branch information
Dan Carpenter authored and Bartlomiej Zolnierkiewicz committed Dec 20, 2018
1 parent 31d1b77 commit c143a55
Showing 1 changed file with 6 additions and 8 deletions.
14 changes: 6 additions & 8 deletions drivers/video/fbdev/udlfb.c
Original file line number Diff line number Diff line change
Expand Up @@ -1598,7 +1598,7 @@ static int dlfb_usb_probe(struct usb_interface *intf,
dlfb = kzalloc(sizeof(*dlfb), GFP_KERNEL);
if (!dlfb) {
dev_err(&intf->dev, "%s: failed to allocate dlfb\n", __func__);
goto error;
return -ENOMEM;
}

INIT_LIST_HEAD(&dlfb->deferred_free);
Expand Down Expand Up @@ -1703,7 +1703,7 @@ static int dlfb_usb_probe(struct usb_interface *intf,
error:
if (dlfb->info) {
dlfb_ops_destroy(dlfb->info);
} else if (dlfb) {
} else {
usb_put_dev(dlfb->udev);
kfree(dlfb);
}
Expand All @@ -1730,12 +1730,10 @@ static void dlfb_usb_disconnect(struct usb_interface *intf)
/* this function will wait for all in-flight urbs to complete */
dlfb_free_urb_list(dlfb);

if (info) {
/* remove udlfb's sysfs interfaces */
for (i = 0; i < ARRAY_SIZE(fb_device_attrs); i++)
device_remove_file(info->dev, &fb_device_attrs[i]);
device_remove_bin_file(info->dev, &edid_attr);
}
/* remove udlfb's sysfs interfaces */
for (i = 0; i < ARRAY_SIZE(fb_device_attrs); i++)
device_remove_file(info->dev, &fb_device_attrs[i]);
device_remove_bin_file(info->dev, &edid_attr);

unregister_framebuffer(info);
}
Expand Down

0 comments on commit c143a55

Please sign in to comment.