Commit da8b269c authored Oct 14, 2021 by Wang Hai Committed by Greg Kroah-Hartman Apr 15, 2022

video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe()



[ Upstream commit 1791f487f877a9e83d81c8677bd3e7b259e7cb27 ]

I got a null-ptr-deref report:

BUG: kernel NULL pointer dereference, address: 0000000000000000
...
RIP: 0010:fb_destroy_modelist+0x38/0x100
...
Call Trace:
 ufx_usb_probe.cold+0x2b5/0xac1 [smscufx]
 usb_probe_interface+0x1aa/0x3c0 [usbcore]
 really_probe+0x167/0x460
...
 ret_from_fork+0x1f/0x30

If fb_alloc_cmap() fails in ufx_usb_probe(), fb_destroy_modelist() will
be called to destroy modelist in the error handling path. But modelist
has not been initialized yet, so it will result in null-ptr-deref.

Initialize modelist before calling fb_alloc_cmap() to fix this bug.

Fixes: 3c8a63e2 ("Add support for SMSC UFX6000/7000 USB display adapters")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent 4d847e45

drivers/video/fbdev/smscufx.c

+1 −2

Original line number	Diff line number	Diff line
		@@ -1657,6 +1657,7 @@ static int ufx_usb_probe(struct usb_interface *interface,
		info->par = dev;
		info->pseudo_palette = dev->pseudo_palette;
		info->fbops = &ufx_ops;
		INIT_LIST_HEAD(&info->modelist);

		retval = fb_alloc_cmap(&info->cmap, 256, 0);
		if (retval < 0) {
		@@ -1667,8 +1668,6 @@ static int ufx_usb_probe(struct usb_interface *interface,
		INIT_DELAYED_WORK(&dev->free_framebuffer_work,
		ufx_free_framebuffer_work);

		INIT_LIST_HEAD(&info->modelist);

		retval = ufx_reg_read(dev, 0x3000, &id_rev);
		check_warn_goto_error(retval, "error %d reading 0x3000 register from device", retval);
		dev_dbg(dev->gdev, "ID_REV register value 0x%08x", id_rev);