| Message ID | 20211014132231.555138-1-wanghai38@huawei.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | video: smscufx: Fix null-ptr-deref in ufx_usb_probe() | expand |
Hi Am 14.10.21 um 15:22 schrieb Wang Hai: > I got a null-ptr-deref report: > > BUG: kernel NULL pointer dereference, address: 0000000000000000 > ... > RIP: 0010:fb_destroy_modelist+0x38/0x100 > ... > Call Trace: > ufx_usb_probe.cold+0x2b5/0xac1 [smscufx] > usb_probe_interface+0x1aa/0x3c0 [usbcore] > really_probe+0x167/0x460 > ... > ret_from_fork+0x1f/0x30 > > If fb_alloc_cmap() fails in ufx_usb_probe(), fb_destroy_modelist() will > be called to destroy modelist in the error handling path. But modelist > has not been initialized yet, so it will result in null-ptr-deref. > > Initialize modelist before calling fb_alloc_cmap() to fix this bug. > > Fixes: 3c8a63e22a08 ("Add support for SMSC UFX6000/7000 USB display adapters") > Reported-by: Hulk Robot <hulkci@huawei.com> > Signed-off-by: Wang Hai <wanghai38@huawei.com> Acked-by: Thomas Zimmermann <tzimmermann@suse.de> I got one of these devices but the driver didn't produce any output for me. Are actually able to use the driver? Best regards Thomas > --- > drivers/video/fbdev/smscufx.c | 3 +-- > 1 file changed, 1 insertion(+), 2 deletions(-) > > diff --git a/drivers/video/fbdev/smscufx.c b/drivers/video/fbdev/smscufx.c > index bfac3ee4a642..28768c272b73 100644 > --- a/drivers/video/fbdev/smscufx.c > +++ b/drivers/video/fbdev/smscufx.c > @@ -1656,6 +1656,7 @@ static int ufx_usb_probe(struct usb_interface *interface, > info->par = dev; > info->pseudo_palette = dev->pseudo_palette; > info->fbops = &ufx_ops; > + INIT_LIST_HEAD(&info->modelist); > > retval = fb_alloc_cmap(&info->cmap, 256, 0); > if (retval < 0) { > @@ -1666,8 +1667,6 @@ static int ufx_usb_probe(struct usb_interface *interface, > INIT_DELAYED_WORK(&dev->free_framebuffer_work, > ufx_free_framebuffer_work); > > - INIT_LIST_HEAD(&info->modelist); > - > retval = ufx_reg_read(dev, 0x3000, &id_rev); > check_warn_goto_error(retval, "error %d reading 0x3000 register from device", retval); > dev_dbg(dev->gdev, "ID_REV register value 0x%08x", id_rev); >
diff --git a/drivers/video/fbdev/smscufx.c b/drivers/video/fbdev/smscufx.c index bfac3ee4a642..28768c272b73 100644 --- a/drivers/video/fbdev/smscufx.c +++ b/drivers/video/fbdev/smscufx.c @@ -1656,6 +1656,7 @@ static int ufx_usb_probe(struct usb_interface *interface, info->par = dev; info->pseudo_palette = dev->pseudo_palette; info->fbops = &ufx_ops; + INIT_LIST_HEAD(&info->modelist); retval = fb_alloc_cmap(&info->cmap, 256, 0); if (retval < 0) { @@ -1666,8 +1667,6 @@ static int ufx_usb_probe(struct usb_interface *interface, INIT_DELAYED_WORK(&dev->free_framebuffer_work, ufx_free_framebuffer_work); - INIT_LIST_HEAD(&info->modelist); - retval = ufx_reg_read(dev, 0x3000, &id_rev); check_warn_goto_error(retval, "error %d reading 0x3000 register from device", retval); dev_dbg(dev->gdev, "ID_REV register value 0x%08x", id_rev);
I got a null-ptr-deref report: BUG: kernel NULL pointer dereference, address: 0000000000000000 ... RIP: 0010:fb_destroy_modelist+0x38/0x100 ... Call Trace: ufx_usb_probe.cold+0x2b5/0xac1 [smscufx] usb_probe_interface+0x1aa/0x3c0 [usbcore] really_probe+0x167/0x460 ... ret_from_fork+0x1f/0x30 If fb_alloc_cmap() fails in ufx_usb_probe(), fb_destroy_modelist() will be called to destroy modelist in the error handling path. But modelist has not been initialized yet, so it will result in null-ptr-deref. Initialize modelist before calling fb_alloc_cmap() to fix this bug. Fixes: 3c8a63e22a08 ("Add support for SMSC UFX6000/7000 USB display adapters") Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Wang Hai <wanghai38@huawei.com> --- drivers/video/fbdev/smscufx.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)