kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/drivers/video/fbdev
History
Dongliang Mu 64fa364ad3 fbdev: smscufx: fix error handling code in ufx_usb_probe 
commit b76449ee75 upstream.

The current error handling code in ufx_usb_probe have many unmatching
issues, e.g., missing ufx_free_usb_list, destroy_modedb label should
only include framebuffer_release, fb_dealloc_cmap only matches
fb_alloc_cmap.

My local syzkaller reports a memory leak bug:

memory leak in ufx_usb_probe

BUG: memory leak
unreferenced object 0xffff88802f879580 (size 128):
  comm "kworker/0:7", pid 17416, jiffies 4295067474 (age 46.710s)
  hex dump (first 32 bytes):
    80 21 7c 2e 80 88 ff ff 18 d0 d0 0c 80 88 ff ff  .!|.............
    00 d0 d0 0c 80 88 ff ff e0 ff ff ff 0f 00 00 00  ................
  backtrace:
    [<ffffffff814c99a0>] kmalloc_trace+0x20/0x90 mm/slab_common.c:1045
    [<ffffffff824d219c>] kmalloc include/linux/slab.h:553 [inline]
    [<ffffffff824d219c>] kzalloc include/linux/slab.h:689 [inline]
    [<ffffffff824d219c>] ufx_alloc_urb_list drivers/video/fbdev/smscufx.c:1873 [inline]
    [<ffffffff824d219c>] ufx_usb_probe+0x11c/0x15a0 drivers/video/fbdev/smscufx.c:1655
    [<ffffffff82d17927>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
    [<ffffffff82712f0d>] call_driver_probe drivers/base/dd.c:560 [inline]
    [<ffffffff82712f0d>] really_probe+0x12d/0x390 drivers/base/dd.c:639
    [<ffffffff8271322f>] __driver_probe_device+0xbf/0x140 drivers/base/dd.c:778
    [<ffffffff827132da>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:808
    [<ffffffff82713c27>] __device_attach_driver+0xf7/0x150 drivers/base/dd.c:936
    [<ffffffff82710137>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
    [<ffffffff827136b5>] __device_attach+0x105/0x2d0 drivers/base/dd.c:1008
    [<ffffffff82711d36>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487
    [<ffffffff8270e242>] device_add+0x642/0xdc0 drivers/base/core.c:3517
    [<ffffffff82d14d5f>] usb_set_configuration+0x8ef/0xb80 drivers/usb/core/message.c:2170
    [<ffffffff82d2576c>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
    [<ffffffff82d16ffc>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293
    [<ffffffff82712f0d>] call_driver_probe drivers/base/dd.c:560 [inline]
    [<ffffffff82712f0d>] really_probe+0x12d/0x390 drivers/base/dd.c:639
    [<ffffffff8271322f>] __driver_probe_device+0xbf/0x140 drivers/base/dd.c:778

Fix this bug by rewriting the error handling code in ufx_usb_probe.

Reported-by: syzkaller <syzkaller@googlegroups.com>
Tested-by: Dongliang Mu <dzm91@hust.edu.cn>
Signed-off-by: Dongliang Mu <dzm91@hust.edu.cn>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2023-02-09 11:26:47 +01:00
..
aty video: fbdev: atyfb: mach64_cursor.c: deleted the repeated word 2021-06-03 10:32:49 +02:00
core fbcon: Check font dimension limits 2023-02-09 11:26:41 +01:00
geode fbdev: geode: don't build on UML 2022-12-31 13:14:32 +01:00
i810 video: fbdev: i810: use true,false for bool variables 2020-05-06 19:29:10 +02:00
intelfb drm pull for 5.6-rc1 2020-01-30 08:04:01 -08:00
kyro video: fbdev: kyro: Error out if 'pixclock' equals zero 2021-07-26 20:06:00 +02:00
matrox fbdev: matroxfb: G200eW: Increase max memory from 1 MB to 16 MB 2023-01-12 11:59:17 +01:00
mb862xx video: fbdev: mb862xx: use DEVICE_ATTR_RO macro 2021-06-03 10:32:49 +02:00
mmp video: fbdev: mmp: Fix kernel-doc warning for lcd_spi_write 2020-12-08 18:34:25 +01:00
nvidia video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow 2022-04-08 14:23:59 +02:00
omap video: omap: Remove in_interrupt() usage. 2021-02-18 15:14:32 +01:00
omap2 fbdev: omapfb: avoid stack overflow warning 2023-01-24 07:22:42 +01:00
riva video: fbdev: riva: Error out if 'pixclock' equals zero 2021-07-26 20:06:03 +02:00
savage fbdev: savagefb: use generic power management 2020-09-08 13:33:15 +02:00
sis video: fbdev: sis: fix typos in SiS_GetModeID() 2022-08-17 14:24:11 +02:00
vermilion fbdev: vermilion: decrease reference count in error path 2022-12-31 13:14:32 +01:00
via fbdev: via: Fix error in via_core_init() 2022-12-31 13:14:31 +01:00
68328fb.c video/fbdev/68328fb: Remove dead code 2020-01-03 14:27:43 +01:00
acornfb.c video: fbdev: acornfb: remove free_unused_pages() 2021-02-24 13:38:31 -08:00
acornfb.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
amba-clcd.c video: fbdev: amba-clcd: Fix refcount leak bugs 2022-08-17 14:24:11 +02:00
amifb.c backlight/video: Use Platform getter/setter functions 2021-02-12 10:01:45 +00:00
arcfb.c video: fbdev: arcfb: remove redundant initialization of variable err 2021-07-21 13:09:21 +02:00
arkfb.c video: fbdev: arkfb: Check the size of screen before memset_io() 2022-08-17 14:24:16 +02:00
asiliantfb.c video: fbdev: asiliantfb: Error out if 'pixclock' equals zero 2021-07-26 20:05:50 +02:00
atafb.c video: fbdev: atari: Atari 2 bpp (STe) palette bugfix 2022-04-08 14:23:00 +02:00
atafb.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
atafb_iplan2p2.c fbdev: atafb: Remove obsolete module support 2019-04-01 17:46:55 +02:00
atafb_iplan2p4.c fbdev: atafb: Remove obsolete module support 2019-04-01 17:46:55 +02:00
atafb_iplan2p8.c fbdev: atafb: Remove obsolete module support 2019-04-01 17:46:55 +02:00
atafb_mfb.c fbdev: atafb: Remove obsolete module support 2019-04-01 17:46:55 +02:00
atafb_utils.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
atmel_lcdfb.c video: fbdev: atmel_lcdfb: fix an error code in atmel_lcdfb_probe() 2022-04-08 14:23:14 +02:00
au1100fb.c video: constify fb ops across all drivers 2019-12-05 10:57:53 +02:00
au1100fb.h au1100fb: fix DMA API abuse 2019-06-03 16:00:08 +02:00
au1200fb.c video: constify fb ops across all drivers 2019-12-05 10:57:53 +02:00
au1200fb.h fbdev: au1200fb: delete duplicate header contents 2018-01-04 16:53:49 +01:00
broadsheetfb.c video: constify fb ops across all drivers 2019-12-05 10:57:53 +02:00
bt431.h video: fbdev: bt431: Correct cursor format control macro 2016-02-26 13:06:11 +02:00
bt455.h video: fbdev: pmag-ba-fb: Optimize Bt455 colormap addressing 2016-02-26 13:06:11 +02:00
bw2.c video: fbdev: sparc drivers: fix kernel-doc warnings for blank_mode 2020-12-08 18:34:08 +01:00
c2p.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
c2p_core.h fbdev: c2p: Use BUILD_BUG() instead of custom solution 2020-03-09 11:12:19 +01:00
c2p_iplan2.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
c2p_planar.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
carminefb.c drm pull for 5.6-rc1 2020-01-30 08:04:01 -08:00
carminefb.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
carminefb_regs.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
cg3.c video: fbdev: sparc drivers: fix kernel-doc warnings for blank_mode 2020-12-08 18:34:08 +01:00
cg6.c video: fbdev: sparc drivers: fix kernel-doc warnings for blank_mode 2020-12-08 18:34:08 +01:00
cg14.c fbdev: cg14fb: use resource_size 2020-01-15 17:31:50 +01:00
chipsfb.c fbdev: chipsfb: Add missing pci_disable_device() in chipsfb_pci_init() 2022-09-15 11:30:01 +02:00
cirrusfb.c video: fbdev: cirrusfb: check pixclock to avoid divide by zero 2022-04-08 14:24:00 +02:00
clps711x-fb.c video: constify fb ops across all drivers 2019-12-05 10:57:53 +02:00
cobalt_lcdfb.c video: constify fb ops across all drivers 2019-12-05 10:57:53 +02:00
controlfb.c video: fbdev: controlfb: Fix COMPILE_TEST build 2022-04-08 14:23:14 +02:00
controlfb.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
cyber2000fb.c fbdev: cyber2000fb: use generic power management 2020-09-08 13:33:16 +02:00
cyber2000fb.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
da8xx-fb.c backlight/video: Use Platform getter/setter functions 2021-02-12 10:01:45 +00:00
dnfb.c video: constify fb ops across all drivers 2019-12-05 10:57:53 +02:00
edid.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
efifb.c fbdev: efifb: Fix a use-after-free due early fb_info cleanup 2022-05-18 10:26:49 +02:00
ep93xx-fb.c fbdev: ep93xx-fb: Add missing clk_disable_unprepare in ep93xxfb_probe() 2022-12-31 13:14:32 +01:00
ffb.c video: fbdev: sparc drivers: fix kernel-doc warnings for blank_mode 2020-12-08 18:34:08 +01:00
fm2fb.c video: constify fb ops across all drivers 2019-12-05 10:57:53 +02:00
fsl-diu-fb.c video: fbdev: fsl-diu-fb: remove unneeded variable 'res' 2020-10-17 08:23:14 +02:00
g364fb.c fbdev/g364fb: Fix build failure 2020-02-19 10:58:22 -08:00
gbefb.c video: fbdev: gbefb: Only instantiate device when built for IP32 2021-10-06 11:12:28 +02:00
goldfishfb.c video: fbdev: goldfishfb: Fix defined but not used warning 2020-12-08 18:34:50 +01:00
grvga.c video: fbdev: Replace HTTP links with HTTPS ones 2020-07-20 11:47:29 +02:00
gxt4500.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
hecubafb.c video: constify fb ops across all drivers 2019-12-05 10:57:53 +02:00
hgafb.c video: hgafb: correctly handle card detect failure during probe 2021-05-21 15:04:05 +02:00
hitfb.c mm: don't include asm/pgtable.h if linux/mm.h is already included 2020-06-09 09:39:13 -07:00
hpfb.c maccess: rename probe_kernel_{read,write} to copy_{from,to}_kernel_nofault 2020-06-17 10:57:41 -07:00
hyperv_fb.c video: hyperv_fb: Avoid taking busy spinlock on panic path 2022-12-31 13:14:39 +01:00
i740_reg.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
i740fb.c video: fbdev: i740fb: Error out if 'pixclock' equals zero 2022-09-23 14:15:49 +02:00
imsttfb.c video: imsttfb: check for ioremap() failures 2021-05-13 18:58:39 +02:00
imxfb.c video: fbdev: imxfb: Fix an error message 2021-05-07 18:34:18 +02:00
Kconfig fbdev: uvesafb: don't build on UML 2022-12-31 13:14:32 +01:00
leo.c video: fbdev: sparc drivers: fix kernel-doc warnings for blank_mode 2020-12-08 18:34:08 +01:00
macfb.c video: fbdev: Replace HTTP links with HTTPS ones 2020-07-20 11:47:29 +02:00
macmodes.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
macmodes.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
Makefile drm next for 5.10-rc1 2020-10-15 10:46:16 -07:00
maxinefb.c video: constify fb ops across all drivers 2019-12-05 10:57:53 +02:00
metronomefb.c video: fbdev: Replace HTTP links with HTTPS ones 2020-07-20 11:47:29 +02:00
mx3fb.c video: fbdev: mx3fb: Fix kernel-doc, set but not used and string warnings 2020-11-30 20:04:56 +01:00
n411.c Annotate hardware config module parameters in drivers/video/ 2017-04-20 12:02:32 +01:00
neofb.c video: fbdev: neofb: add a check against divide error 2021-07-21 15:02:03 +02:00
ocfb.c video: ocfb: Use devm_platform_ioremap_resource() in ocfb_probe() 2020-01-03 14:27:49 +01:00
offb.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
p9100.c video: fbdev: sparc drivers: fix kernel-doc warnings for blank_mode 2020-12-08 18:34:08 +01:00
platinumfb.c video: constify fb ops across all drivers 2019-12-05 10:57:53 +02:00
platinumfb.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
pm2fb.c fbdev: pm2fb: fix missing pci_disable_device() 2022-12-31 13:14:31 +01:00
pm3fb.c treewide: Remove uninitialized_var() usage 2020-07-16 12:35:15 -07:00
pmag-aa-fb.c drm pull for 5.6-rc1 2020-01-30 08:04:01 -08:00
pmag-ba-fb.c drm pull for 5.6-rc1 2020-01-30 08:04:01 -08:00
pmagb-b-fb.c drm pull for 5.6-rc1 2020-01-30 08:04:01 -08:00
ps3fb.c powerpc/ps3: make system bus's remove and shutdown callbacks return void 2020-12-04 01:01:22 +11:00
pvr2fb.c video: fbdev: pvr2fb: initialize variables 2020-08-05 19:47:22 +02:00
pxa3xx-gcu.c video: fbdev: pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_write 2022-09-23 14:15:51 +02:00
pxa3xx-gcu.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
pxa168fb.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
pxa168fb.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
pxafb.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
pxafb.h video: pxafb: Remove cpufreq policy notifier 2019-08-26 10:02:02 +02:00
q40fb.c mm: don't include asm/pgtable.h if linux/mm.h is already included 2020-06-09 09:39:13 -07:00
s1d13xxxfb.c video: fbdev: s1d13xxxfb: Fix kernel-doc and set but not used warnings 2020-11-29 22:51:07 +01:00
s3c-fb.c video: fbdev: s3c-fb: Fix kernel-doc and set but not used warnings 2020-12-05 21:01:04 +01:00
s3c2410fb-regs-lcd.h fbdev: s3c2410fb: remove mach header dependency 2020-08-20 17:48:12 +02:00
s3c2410fb.c fbdev: s3c2410fb: remove mach header dependency 2020-08-20 17:48:12 +02:00
s3c2410fb.h video: s3c2410fb: Register cpufreq notifier only on S3C24xx 2016-08-11 17:54:55 +03:00
s3fb.c video: fbdev: s3fb: Check the size of screen before memset_io() 2022-08-17 14:24:16 +02:00
sa1100fb.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
sa1100fb.h ARM/fbdev: sa11x0: Switch to use GPIO descriptors 2020-04-17 15:50:11 +02:00
sbuslib.c fbdev: sbuslib: remove compat_alloc_user_space usage 2020-09-25 16:34:50 +02:00
sbuslib.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
sh7760fb.c drm pull for 5.6-rc1 2020-01-30 08:04:01 -08:00
sh_mobile_lcdcfb.c fbdev/sh_mobile: Drop unused include 2020-11-01 10:29:04 +01:00
sh_mobile_lcdcfb.h fbdev/sh_mobile: remove sh_mobile_lcdc_display_notify 2019-06-12 20:28:11 +02:00
simplefb.c fbdev: simplefb: Cleanup fb_info in .fb_destroy rather than .remove 2022-05-18 10:26:48 +02:00
skeletonfb.c video: constify fb ops across all drivers 2019-12-05 10:57:53 +02:00
sm501fb.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
sm712.h fbdev: sm712fb: use 1024x768 by default on non-MIPS, fix garbled display 2019-04-01 17:46:59 +02:00
sm712fb.c video: fbdev: sm712fb: Fix crash in smtcfb_write() 2022-04-08 14:24:02 +02:00
smscufx.c fbdev: smscufx: fix error handling code in ufx_usb_probe 2023-02-09 11:26:47 +01:00
ssd1307fb.c video: fbdev: ssd1307fb: Cache address ranges 2021-07-27 17:18:26 +02:00
sstfb.c video: fbdev: sstfb: Updated logging to fix set but not used warnings 2020-11-30 20:04:59 +01:00
sticore.h parisc/stifb: Keep track of hardware path of graphics card 2022-06-09 10:22:26 +02:00
stifb.c fbdev: stifb: Fall back to cfb_fillrect() on 32-bit HCRX cards 2022-11-10 18:15:32 +01:00
sunxvr500.c video: constify fb ops across all drivers 2019-12-05 10:57:53 +02:00
sunxvr1000.c video: constify fb ops across all drivers 2019-12-05 10:57:53 +02:00
sunxvr2500.c video: constify fb ops across all drivers 2019-12-05 10:57:53 +02:00
tcx.c video: fbdev: sparc drivers: fix kernel-doc warnings for blank_mode 2020-12-08 18:34:08 +01:00
tdfxfb.c video: fbdev: tdfx: Fix set but not used warning in att_outb() 2020-11-30 20:04:30 +01:00
tgafb.c video: fbdev: tgafb: Fix kernel-doc and set but not used warnings 2020-11-30 20:04:50 +01:00
tmiofb.c video: constify fb ops across all drivers 2019-12-05 10:57:53 +02:00
tridentfb.c drm pull for 5.6-rc1 2020-01-30 08:04:01 -08:00
udlfb.c video: fbdev: udlfb: properly check endpoint type 2022-05-09 09:14:31 +02:00
uvesafb.c fbdev: uvesafb: Fixes an error handling path in uvesafb_probe() 2022-12-31 13:14:32 +01:00
valkyriefb.c video: fbdev: valkyriefb.c: fix warning comparing pointer to 0 2020-05-06 21:04:45 +02:00
valkyriefb.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
vesafb.c video: fbdev: vesafb: Fix a use-after-free due early fb_info cleanup 2022-06-09 10:23:16 +02:00
vfb.c video: constify fb ops across all drivers 2019-12-05 10:57:53 +02:00
vga16fb.c video: vga16fb: Only probe for EGA and VGA 16 color graphic cards 2022-01-20 09:13:14 +01:00
vt8500lcdfb.c video: vt8500lcdfb: fix fallthrough warning 2020-04-17 15:50:08 +02:00
vt8500lcdfb.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 282 2019-06-05 17:36:37 +02:00
vt8623fb.c video: fbdev: vt8623fb: Check the size of screen before memset_io() 2022-08-17 14:24:16 +02:00
w100fb.c video: fbdev: w100fb: Reset global state 2022-04-08 14:23:59 +02:00
w100fb.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
wm8505fb.c video: fbdev: wm8505fb: fix sparse warnings about using incorrect types 2020-03-02 16:32:04 +01:00
wm8505fb_regs.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 282 2019-06-05 17:36:37 +02:00
wmt_ge_rops.c video: fbdev: wmt_ge_rops: Fix function not declared warnings 2020-12-08 18:34:36 +01:00
wmt_ge_rops.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
xen-fbfront.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
xilinxfb.c video: fbdev: Fix fall-through warning for Clang 2021-07-13 13:58:29 -05:00