diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2018-12-20 13:13:07 -0500 |
|---|---|---|
| committer | Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> | 2018-12-20 13:13:07 -0500 |
| commit | c143a559b073aeea688b9bb7c5b46f3cf322d569 (patch) | |
| tree | f004548efca498d415564a81c2250bc7cb96229d /drivers/video/fbdev | |
| parent | 31d1b7710262fba12282b24083f20dc76e0efc93 (diff) | |
udlfb: fix some inconsistent NULL checking
In the current kernel, then kzalloc() can't fail for small allocations,
but if it did fail then we would have a NULL dereference in the error
handling. Also in dlfb_usb_disconnect() if "info" were NULL then it
would cause an Oops inside the unregister_framebuffer() function but it
can't be NULL so let's remove that check.
Fixes: 68a958a915ca ("udlfb: handle unplug properly")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Bernie Thompson <bernie@plugable.com>
Cc: Mikulas Patocka <mpatocka@redhat.com>
Cc: Alexey Khoroshilov <khoroshilov@ispras.ru>
Cc: Colin Ian King <colin.king@canonical.com>
Cc: Wen Yang <wen.yang99@zte.com.cn>
[b.zolnierkie: added "Fixes:" tag]
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Diffstat (limited to 'drivers/video/fbdev')
| -rw-r--r-- | drivers/video/fbdev/udlfb.c | 14 |
1 files changed, 6 insertions, 8 deletions
diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c index 070026a7e55a..1d034dddc556 100644 --- a/drivers/video/fbdev/udlfb.c +++ b/drivers/video/fbdev/udlfb.c | |||
| @@ -1598,7 +1598,7 @@ static int dlfb_usb_probe(struct usb_interface *intf, | |||
| 1598 | dlfb = kzalloc(sizeof(*dlfb), GFP_KERNEL); | 1598 | dlfb = kzalloc(sizeof(*dlfb), GFP_KERNEL); |
| 1599 | if (!dlfb) { | 1599 | if (!dlfb) { |
| 1600 | dev_err(&intf->dev, "%s: failed to allocate dlfb\n", __func__); | 1600 | dev_err(&intf->dev, "%s: failed to allocate dlfb\n", __func__); |
| 1601 | goto error; | 1601 | return -ENOMEM; |
| 1602 | } | 1602 | } |
| 1603 | 1603 | ||
| 1604 | INIT_LIST_HEAD(&dlfb->deferred_free); | 1604 | INIT_LIST_HEAD(&dlfb->deferred_free); |
| @@ -1703,7 +1703,7 @@ static int dlfb_usb_probe(struct usb_interface *intf, | |||
| 1703 | error: | 1703 | error: |
| 1704 | if (dlfb->info) { | 1704 | if (dlfb->info) { |
| 1705 | dlfb_ops_destroy(dlfb->info); | 1705 | dlfb_ops_destroy(dlfb->info); |
| 1706 | } else if (dlfb) { | 1706 | } else { |
| 1707 | usb_put_dev(dlfb->udev); | 1707 | usb_put_dev(dlfb->udev); |
| 1708 | kfree(dlfb); | 1708 | kfree(dlfb); |
| 1709 | } | 1709 | } |
| @@ -1730,12 +1730,10 @@ static void dlfb_usb_disconnect(struct usb_interface *intf) | |||
| 1730 | /* this function will wait for all in-flight urbs to complete */ | 1730 | /* this function will wait for all in-flight urbs to complete */ |
| 1731 | dlfb_free_urb_list(dlfb); | 1731 | dlfb_free_urb_list(dlfb); |
| 1732 | 1732 | ||
| 1733 | if (info) { | 1733 | /* remove udlfb's sysfs interfaces */ |
| 1734 | /* remove udlfb's sysfs interfaces */ | 1734 | for (i = 0; i < ARRAY_SIZE(fb_device_attrs); i++) |
| 1735 | for (i = 0; i < ARRAY_SIZE(fb_device_attrs); i++) | 1735 | device_remove_file(info->dev, &fb_device_attrs[i]); |
| 1736 | device_remove_file(info->dev, &fb_device_attrs[i]); | 1736 | device_remove_bin_file(info->dev, &edid_attr); |
| 1737 | device_remove_bin_file(info->dev, &edid_attr); | ||
| 1738 | } | ||
| 1739 | 1737 | ||
| 1740 | unregister_framebuffer(info); | 1738 | unregister_framebuffer(info); |
| 1741 | } | 1739 | } |
