• Dongliang Mu's avatar
    fbdev: smscufx: fix error handling code in ufx_usb_probe · b76449ee
    Dongliang Mu authored
    The current error handling code in ufx_usb_probe have many unmatching
    issues, e.g., missing ufx_free_usb_list, destroy_modedb label should
    only include framebuffer_release, fb_dealloc_cmap only matches
    fb_alloc_cmap.
    
    My local syzkaller reports a memory leak bug:
    
    memory leak in ufx_usb_probe
    
    BUG: memory leak
    unreferenced object 0xffff88802f879580 (size 128):
      comm "kworker/0:7", pid 17416, jiffies 4295067474 (age 46.710s)
      hex dump (first 32 bytes):
        80 21 7c 2e 80 88 ff ff 18 d0 d0 0c 80 88 ff ff  .!|.............
        00 d0 d0 0c 80 88 ff ff e0 ff ff ff 0f 00 00 00  ................
      backtrace:
        [<ffffffff814c99a0>] kmalloc_trace+0x20/0x90 mm/slab_common.c:1045
        [<ffffffff824d219c>] kmalloc include/linux/slab.h:553 [inline]
        [<ffffffff824d219c>] kzalloc include/linux/slab.h:689 [inline]
        [<ffffffff824d219c>] ufx_alloc_urb_list drivers/video/fbdev/smscufx.c:1873 [inline]
        [<ffffffff824d219c>] ufx_usb_probe+0x11c/0x15a0 drivers/video/fbdev/smscufx.c:1655
        [<ffffffff82d17927>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
        [<ffffffff82712f0d>] call_driver_probe drivers/base/dd.c:560 [inline]
        [<ffffffff82712f0d>] really_probe+0x12d/0x390 drivers/base/dd.c:639
        [<ffffffff8271322f>] __driver_probe_device+0xbf/0x140 drivers/base/dd.c:778
        [<ffffffff827132da>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:808
        [<ffffffff82713c27>] __device_attach_driver+0xf7/0x150 drivers/base/dd.c:936
        [<ffffffff82710137>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
        [<ffffffff827136b5>] __device_attach+0x105/0x2d0 drivers/base/dd.c:1008
        [<ffffffff82711d36>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487
        [<ffffffff8270e242>] device_add+0x642/0xdc0 drivers/base/core.c:3517
        [<ffffffff82d14d5f>] usb_set_configuration+0x8ef/0xb80 drivers/usb/core/message.c:2170
        [<ffffffff82d2576c>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
        [<ffffffff82d16ffc>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293
        [<ffffffff82712f0d>] call_driver_probe drivers/base/dd.c:560 [inline]
        [<ffffffff82712f0d>] really_probe+0x12d/0x390 drivers/base/dd.c:639
        [<ffffffff8271322f>] __driver_probe_device+0xbf/0x140 drivers/base/dd.c:778
    
    Fix this bug by rewriting the error handling code in ufx_usb_probe.
    Reported-by: default avatarsyzkaller <syzkaller@googlegroups.com>
    Tested-by: default avatarDongliang Mu <dzm91@hust.edu.cn>
    Signed-off-by: default avatarDongliang Mu <dzm91@hust.edu.cn>
    Signed-off-by: default avatarHelge Deller <deller@gmx.de>
    b76449ee
smscufx.c 53.5 KB