]> git.baikalelectronics.ru Git - kernel.git/commit
drm: udl: Destroy framebuffer only if it was initialized
authorEmil Lundmark <lndmrk@chromium.org>
Mon, 28 May 2018 14:27:11 +0000 (16:27 +0200)
committerSean Paul <seanpaul@chromium.org>
Mon, 10 Sep 2018 20:02:51 +0000 (16:02 -0400)
commitaa66bcd61f79f30b43714a556e1d7a37431bf06c
tree52716b37501469dd909df77ad9587f03109b6f70
parent2689058cef26f8c4e18faed1397661c1a731268e
drm: udl: Destroy framebuffer only if it was initialized

This fixes a NULL pointer dereference that can happen if the UDL
driver is unloaded before the framebuffer is initialized. This can
happen e.g. if the USB device is unplugged right after it was plugged
in.

As explained by Stéphane Marchesin:

It happens when fbdev is disabled (which is the case for Chrome OS).
Even though intialization of the fbdev part is optional (it's done in
udlfb_create which is the callback for fb_probe()), the teardown isn't
optional (udl_driver_unload -> udl_fbdev_cleanup ->
udl_fbdev_destroy).

Note that udl_fbdev_cleanup *tries* to be conditional (you can see it
does if (!udl->fbdev)) but that doesn't work, because udl->fbdev is
always set during udl_fbdev_init.

Cc: stable@vger.kernel.org
Suggested-by: Sean Paul <seanpaul@chromium.org>
Reviewed-by: Sean Paul <seanpaul@chromium.org>
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Emil Lundmark <lndmrk@chromium.org>
Signed-off-by: Sean Paul <seanpaul@chromium.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20180528142711.142466-1-lndmrk@chromium.org
Signed-off-by: Sean Paul <seanpaul@chromium.org>
drivers/gpu/drm/udl/udl_fb.c