drm: udl: Destroy framebuffer only if it was initialized

lndmrk · atseanpaul · commit fcb74da1eb8e · 2018-09-10T16:02:51.000-04:00
This fixes a NULL pointer dereference that can happen if the UDL driver is unloaded before the framebuffer is initialized. This can happen e.g. if the USB device is unplugged right after it was plugged in. As explained by Stéphane Marchesin: It happens when fbdev is disabled (which is the case for Chrome OS). Even though intialization of the fbdev part is optional (it's done in udlfb_create which is the callback for fb_probe()), the teardown isn't optional (udl_driver_unload -> udl_fbdev_cleanup -> udl_fbdev_destroy). Note that udl_fbdev_cleanup *tries* to be conditional (you can see it does if (!udl->fbdev)) but that doesn't work, because udl->fbdev is always set during udl_fbdev_init. Cc: stable@vger.kernel.org Suggested-by: Sean Paul <seanpaul@chromium.org> Reviewed-by: Sean Paul <seanpaul@chromium.org> Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Emil Lundmark <lndmrk@chromium.org> Signed-off-by: Sean Paul <seanpaul@chromium.org> Link: https://patchwork.freedesktop.org/patch/msgid/20180528142711.142466-1-lndmrk@chromium.org Signed-off-by: Sean Paul <seanpaul@chromium.org>
diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
@@ -432,9 +432,11 @@ static void udl_fbdev_destroy(struct drm_device *dev,
 {
 	drm_fb_helper_unregister_fbi(&ufbdev->helper);
 	drm_fb_helper_fini(&ufbdev->helper);
-	drm_framebuffer_unregister_private(&ufbdev->ufb.base);
-	drm_framebuffer_cleanup(&ufbdev->ufb.base);
-	drm_gem_object_put_unlocked(&ufbdev->ufb.obj->base);
+	if (ufbdev->ufb.obj) {
+		drm_framebuffer_unregister_private(&ufbdev->ufb.base);
+		drm_framebuffer_cleanup(&ufbdev->ufb.base);
+		drm_gem_object_put_unlocked(&ufbdev->ufb.obj->base);
+	}
 }
 
 int udl_fbdev_init(struct drm_device *dev)

Original file line number	Diff line number	Diff line change
`@@ -432,9 +432,11 @@ static void udl_fbdev_destroy(struct drm_device *dev,`
`432`	`432`	`{`
`433`	`433`	`drm_fb_helper_unregister_fbi(&ufbdev->helper);`
`434`	`434`	`drm_fb_helper_fini(&ufbdev->helper);`
`435`		`- drm_framebuffer_unregister_private(&ufbdev->ufb.base);`
`436`		`- drm_framebuffer_cleanup(&ufbdev->ufb.base);`
`437`		`- drm_gem_object_put_unlocked(&ufbdev->ufb.obj->base);`
	`435`	`+ if (ufbdev->ufb.obj) {`
	`436`	`+ drm_framebuffer_unregister_private(&ufbdev->ufb.base);`
	`437`	`+ drm_framebuffer_cleanup(&ufbdev->ufb.base);`
	`438`	`+ drm_gem_object_put_unlocked(&ufbdev->ufb.obj->base);`
	`439`	`+ }`
`438`	`440`	`}`
`439`	`441`
`440`	`442`	`int udl_fbdev_init(struct drm_device *dev)`