In udl_usb_probe(), udl_driver_create() calls udl_init(udl), which
allocates USB URBs and DMA buffers via udl_alloc_urb_list() that are
normally freed by udl_drop_usb() in udl_usb_disconnect(). If
drm_dev_register() fails in udl_usb_probe(), udl_usb_probe() returns
without calling udl_drop_usb(udl), leaking the allocated URB list and DMA
buffers because udl_usb_disconnect() is not called when probe fails.
Call udl_drop_usb(udl) when drm_dev_register() fails in udl_usb_probe().
Tested in QEMU against Linux 7.3.0-rc3 using dummy_hcd by simulating
a registration error in drm_dev_register(): on the unfixed kernel,
udl_usb_probe() returned an error without calling udl_drop_usb(udl),
leaking 8 allocated URBs and DMA buffers; whereas with this fix applied,
udl_drop_usb(udl) is called on error, freeing all URB and DMA
allocations.
Fixes: 5320918b9a87 ("drm/udl: initial UDL driver (v4)")
Cc: [email protected]
Reviewed-by: Thomas Zimmermann <[email protected]>
Assisted-by: LLM
Signed-off-by: Hui Peng <[email protected]>
---
Changes in v3:
- Add Reviewed-by tag from Thomas Zimmermann.
Changes in v2:
- Split out as patch 2/2 as requested by Jani Nikula.
- Added testing details in QEMU on drm_dev_register() failure cleanup.
drivers/gpu/drm/udl/udl_drv.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/udl/udl_drv.c b/drivers/gpu/drm/udl/udl_drv.c
index 1922988625eb..239a6983f49f 100644
--- a/drivers/gpu/drm/udl/udl_drv.c
+++ b/drivers/gpu/drm/udl/udl_drv.c
@@ -97,8 +97,10 @@ static int udl_usb_probe(struct usb_interface *interface,
return PTR_ERR(udl);
r = drm_dev_register(&udl->drm, 0);
- if (r)
+ if (r) {
+ udl_drop_usb(udl);
return r;
+ }
DRM_INFO("Initialized udl on minor %d\n", udl->drm.primary->index);
