video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe()

[ Upstream commit 1791f487f877a9e83d81c8677bd3e7b259e7cb27 ]

I got a null-ptr-deref report:

BUG: kernel NULL pointer dereference, address: 0000000000000000
...
RIP: 0010:fb_destroy_modelist+0x38/0x100
...
Call Trace:
 ufx_usb_probe.cold+0x2b5/0xac1 [smscufx]
 usb_probe_interface+0x1aa/0x3c0 [usbcore]
 really_probe+0x167/0x460
...
 ret_from_fork+0x1f/0x30

If fb_alloc_cmap() fails in ufx_usb_probe(), fb_destroy_modelist() will
be called to destroy modelist in the error handling path. But modelist
has not been initialized yet, so it will result in null-ptr-deref.

Initialize modelist before calling fb_alloc_cmap() to fix this bug.

Fixes: 3c8a63e22a08 ("Add support for SMSC UFX6000/7000 USB display adapters")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/video/fbdev/smscufx.c b/drivers/video/fbdev/smscufx.c
index bfac3ee..28768c2 100644 (file)
--- a/drivers/video/fbdev/smscufx.c
+++ b/drivers/video/fbdev/smscufx.c
@@ -1656,6 +1656,7 @@ static int ufx_usb_probe(struct usb_interface *interface,
        info->par = dev;
        info->pseudo_palette = dev->pseudo_palette;
        info->fbops = &ufx_ops;
+       INIT_LIST_HEAD(&info->modelist);
 
        retval = fb_alloc_cmap(&info->cmap, 256, 0);
        if (retval < 0) {
@@ -1666,8 +1667,6 @@ static int ufx_usb_probe(struct usb_interface *interface,
        INIT_DELAYED_WORK(&dev->free_framebuffer_work,
                          ufx_free_framebuffer_work);
 
-       INIT_LIST_HEAD(&info->modelist);
-
        retval = ufx_reg_read(dev, 0x3000, &id_rev);
        check_warn_goto_error(retval, "error %d reading 0x3000 register from device", retval);
        dev_dbg(dev->gdev, "ID_REV register value 0x%08x", id_rev);