[PATCH] fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe()

Abdun Nihaal posted 1 patch 2 weeks, 3 days ago
There is a newer version of this series
drivers/video/fbdev/ssd1307fb.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
[PATCH] fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe()
Posted by Abdun Nihaal 2 weeks, 3 days ago
The page allocated for vmem using __get_free_pages() is not freed on the
error paths after it. Fix that by adding a corresponding __free_pages()
call to the error path.

Fixes: facd94bc458a ("fbdev: ssd1307fb: Allocate page aligned video memory.")
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
---
Compile tested only. Not tested on hardware.

 drivers/video/fbdev/ssd1307fb.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/ssd1307fb.c b/drivers/video/fbdev/ssd1307fb.c
index aa6cc0a8151a..66da8a1a0941 100644
--- a/drivers/video/fbdev/ssd1307fb.c
+++ b/drivers/video/fbdev/ssd1307fb.c
@@ -680,7 +680,7 @@ static int ssd1307fb_probe(struct i2c_client *client)
 	if (!ssd1307fb_defio) {
 		dev_err(dev, "Couldn't allocate deferred io.\n");
 		ret = -ENOMEM;
-		goto fb_alloc_error;
+		goto fb_defio_error;
 	}
 
 	ssd1307fb_defio->delay = HZ / refreshrate;
@@ -757,6 +757,8 @@ static int ssd1307fb_probe(struct i2c_client *client)
 		regulator_disable(par->vbat_reg);
 reset_oled_error:
 	fb_deferred_io_cleanup(info);
+fb_defio_error:
+	__free_pages(__va(info->fix.smem_start), get_order(info->fix.smem_len));
 fb_alloc_error:
 	framebuffer_release(info);
 	return ret;
-- 
2.43.0
Re: [PATCH] fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe()
Posted by Helge Deller 2 weeks, 3 days ago
On 12/2/25 20:12, Abdun Nihaal wrote:
> The page allocated for vmem using __get_free_pages() is not freed on the
> error paths after it. Fix that by adding a corresponding __free_pages()
> call to the error path.
> 
> Fixes: facd94bc458a ("fbdev: ssd1307fb: Allocate page aligned video memory.")
> Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
> ---
> Compile tested only. Not tested on hardware.
> 
>   drivers/video/fbdev/ssd1307fb.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/video/fbdev/ssd1307fb.c b/drivers/video/fbdev/ssd1307fb.c
> index aa6cc0a8151a..66da8a1a0941 100644
> --- a/drivers/video/fbdev/ssd1307fb.c
> +++ b/drivers/video/fbdev/ssd1307fb.c
> @@ -680,7 +680,7 @@ static int ssd1307fb_probe(struct i2c_client *client)
>   	if (!ssd1307fb_defio) {
>   		dev_err(dev, "Couldn't allocate deferred io.\n");
>   		ret = -ENOMEM;
> -		goto fb_alloc_error;
> +		goto fb_defio_error;

this goto jumps over the assignment of info->fix.smem_start, so...
...

>   	}
>   
>   	ssd1307fb_defio->delay = HZ / refreshrate;
> @@ -757,6 +757,8 @@ static int ssd1307fb_probe(struct i2c_client *client)
>   		regulator_disable(par->vbat_reg);
>   reset_oled_error:
>   	fb_deferred_io_cleanup(info);
> +fb_defio_error:
> +	__free_pages(__va(info->fix.smem_start), get_order(info->fix.smem_len));

freeing info->fix.smem_start is wrong here as it was not initialized
to the value of vmem.

Please rework the patch.

Helge