Re: [PATCH] drm/udl: reject short USB EDID control transfers and fix URB init cleanup

[Jani Nikula <jani.nikula@linux.intel.com>]

On Sat, 19 Sep 2026, Hui Peng <benquike@gmail.com> wrote:
> In drivers/gpu/drm/udl/ (udl_drv.c, udl_edid.c), check that
> usb_control_msg() returns the full 2-byte response in
> udl_read_edid_block() before copying read_buff[1], and clean up
> allocated URBs if udl_Driver initialization fails.

One change per patch please.

>
> Fixes: 5320918b9a87 ("drm/udl: initial UDL driver (v4)")
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>
> ---
> diff --git a/drivers/gpu/drm/udl/udl_drv.c b/drivers/gpu/drm/udl/udl_drv.c
> index 1922988625eb..239a6983f49f 100644
> --- a/drivers/gpu/drm/udl/udl_drv.c
> +++ b/drivers/gpu/drm/udl/udl_drv.c
> @@ -97,8 +97,10 @@ static int udl_usb_probe(struct usb_interface *interface,
>  		return PTR_ERR(udl);
>  
>  	r = drm_dev_register(&udl->drm, 0);
> -	if (r)
> +	if (r) {
> +		udl_drop_usb(udl);
>  		return r;
> +	}
>  
>  	DRM_INFO("Initialized udl on minor %d\n", udl->drm.primary->index);
>  
> diff --git a/drivers/gpu/drm/udl/udl_edid.c b/drivers/gpu/drm/udl/udl_edid.c
> index af4cff2a7c51..b7c462436573 100644
> --- a/drivers/gpu/drm/udl/udl_edid.c
> +++ b/drivers/gpu/drm/udl/udl_edid.c
> @@ -36,7 +36,7 @@ static int udl_read_edid_block(void *data, u8 *buf, unsigned int block, size_t l
>  		if (ret < 0) {
>  			drm_err(dev, "Read EDID byte %zu failed err %x\n", i, ret);
>  			goto err_drm_dev_exit;
> -		} else if (ret < 1) {
> +		} else if (ret != 2) {
>  			ret = -EIO;
>  			drm_err(dev, "Read EDID byte %zu failed\n", i);
>  			goto err_drm_dev_exit;

-- 
Jani Nikula, Intel