[PATCH] drm/udl: reject short USB EDID control transfers and fix URB init cleanup

[Hui Peng]

In drivers/gpu/drm/udl/ (udl_drv.c, udl_edid.c), check that
usb_control_msg() returns the full 2-byte response in
udl_read_edid_block() before copying read_buff[1], and clean up
allocated URBs if udl_Driver initialization fails.

Fixes: 5320918b9a87 ("drm/udl: initial UDL driver (v4)")
Assisted-by: LLM
Signed-off-by: Hui Peng <benqu...@gmail.com>
---
diff --git a/drivers/gpu/drm/udl/udl_drv.c b/drivers/gpu/drm/udl/udl_drv.c
index 1922988625eb..239a6983f49f 100644
--- a/drivers/gpu/drm/udl/udl_drv.c
+++ b/drivers/gpu/drm/udl/udl_drv.c
@@ -97,8 +97,10 @@ static int udl_usb_probe(struct usb_interface *interface,
                return PTR_ERR(udl);
 
        r = drm_dev_register(&udl->drm, 0);
-       if (r)
+       if (r) {
+               udl_drop_usb(udl);
                return r;
+       }
 
        DRM_INFO("Initialized udl on minor %d\n", udl->drm.primary->index);
 
diff --git a/drivers/gpu/drm/udl/udl_edid.c b/drivers/gpu/drm/udl/udl_edid.c
index af4cff2a7c51..b7c462436573 100644
--- a/drivers/gpu/drm/udl/udl_edid.c
+++ b/drivers/gpu/drm/udl/udl_edid.c
@@ -36,7 +36,7 @@ static int udl_read_edid_block(void *data, u8 *buf, unsigned 
int block, size_t l
                if (ret < 0) {
                        drm_err(dev, "Read EDID byte %zu failed err %x\n", i, 
ret);
                        goto err_drm_dev_exit;
-               } else if (ret < 1) {
+               } else if (ret != 2) {
                        ret = -EIO;
                        drm_err(dev, "Read EDID byte %zu failed\n", i);
                        goto err_drm_dev_exit;