Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 815c95d8 authored by Zheng Wang's avatar Zheng Wang Committed by Greg Kroah-Hartman
Browse files

fbdev: imsttfb: Fix use after free bug in imsttfb_probe 



commit c75f5a55061091030a13fef71b9995b89bc86213 upstream.

A use-after-free bug may occur if init_imstt invokes framebuffer_release
and free the info ptr. The caller, imsttfb_probe didn't notice that and
still keep the ptr as private data in pdev.

If we remove the driver which will call imsttfb_remove to make cleanup,
UAF happens.

Fix it by return error code if bad case happens in init_imstt.

Signed-off-by: default avatarZheng Wang <zyytlz.wz@163.com>
Signed-off-by: default avatarHelge Deller <deller@gmx.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent a7c8d2f3

drivers/video/fbdev/imsttfb.c

+8 −7
Original line number Diff line number Diff line
@@ -1346,7 +1346,7 @@ static struct fb_ops imsttfb_ops = { 
	.fb_ioctl 	= imsttfb_ioctl,

};



static void init_imstt(struct fb_info *info)

static int init_imstt(struct fb_info *info)

{

	struct imstt_par *par = info->par;

	__u32 i, tmp, *ip, *end;
@@ -1419,7 +1419,7 @@ static void init_imstt(struct fb_info *info) 
	    || !(compute_imstt_regvals(par, info->var.xres, info->var.yres))) {

		printk("imsttfb: %ux%ux%u not supported\n", info->var.xres, info->var.yres, info->var.bits_per_pixel);

		framebuffer_release(info);

		return;

		return -ENODEV;

	}



	sprintf(info->fix.id, "IMS TT (%s)", par->ramdac == IBM ? "IBM" : "TVP");
@@ -1455,12 +1455,13 @@ static void init_imstt(struct fb_info *info) 


	if (register_framebuffer(info) < 0) {

		framebuffer_release(info);

		return;

		return -ENODEV;

	}



	tmp = (read_reg_le32(par->dc_regs, SSTATUS) & 0x0f00) >> 8;

	fb_info(info, "%s frame buffer; %uMB vram; chip version %u\n",

		info->fix.id, info->fix.smem_len >> 20, tmp);

	return 0;

}



static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
@@ -1523,10 +1524,10 @@ static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent) 
	if (!par->cmap_regs)

		goto error;

	info->pseudo_palette = par->palette;

	init_imstt(info);



	ret = init_imstt(info);

	if (!ret)

		pci_set_drvdata(pdev, info);

	return 0;

	return ret;



error:

	if (par->dc_regs)