Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a50d28de authored by Bruno Prémont's avatar Bruno Prémont Committed by Paul Mundt
Browse files

video: Fix use-after-free by vga16fb on rmmod 



Since fb_info is now refcounted and thus may get freed at any time it
gets unregistered module unloading will try to unregister framebuffer
as stored in platform data on probe though this pointer may
be stale.

Cleanup platform data on framebuffer release.

CC: stable@kernel.org
Signed-off-by: default avatarBruno Prémont <bonbons@linux-vserver.org>
Signed-off-by: default avatarPaul Mundt <lethal@linux-sh.org>
parent 1b86d775

drivers/video/vga16fb.c

+2 −0
Original line number Diff line number Diff line
@@ -1265,9 +1265,11 @@ static void vga16fb_imageblit(struct fb_info *info, const struct fb_image *image 


static void vga16fb_destroy(struct fb_info *info)

{

	struct platform_device *dev = container_of(info->device, struct platform_device, dev);

	iounmap(info->screen_base);

	fb_dealloc_cmap(&info->cmap);

	/* XXX unshare VGA regions */

	platform_set_drvdata(dev, NULL);

	framebuffer_release(info);

}