Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ba21611c authored by Jeremy Kerr's avatar Jeremy Kerr Committed by Linus Torvalds
Browse files

ps3fb: prevent use after free of fb_info 



In ps3fb_shutdown, freeing the framebuffer will cause fb_info (in
dev->core.driver_data) to be free()ed, which we potentially access
from the ps3fbd kthread.

This change frees the framebuffer after stopping the ps3fbd kthread.

Signed-off-by: default avatarJeremy Kerr <jk@ozlabs.org>
Signed-off-by: default avatarGeert Uytterhoeven <Geert.Uytterhoeven@sonycom.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent b506d1b6

drivers/video/ps3fb.c

+6 −6
Original line number Diff line number Diff line
@@ -1234,12 +1234,6 @@ static int ps3fb_shutdown(struct ps3_system_bus_device *dev) 
	ps3fb_flip_ctl(0, &ps3fb);	/* flip off */

	ps3fb.dinfo->irq.mask = 0;



	if (info) {

		unregister_framebuffer(info);

		fb_dealloc_cmap(&info->cmap);

		framebuffer_release(info);

	}



	ps3av_register_flip_ctl(NULL, NULL);

	if (ps3fb.task) {

		struct task_struct *task = ps3fb.task;
@@ -1250,6 +1244,12 @@ static int ps3fb_shutdown(struct ps3_system_bus_device *dev) 
		free_irq(ps3fb.irq_no, &dev->core);

		ps3_irq_plug_destroy(ps3fb.irq_no);

	}

	if (info) {

		unregister_framebuffer(info);

		fb_dealloc_cmap(&info->cmap);

		framebuffer_release(info);

		info = dev->core.driver_data = NULL;

	}

	iounmap((u8 __iomem *)ps3fb.dinfo);



	status = lv1_gpu_context_free(ps3fb.context_handle);