Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5ae29649 authored by Dan Carpenter's avatar Dan Carpenter Committed by Bartlomiej Zolnierkiewicz
Browse files

video: fbdev: imxfb: use after free in imxfb_remove() 



We free "info" then dereference it on the next line.  Really this whole
function would be better if we wrote it to unwind in the mirror of how
things are allocated in the probe.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Cc: Alexander Shiyan <shc_work@mail.ru>
Cc: Sascha Hauer <kernel@pengutronix.de>
Signed-off-by: default avatarBartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
parent 16f73eb0

drivers/video/fbdev/imxfb.c

+3 −7
Original line number Diff line number Diff line
@@ -1073,20 +1073,16 @@ static int imxfb_remove(struct platform_device *pdev) 
	imxfb_disable_controller(fbi);



	unregister_framebuffer(info);



	fb_dealloc_cmap(&info->cmap);

	pdata = dev_get_platdata(&pdev->dev);

	if (pdata && pdata->exit)

		pdata->exit(fbi->pdev);



	fb_dealloc_cmap(&info->cmap);

	kfree(info->pseudo_palette);

	framebuffer_release(info);



	dma_free_wc(&pdev->dev, fbi->map_size, info->screen_base,

		    fbi->map_dma);



	iounmap(fbi->regs);

	release_mem_region(res->start, resource_size(res));

	kfree(info->pseudo_palette);

	framebuffer_release(info);



	return 0;

}