A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-30 03:27:44 -04:00
Code Issues Projects Releases Packages Wiki Activity

video: fbdev: imxfb: use after free in imxfb_remove()

Browse source 
We free "info" then dereference it on the next line.  Really this whole
function would be better if we wrote it to unwind in the mirror of how
things are allocated in the probe.

Signed-off-by: Dan Carpenter <[email protected]>
Cc: Alexander Shiyan <[email protected]>
Cc: Sascha Hauer <[email protected]>
Signed-off-by: Bartlomiej Zolnierkiewicz <[email protected]>
This commit is contained in:
Dan Carpenter 2017-07-31 18:45:41 +02:00 • committed by Bartlomiej Zolnierkiewicz
commit 5ae29649e0
1 changed files with 3 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

10
drivers/video/fbdev/imxfb.c
View file

@ -1073,20 +1073,16 @@ static int imxfb_remove(struct platform_device *pdev)
imxfb_disable_controller(fbi);
unregister_framebuffer(info);
fb_dealloc_cmap(&info->cmap);
pdata = dev_get_platdata(&pdev->dev);
if (pdata && pdata->exit)
pdata->exit(fbi->pdev);
fb_dealloc_cmap(&info->cmap);
kfree(info->pseudo_palette);
framebuffer_release(info);
dma_free_wc(&pdev->dev, fbi->map_size, info->screen_base,
fbi->map_dma);
iounmap(fbi->regs);
release_mem_region(res->start, resource_size(res));
kfree(info->pseudo_palette);
framebuffer_release(info);
return 0;
}