luck/tmp_suning_uos_patched
1
0
Fork 1
Code Issues Pull Requests Packages Projects Releases Wiki Activity

video: Fix use-after-free by vga16fb on rmmod

Browse Source 
Since fb_info is now refcounted and thus may get freed at any time it
gets unregistered module unloading will try to unregister framebuffer
as stored in platform data on probe though this pointer may
be stale.

Cleanup platform data on framebuffer release.

CC: stable@kernel.org
Signed-off-by: Bruno Prémont <bonbons@linux-vserver.org>
Signed-off-by: Paul Mundt <lethal@linux-sh.org>
This commit is contained in:
Bruno Prémont 2011-05-24 19:59:17 +00:00 committed by Paul Mundt
parent 1b86d775dd
commit a50d28de8d
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/video/vga16fb.c
View File

@ -1265,9 +1265,11 @@ static void vga16fb_imageblit(struct fb_info *info, const struct fb_image *image
static void vga16fb_destroy(struct fb_info *info) static void vga16fb_destroy(struct fb_info *info)
{ {
struct platform_device *dev = container_of(info->device, struct platform_device, dev);
iounmap(info->screen_base); iounmap(info->screen_base);
fb_dealloc_cmap(&info->cmap); fb_dealloc_cmap(&info->cmap);
/* XXX unshare VGA regions */ /* XXX unshare VGA regions */
platform_set_drvdata(dev, NULL);
framebuffer_release(info); framebuffer_release(info);
} }