Commit a50d28de authored by Bruno Prémont's avatar Bruno Prémont Committed by Paul Mundt

video: Fix use-after-free by vga16fb on rmmod

Since fb_info is now refcounted and thus may get freed at any time it
gets unregistered module unloading will try to unregister framebuffer
as stored in platform data on probe though this pointer may
be stale.

Cleanup platform data on framebuffer release.

CC: stable@kernel.org
Signed-off-by: default avatarBruno Prémont <bonbons@linux-vserver.org>
Signed-off-by: default avatarPaul Mundt <lethal@linux-sh.org>
parent 1b86d775
...@@ -1265,9 +1265,11 @@ static void vga16fb_imageblit(struct fb_info *info, const struct fb_image *image ...@@ -1265,9 +1265,11 @@ static void vga16fb_imageblit(struct fb_info *info, const struct fb_image *image
static void vga16fb_destroy(struct fb_info *info) static void vga16fb_destroy(struct fb_info *info)
{ {
struct platform_device *dev = container_of(info->device, struct platform_device, dev);
iounmap(info->screen_base); iounmap(info->screen_base);
fb_dealloc_cmap(&info->cmap); fb_dealloc_cmap(&info->cmap);
/* XXX unshare VGA regions */ /* XXX unshare VGA regions */
platform_set_drvdata(dev, NULL);
framebuffer_release(info); framebuffer_release(info);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment