diff options
| author | Zheng Wang <[email protected]> | 2023-04-27 03:08:41 +0000 |
|---|---|---|
| committer | Helge Deller <[email protected]> | 2023-05-11 20:58:59 +0000 |
| commit | c75f5a55061091030a13fef71b9995b89bc86213 (patch) | |
| tree | 7a8abedd4254f120f6d2b1178d8c96e01bb6f3e4 /lib/debugobjects.c | |
| parent | fbdev: vfb: Remove trailing whitespaces (diff) | |
| download | kernel-c75f5a55061091030a13fef71b9995b89bc86213.tar.gz kernel-c75f5a55061091030a13fef71b9995b89bc86213.zip | |
fbdev: imsttfb: Fix use after free bug in imsttfb_probe
A use-after-free bug may occur if init_imstt invokes framebuffer_release
and free the info ptr. The caller, imsttfb_probe didn't notice that and
still keep the ptr as private data in pdev.
If we remove the driver which will call imsttfb_remove to make cleanup,
UAF happens.
Fix it by return error code if bad case happens in init_imstt.
Signed-off-by: Zheng Wang <[email protected]>
Signed-off-by: Helge Deller <[email protected]>
Diffstat (limited to 'lib/debugobjects.c')
0 files changed, 0 insertions, 0 deletions