diff options
| author | Daniel Vetter <[email protected]> | 2022-05-05 22:04:13 +0000 |
|---|---|---|
| committer | Javier Martinez Canillas <[email protected]> | 2022-05-06 07:21:20 +0000 |
| commit | 89bfd4017e58faaf70411555e7f508495114e90b (patch) | |
| tree | f9f73d58ba65664f9d8774892f0aade0f9870610 /tools/perf/scripts/python | |
| parent | Revert "fbdev: Make fb_release() return -ENODEV if fbdev was unregistered" (diff) | |
| download | kernel-89bfd4017e58faaf70411555e7f508495114e90b.tar.gz kernel-89bfd4017e58faaf70411555e7f508495114e90b.zip | |
fbdev: Prevent possible use-after-free in fb_release()
Most fbdev drivers have issues with the fb_info lifetime, because call to
framebuffer_release() from their driver's .remove callback, rather than
doing from fbops.fb_destroy callback.
Doing that will destroy the fb_info too early, while references to it may
still exist, leading to a use-after-free error.
To prevent this, check the fb_info reference counter when attempting to
kfree the data structure in framebuffer_release(). That will leak it but
at least will prevent the mentioned error.
Signed-off-by: Daniel Vetter <[email protected]>
Signed-off-by: Javier Martinez Canillas <[email protected]>
Reviewed-by: Thomas Zimmermann <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions