Commit ad3de274 authored by Zheng Wang's avatar Zheng Wang Committed by Greg Kroah-Hartman
Browse files

fbdev: imsttfb: Fix use after free bug in imsttfb_probe



[ Upstream commit c75f5a55 ]

A use-after-free bug may occur if init_imstt invokes framebuffer_release
and free the info ptr. The caller, imsttfb_probe didn't notice that and
still keep the ptr as private data in pdev.

If we remove the driver which will call imsttfb_remove to make cleanup,
UAF happens.

Fix it by return error code if bad case happens in init_imstt.

Signed-off-by: default avatarZheng Wang <zyytlz.wz@163.com>
Signed-off-by: default avatarHelge Deller <deller@gmx.de>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent fd8b4e28
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment