projects / linux-block.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 6208890) | patch
fbdev: imsttfb: Fix use after free bug in imsttfb_probe
authorZheng Wang <zyytlz.wz@163.com>
Thu, 27 Apr 2023 03:08:41 +0000 (11:08 +0800)
committerHelge Deller <deller@gmx.de>
Thu, 11 May 2023 20:58:59 +0000 (22:58 +0200)
commitc75f5a55061091030a13fef71b9995b89bc86213
tree7a8abedd4254f120f6d2b1178d8c96e01bb6f3e4tree
parent6208890495ded5429424b0335c7fd2d47fdffb83commit | diff
fbdev: imsttfb: Fix use after free bug in imsttfb_probe

A use-after-free bug may occur if init_imstt invokes framebuffer_release
and free the info ptr. The caller, imsttfb_probe didn't notice that and
still keep the ptr as private data in pdev.

If we remove the driver which will call imsttfb_remove to make cleanup,
UAF happens.

Fix it by return error code if bad case happens in init_imstt.

Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
Signed-off-by: Helge Deller <deller@gmx.de>
drivers/video/fbdev/imsttfb.c diff | blob | blame | history
Linux 6.x block layer and io_uring tree(s)