diff options
| author | Dan Carpenter <[email protected]> | 2017-07-31 18:45:41 +0200 |
|---|---|---|
| committer | Bartlomiej Zolnierkiewicz <[email protected]> | 2017-07-31 18:45:41 +0200 |
| commit | 5ae29649e03f58be0f412c21b62b203aa7cf1680 (patch) | |
| tree | 656790e6704b6f12ae9d73ce6fd46a2d466853e1 | |
| parent | 16f73eb02d7e1765ccab3d2018e0bd98eb93d973 (diff) | |
video: fbdev: imxfb: use after free in imxfb_remove()
We free "info" then dereference it on the next line. Really this whole
function would be better if we wrote it to unwind in the mirror of how
things are allocated in the probe.
Signed-off-by: Dan Carpenter <[email protected]>
Cc: Alexander Shiyan <[email protected]>
Cc: Sascha Hauer <[email protected]>
Signed-off-by: Bartlomiej Zolnierkiewicz <[email protected]>
| -rw-r--r-- | drivers/video/fbdev/imxfb.c | 10 |
1 files changed, 3 insertions, 7 deletions
diff --git a/drivers/video/fbdev/imxfb.c b/drivers/video/fbdev/imxfb.c index c166e0725be5..ba82f97fb42b 100644 --- a/drivers/video/fbdev/imxfb.c +++ b/drivers/video/fbdev/imxfb.c @@ -1073,20 +1073,16 @@ static int imxfb_remove(struct platform_device *pdev) imxfb_disable_controller(fbi); unregister_framebuffer(info); - + fb_dealloc_cmap(&info->cmap); pdata = dev_get_platdata(&pdev->dev); if (pdata && pdata->exit) pdata->exit(fbi->pdev); - - fb_dealloc_cmap(&info->cmap); - kfree(info->pseudo_palette); - framebuffer_release(info); - dma_free_wc(&pdev->dev, fbi->map_size, info->screen_base, fbi->map_dma); - iounmap(fbi->regs); release_mem_region(res->start, resource_size(res)); + kfree(info->pseudo_palette); + framebuffer_release(info); return 0; } |