fbdev: efifb: Fix a use-after-free due early fb_info cleanup
Commit d258d00f ("fbdev: efifb: Cleanup fb_info in .fb_destroy rather than .remove") attempted to fix a use-after-free error due driver freeing the fb_info in the .remove handler instead of doing it in .fb_destroy. But ironically that change introduced yet another use-after-free since the fb_info was still used after the free. This should fix for good by freeing the fb_info at the end of the handler. Fixes: d258d00f ("fbdev: efifb: Cleanup fb_info in .fb_destroy rather than .remove") Reported-by:Ville Syrjälä <ville.syrjala@linux.intel.com> Reported-by:
Andrzej Hajda <andrzej.hajda@intel.com> Signed-off-by:
Javier Martinez Canillas <javierm@redhat.com> Reviewed-by:
Andi Shyti <andi.shyti@linux.intel.com> Reviewed-by:
Andrzej Hajda <andrzej.hajda@intel.com> Reviewed-by:
Thomas Zimmermann <tzimemrmann@suse.de> Signed-off-by:
Lucas De Marchi <lucas.demarchi@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20220506132225.588379-1-javierm@redhat.com
Showing
Please register or sign in to comment