Commit 5ae29649 authored by Dan Carpenter's avatar Dan Carpenter Committed by Bartlomiej Zolnierkiewicz

video: fbdev: imxfb: use after free in imxfb_remove()

We free "info" then dereference it on the next line.  Really this whole
function would be better if we wrote it to unwind in the mirror of how
things are allocated in the probe.
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Cc: Alexander Shiyan <shc_work@mail.ru>
Cc: Sascha Hauer <kernel@pengutronix.de>
Signed-off-by: default avatarBartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
parent 16f73eb0
...@@ -1073,20 +1073,16 @@ static int imxfb_remove(struct platform_device *pdev) ...@@ -1073,20 +1073,16 @@ static int imxfb_remove(struct platform_device *pdev)
imxfb_disable_controller(fbi); imxfb_disable_controller(fbi);
unregister_framebuffer(info); unregister_framebuffer(info);
fb_dealloc_cmap(&info->cmap);
pdata = dev_get_platdata(&pdev->dev); pdata = dev_get_platdata(&pdev->dev);
if (pdata && pdata->exit) if (pdata && pdata->exit)
pdata->exit(fbi->pdev); pdata->exit(fbi->pdev);
fb_dealloc_cmap(&info->cmap);
kfree(info->pseudo_palette);
framebuffer_release(info);
dma_free_wc(&pdev->dev, fbi->map_size, info->screen_base, dma_free_wc(&pdev->dev, fbi->map_size, info->screen_base,
fbi->map_dma); fbi->map_dma);
iounmap(fbi->regs); iounmap(fbi->regs);
release_mem_region(res->start, resource_size(res)); release_mem_region(res->start, resource_size(res));
kfree(info->pseudo_palette);
framebuffer_release(info);
return 0; return 0;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment