diff options
| author | Zheng Wang <zyytlz.wz@163.com> | 2023-04-27 11:08:41 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-08-11 11:45:01 +0200 |
| commit | 7f683f286a2196bd4d2da420a3194f5ba0269d8c (patch) | |
| tree | 8daba14a59222970426915831d20196bdb90e87f /scripts | |
| parent | e0302cf3ba2b84019bcd7f946c1889362197cea1 (diff) | |
fbdev: imsttfb: Fix use after free bug in imsttfb_probe
commit c75f5a55061091030a13fef71b9995b89bc86213 upstream.
A use-after-free bug may occur if init_imstt invokes framebuffer_release
and free the info ptr. The caller, imsttfb_probe didn't notice that and
still keep the ptr as private data in pdev.
If we remove the driver which will call imsttfb_remove to make cleanup,
UAF happens.
Fix it by return error code if bad case happens in init_imstt.
Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'scripts')
0 files changed, 0 insertions, 0 deletions