summaryrefslogtreecommitdiffstats
path: root/drivers/video
diff options
context:
space:
mode:
authorBruno Prémont <bonbons@linux-vserver.org>2011-05-24 19:59:17 +0000
committerPaul Mundt <lethal@linux-sh.org>2011-06-06 18:14:45 +0900
commita50d28de8d5085e0f34f96088a45cc156d022021 (patch)
tree7469b8d254760a64ecf0450ca86d2c626e37a1df /drivers/video
parent1b86d775dd4c13967e1895df09d0cef198956e81 (diff)
downloadop-kernel-dev-a50d28de8d5085e0f34f96088a45cc156d022021.zip
op-kernel-dev-a50d28de8d5085e0f34f96088a45cc156d022021.tar.gz
video: Fix use-after-free by vga16fb on rmmod
Since fb_info is now refcounted and thus may get freed at any time it gets unregistered module unloading will try to unregister framebuffer as stored in platform data on probe though this pointer may be stale. Cleanup platform data on framebuffer release. CC: stable@kernel.org Signed-off-by: Bruno Prémont <bonbons@linux-vserver.org> Signed-off-by: Paul Mundt <lethal@linux-sh.org>
Diffstat (limited to 'drivers/video')
-rw-r--r--drivers/video/vga16fb.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/video/vga16fb.c b/drivers/video/vga16fb.c
index 53b2c5a..305c975 100644
--- a/drivers/video/vga16fb.c
+++ b/drivers/video/vga16fb.c
@@ -1265,9 +1265,11 @@ static void vga16fb_imageblit(struct fb_info *info, const struct fb_image *image
static void vga16fb_destroy(struct fb_info *info)
{
+ struct platform_device *dev = container_of(info->device, struct platform_device, dev);
iounmap(info->screen_base);
fb_dealloc_cmap(&info->cmap);
/* XXX unshare VGA regions */
+ platform_set_drvdata(dev, NULL);
framebuffer_release(info);
}
OpenPOWER on IntegriCloud