From: Bruno Prémont Date: Tue, 24 May 2011 19:59:17 +0000 (+0000) Subject: video: Fix use-after-free by vga16fb on rmmod X-Git-Tag: Ubuntu-5.0.0-8.9~18587^2 X-Git-Url: https://git.proxmox.com/?a=commitdiff_plain;h=a50d28de8d5085e0f34f96088a45cc156d022021;p=mirror_ubuntu-disco-kernel.git video: Fix use-after-free by vga16fb on rmmod Since fb_info is now refcounted and thus may get freed at any time it gets unregistered module unloading will try to unregister framebuffer as stored in platform data on probe though this pointer may be stale. Cleanup platform data on framebuffer release. CC: stable@kernel.org Signed-off-by: Bruno Prémont Signed-off-by: Paul Mundt --- diff --git a/drivers/video/vga16fb.c b/drivers/video/vga16fb.c index 53b2c5aae067..305c975b1787 100644 --- a/drivers/video/vga16fb.c +++ b/drivers/video/vga16fb.c @@ -1265,9 +1265,11 @@ static void vga16fb_imageblit(struct fb_info *info, const struct fb_image *image static void vga16fb_destroy(struct fb_info *info) { + struct platform_device *dev = container_of(info->device, struct platform_device, dev); iounmap(info->screen_base); fb_dealloc_cmap(&info->cmap); /* XXX unshare VGA regions */ + platform_set_drvdata(dev, NULL); framebuffer_release(info); }