]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
fbdev: imsttfb: Fix use after free bug in imsttfb_probe
authorZheng Wang <zyytlz.wz@163.com>
Thu, 27 Apr 2023 03:08:41 +0000 (11:08 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 11 Aug 2023 09:33:32 +0000 (11:33 +0200)
commit64c6b84c73f576380fadeec2d30aaeccbc2994c7
tree6188304af09325b2e3abbc023bf509d6da0c1540
parent9559a3e60c4e25932cee6797e9c3a92bb5028b67
fbdev: imsttfb: Fix use after free bug in imsttfb_probe

commit c75f5a55061091030a13fef71b9995b89bc86213 upstream.

A use-after-free bug may occur if init_imstt invokes framebuffer_release
and free the info ptr. The caller, imsttfb_probe didn't notice that and
still keep the ptr as private data in pdev.

If we remove the driver which will call imsttfb_remove to make cleanup,
UAF happens.

Fix it by return error code if bad case happens in init_imstt.

Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/video/fbdev/imsttfb.c