mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-28 07:13:34 +00:00
89bfd4017e
Most fbdev drivers have issues with the fb_info lifetime, because call to framebuffer_release() from their driver's .remove callback, rather than doing from fbops.fb_destroy callback. Doing that will destroy the fb_info too early, while references to it may still exist, leading to a use-after-free error. To prevent this, check the fb_info reference counter when attempting to kfree the data structure in framebuffer_release(). That will leak it but at least will prevent the mentioned error. Signed-off-by: Daniel Vetter <daniel.vetter@intel.com> Signed-off-by: Javier Martinez Canillas <javierm@redhat.com> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patchwork.freedesktop.org/patch/msgid/20220505220413.365977-1-javierm@redhat.com |
||
---|---|---|
.. | ||
bitblit.c | ||
cfbcopyarea.c | ||
cfbfillrect.c | ||
cfbimgblt.c | ||
fb_cmdline.c | ||
fb_ddc.c | ||
fb_defio.c | ||
fb_draw.h | ||
fb_notify.c | ||
fb_sys_fops.c | ||
fbcmap.c | ||
fbcon.c | ||
fbcon.h | ||
fbcon_ccw.c | ||
fbcon_cw.c | ||
fbcon_rotate.c | ||
fbcon_rotate.h | ||
fbcon_ud.c | ||
fbcvt.c | ||
fbmem.c | ||
fbmon.c | ||
fbsysfs.c | ||
Makefile | ||
modedb.c | ||
softcursor.c | ||
svgalib.c | ||
syscopyarea.c | ||
sysfillrect.c | ||
sysimgblt.c | ||
tileblit.c |