fbdev: imsttfb: Fix use after free bug in imsttfb_probe
authorZheng Wang <zyytlz.wz@163.com>
Thu, 27 Apr 2023 03:08:41 +0000 (11:08 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 9 Jun 2023 08:34:09 +0000 (10:34 +0200)
commitc6c0a9f619584be19726ce7f81c31bc555af401a
treeefd4e99852e872d9d2c1db6fe14cbb70b60893c9
parent3e336ad6f517d1078b1e6e874e1578827088f269
fbdev: imsttfb: Fix use after free bug in imsttfb_probe

[ Upstream commit c75f5a55061091030a13fef71b9995b89bc86213 ]

A use-after-free bug may occur if init_imstt invokes framebuffer_release
and free the info ptr. The caller, imsttfb_probe didn't notice that and
still keep the ptr as private data in pdev.

If we remove the driver which will call imsttfb_remove to make cleanup,
UAF happens.

Fix it by return error code if bad case happens in init_imstt.

Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/video/fbdev/imsttfb.c