summaryrefslogtreecommitdiff
path: root/drivers/video
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2017-07-31 18:45:41 +0200
committerBartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>2017-07-31 18:45:41 +0200
commit5ae29649e03f58be0f412c21b62b203aa7cf1680 (patch)
tree656790e6704b6f12ae9d73ce6fd46a2d466853e1 /drivers/video
parent16f73eb02d7e1765ccab3d2018e0bd98eb93d973 (diff)
video: fbdev: imxfb: use after free in imxfb_remove()
We free "info" then dereference it on the next line. Really this whole function would be better if we wrote it to unwind in the mirror of how things are allocated in the probe. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: Alexander Shiyan <shc_work@mail.ru> Cc: Sascha Hauer <kernel@pengutronix.de> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Diffstat (limited to 'drivers/video')
-rw-r--r--drivers/video/fbdev/imxfb.c10
1 files changed, 3 insertions, 7 deletions
diff --git a/drivers/video/fbdev/imxfb.c b/drivers/video/fbdev/imxfb.c
index c166e0725be5..ba82f97fb42b 100644
--- a/drivers/video/fbdev/imxfb.c
+++ b/drivers/video/fbdev/imxfb.c
@@ -1073,20 +1073,16 @@ static int imxfb_remove(struct platform_device *pdev)
imxfb_disable_controller(fbi);
unregister_framebuffer(info);
-
+ fb_dealloc_cmap(&info->cmap);
pdata = dev_get_platdata(&pdev->dev);
if (pdata && pdata->exit)
pdata->exit(fbi->pdev);
-
- fb_dealloc_cmap(&info->cmap);
- kfree(info->pseudo_palette);
- framebuffer_release(info);
-
dma_free_wc(&pdev->dev, fbi->map_size, info->screen_base,
fbi->map_dma);
-
iounmap(fbi->regs);
release_mem_region(res->start, resource_size(res));
+ kfree(info->pseudo_palette);
+ framebuffer_release(info);
return 0;
}