projects / linux.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 7028159) | patch
fbdev: smscufx: Fix several use-after-free bugs
authorHyunwoo Kim <imv4bel@gmail.com>
Fri, 21 Oct 2022 01:15:44 +0000 (18:15 -0700)
committerHelge Deller <deller@gmx.de>
Fri, 21 Oct 2022 05:36:32 +0000 (07:36 +0200)
commitcc67482c9e5f2c80d62f623bcc347c29f9f648e1
tree6d4c7d7f882900e9bdb50ff197166d691eb53402tree | snapshot
parent70281592bf3fb7a2a193dced4d4e58a9ee96aa6ccommit | diff
fbdev: smscufx: Fix several use-after-free bugs

Several types of UAFs can occur when physically removing a USB device.

Adds ufx_ops_destroy() function to .fb_destroy of fb_ops, and
in this function, there is kref_put() that finally calls ufx_free().

This fix prevents multiple UAFs.

Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Link: https://lore.kernel.org/linux-fbdev/20221011153436.GA4446@ubuntu/
Cc: <stable@vger.kernel.org>
Signed-off-by: Helge Deller <deller@gmx.de>
drivers/video/fbdev/smscufx.c diff | blob | history
ep93xx device tree rework repo: git://git.maquefel.me/linux.git