]> git.baikalelectronics.ru Git - kernel.git/commit
projects / kernel.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: edd3df6) | patch
fbdev: smscufx: Fix several use-after-free bugs
authorHyunwoo Kim <imv4bel@gmail.com>
Fri, 21 Oct 2022 01:15:44 +0000 (18:15 -0700)
committerHelge Deller <deller@gmx.de>
Fri, 21 Oct 2022 05:36:32 +0000 (07:36 +0200)
commit1be74e18fd32b5d0299e02c5259ded9888d3395d
tree6d4c7d7f882900e9bdb50ff197166d691eb53402tree | snapshot
parentedd3df6176e6acdf4c80ad74deb46df9c05037a5commit | diff
fbdev: smscufx: Fix several use-after-free bugs

Several types of UAFs can occur when physically removing a USB device.

Adds ufx_ops_destroy() function to .fb_destroy of fb_ops, and
in this function, there is kref_put() that finally calls ufx_free().

This fix prevents multiple UAFs.

Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Link: https://lore.kernel.org/linux-fbdev/20221011153436.GA4446@ubuntu/
Cc: <stable@vger.kernel.org>
Signed-off-by: Helge Deller <deller@gmx.de>
drivers/video/fbdev/smscufx.c diff | blob | history
Linux Kernel Source Tree.