From ad63957ae0419a3552dc651751d0d550cdd9c30c Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Mon, 31 Jul 2017 18:45:41 +0200 Subject: [PATCH] video: fbdev: imxfb: use after free in imxfb_remove() We free "info" then dereference it on the next line. Really this whole function would be better if we wrote it to unwind in the mirror of how things are allocated in the probe. Signed-off-by: Dan Carpenter Cc: Alexander Shiyan Cc: Sascha Hauer Signed-off-by: Bartlomiej Zolnierkiewicz --- drivers/video/fbdev/imxfb.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/drivers/video/fbdev/imxfb.c b/drivers/video/fbdev/imxfb.c index c166e0725be5d..ba82f97fb42b2 100644 --- a/drivers/video/fbdev/imxfb.c +++ b/drivers/video/fbdev/imxfb.c @@ -1073,20 +1073,16 @@ static int imxfb_remove(struct platform_device *pdev) imxfb_disable_controller(fbi); unregister_framebuffer(info); - + fb_dealloc_cmap(&info->cmap); pdata = dev_get_platdata(&pdev->dev); if (pdata && pdata->exit) pdata->exit(fbi->pdev); - - fb_dealloc_cmap(&info->cmap); - kfree(info->pseudo_palette); - framebuffer_release(info); - dma_free_wc(&pdev->dev, fbi->map_size, info->screen_base, fbi->map_dma); - iounmap(fbi->regs); release_mem_region(res->start, resource_size(res)); + kfree(info->pseudo_palette); + framebuffer_release(info); return 0; } -- 2.39.5