| commit | d9ddfeb01fb95ffbbc7031d46a5ee2a5e45cbb86 | [log] [tgz] |
|---|---|---|
| author | Hyunwoo Kim <[email protected]> | Thu Oct 20 18:15:44 2022 -0700 |
| committer | Greg Kroah-Hartman <[email protected]> | Thu Nov 03 23:57:49 2022 +0900 |
| tree | c0dd44de8dbbacbb60a2e01b1fb5078ad07d7f1d | |
| parent | f19f1a75d378c2d87d98a02e6cb9ffcdc5c9af73 [diff] |
fbdev: smscufx: Fix several use-after-free bugs commit cc67482c9e5f2c80d62f623bcc347c29f9f648e1 upstream. Several types of UAFs can occur when physically removing a USB device. Adds ufx_ops_destroy() function to .fb_destroy of fb_ops, and in this function, there is kref_put() that finally calls ufx_free(). This fix prevents multiple UAFs. Signed-off-by: Hyunwoo Kim <[email protected]> Link: https://lore.kernel.org/linux-fbdev/20221011153436.GA4446@ubuntu/ Cc: <[email protected]> Signed-off-by: Helge Deller <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>