diff options
| author | Hyunwoo Kim <imv4bel@gmail.com> | 2022-10-21 04:15:44 +0300 |
|---|---|---|
| committer | Helge Deller <deller@gmx.de> | 2022-10-21 08:36:32 +0300 |
| commit | cc67482c9e5f2c80d62f623bcc347c29f9f648e1 (patch) | |
| tree | 6d4c7d7f882900e9bdb50ff197166d691eb53402 /mm | |
| parent | 70281592bf3fb7a2a193dced4d4e58a9ee96aa6c (diff) | |
fbdev: smscufx: Fix several use-after-free bugs
Several types of UAFs can occur when physically removing a USB device.
Adds ufx_ops_destroy() function to .fb_destroy of fb_ops, and
in this function, there is kref_put() that finally calls ufx_free().
This fix prevents multiple UAFs.
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Link: https://lore.kernel.org/linux-fbdev/20221011153436.GA4446@ubuntu/
Cc: <stable@vger.kernel.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Diffstat (limited to 'mm')
0 files changed, 0 insertions, 0 deletions