This is a note to let you know that I've just added the patch titled
video: Fix use-after-free by vga16fb on rmmod
to the 2.6.39-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
video-fix-use-after-free-by-vga16fb-on-rmmod.patch
and it can be found in the queue-2.6.39 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
From a50d28de8d5085e0f34f96088a45cc156d022021 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bruno=20Pr=C3=A9mont?= <[email protected]>
Date: Tue, 24 May 2011 19:59:17 +0000
Subject: video: Fix use-after-free by vga16fb on rmmod
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
From: =?UTF-8?q?Bruno=20Pr=C3=A9mont?= <[email protected]>
commit a50d28de8d5085e0f34f96088a45cc156d022021 upstream.
Since fb_info is now refcounted and thus may get freed at any time it
gets unregistered module unloading will try to unregister framebuffer
as stored in platform data on probe though this pointer may
be stale.
Cleanup platform data on framebuffer release.
Signed-off-by: Bruno Prémont <[email protected]>
Signed-off-by: Paul Mundt <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/video/vga16fb.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/video/vga16fb.c
+++ b/drivers/video/vga16fb.c
@@ -1265,9 +1265,11 @@ static void vga16fb_imageblit(struct fb_
static void vga16fb_destroy(struct fb_info *info)
{
+ struct platform_device *dev = container_of(info->device, struct
platform_device, dev);
iounmap(info->screen_base);
fb_dealloc_cmap(&info->cmap);
/* XXX unshare VGA regions */
+ platform_set_drvdata(dev, NULL);
framebuffer_release(info);
}
Patches currently in stable-queue which might be from [email protected]
are
queue-2.6.39/video-fix-use-after-free-by-vga16fb-on-rmmod.patch
_______________________________________________
stable mailing list
[email protected]
http://linux.kernel.org/mailman/listinfo/stable
