Re: [PATCH] cyber2000fb: New framebuffer_alloc API and class_dev changes
flat view
From: Russell King <hidden>
Date: 2003-09-15 21:33:37
On Mon, Sep 15, 2003 at 11:28:09PM +0200, Kronos wrote:
quoted
quoted
@@ -1635,6 +1638,16 @@ return err; } +static void release_cfb_info(struct fb_info *info) { + struct cfb_info *cfb = info->par; + + iounmap(cfb->region); + fb_alloc_cmap(&info->cmap, 0, 0); + + if (cfb->dev) + pci_release_regions(cfb->dev); +} + static void __devexit cyberpro_pci_remove(struct pci_dev *dev) { struct cfb_info *cfb = pci_get_drvdata(dev);Who says "cfb->dev" remains valid after the PCI device has been removed. This looks like a perfect use-after-free bug waiting to happen.cfb->dev is refcounted, it won't go away until we are done with the cleanup. Maybe I misread driver core code...
pci_request_regions / pci_release_regions does not perform any reference counting on the pci device. -- Russell King (rmk@arm.linux.org.uk) http://www.arm.linux.org.uk/personal/ Linux kernel maintainer of: 2.6 ARM Linux - http://www.arm.linux.org.uk/ 2.6 PCMCIA - http://pcmcia.arm.linux.org.uk/ 2.6 Serial core ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf