Stanislaw Gruszka :
If framebuffer registration failed in platform driver ->probe() callback,
dev_get_drvdata() points to freed memory region, but ->remove()
function try to use it and the following oops occurs:
[..]
This patch fix oops.
Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl>
CC: Nicolas Ferre <redacted>
Feel free to add :
Acked-by: Nicolas Ferre <redacted>
quoted hunk ↗ jump to hunk
---
drivers/video/atmel_lcdfb.c | 10 ++++++----
1 files changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/video/atmel_lcdfb.c b/drivers/video/atmel_lcdfb.c
index a471a60..3376f35 100644
--- a/drivers/video/atmel_lcdfb.c
+++ b/drivers/video/atmel_lcdfb.c
@@ -939,7 +939,7 @@ static int __init atmel_lcdfb_probe(struct platform_device *pdev)
ret = register_framebuffer(info);
if (ret < 0) {
dev_err(dev, "failed to register framebuffer device: %d\n", ret);
- goto free_cmap;
+ goto reset_drvdata;
}
/* add selected videomode to modelist */@@ -955,7 +955,8 @@ static int __init atmel_lcdfb_probe(struct platform_device *pdev)
return 0;
-
+reset_drvdata:
+ dev_set_drvdata(dev, NULL);
free_cmap:
fb_dealloc_cmap(&info->cmap);
unregister_irqs:
@@ -992,10 +993,11 @@ static int __exit atmel_lcdfb_remove(struct platform_device *pdev)
{
struct device *dev = &pdev->dev;
struct fb_info *info = dev_get_drvdata(dev);
- struct atmel_lcdfb_info *sinfo = info->par;
+ struct atmel_lcdfb_info *sinfo;
- if (!sinfo)
+ if (!info || !info->par)
return 0;
+ sinfo = info->par;
cancel_work_sync(&sinfo->task);
exit_backlight(sinfo);
--
Nicolas Ferre
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/