[PATCH] [video/fbdev] mbxfb_remove: fix null pointer dereference

Subsystems: framebuffer layer, the rest

STALE2272d

2 messages, 2 authors, 2020-07-26 · open the first message on its own page

[PATCH] [video/fbdev] mbxfb_remove: fix null pointer dereference

From: Gaurav Singh <hidden>
Date: 2020-07-26 05:20:58

Function mbxfb_debugfs_remove() accesses fbi->par without NULL check,
hence do the NULL check in the caller mbxfb_remove().

Signed-off-by: Gaurav Singh <redacted>
---
 drivers/video/fbdev/mbx/mbxfb.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/video/fbdev/mbx/mbxfb.c b/drivers/video/fbdev/mbx/mbxfb.c
index 6dc287c819cb..515c0cda1994 100644
--- a/drivers/video/fbdev/mbx/mbxfb.c
+++ b/drivers/video/fbdev/mbx/mbxfb.c
@@ -1012,11 +1012,10 @@ static int mbxfb_remove(struct platform_device *dev)
 
 	write_reg_dly(SYSRST_RST, SYSRST);
 
-	mbxfb_debugfs_remove(fbi);
-
 	if (fbi) {
 		struct mbxfb_info *mfbi = fbi->par;
 
+		mbxfb_debugfs_remove(fbi);
 		unregister_framebuffer(fbi);
 		if (mfbi) {
 			if (mfbi->platform_remove)
-- 
2.17.1

Re: [PATCH] [video/fbdev] mbxfb_remove: fix null pointer dereference

From: Andy Shevchenko <hidden>
Date: 2020-07-26 08:57:19

On Sun, Jul 26, 2020 at 8:26 AM Gaurav Singh [off-list ref] wrote:
Function mbxfb_debugfs_remove() accesses fbi->par without NULL check,
hence do the NULL check in the caller mbxfb_remove().
...
quoted hunk
@@ -1012,11 +1012,10 @@ static int mbxfb_remove(struct platform_device *dev)

        write_reg_dly(SYSRST_RST, SYSRST);

-       mbxfb_debugfs_remove(fbi);
-
        if (fbi) {
Can you explain how this is NULL on ->remove()?

I bet this check is simply redundant. But you have to check and update
commit message accordingly.
quoted hunk
                struct mbxfb_info *mfbi = fbi->par;

+               mbxfb_debugfs_remove(fbi);
                unregister_framebuffer(fbi);
                if (mfbi) {
                        if (mfbi->platform_remove)

-- 
With Best Regards,
Andy Shevchenko
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help