This is a note to let you know that I've just added the patch titled
fbdev: imsttfb: fix double free in probe()
to the 6.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
fbdev-imsttfb-fix-double-free-in-probe.patch
and it can be found in the queue-6.1 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
commit 0dba7e14edb61efe1ef25501ef2902a7619970f8
Author: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Date: Fri Oct 27 15:04:56 2023 +0300
fbdev: imsttfb: fix double free in probe()
[ Upstream commit e08c30efda21ef4c0ec084a3a9581c220b442ba9 ]
The init_imstt() function calls framebuffer_release() on error and then
the probe() function calls it again. It should only be done in probe.
Fixes: 518ecb6a209f ("fbdev: imsttfb: Fix error path of imsttfb_probe()")
Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Signed-off-by: Helge Deller <deller@xxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
diff --git a/drivers/video/fbdev/imsttfb.c b/drivers/video/fbdev/imsttfb.c
index 3d1ae5267a738..aa51cb72cbba5 100644
--- a/drivers/video/fbdev/imsttfb.c
+++ b/drivers/video/fbdev/imsttfb.c
@@ -1419,7 +1419,6 @@ static int init_imstt(struct fb_info *info)
if ((info->var.xres * info->var.yres) * (info->var.bits_per_pixel >> 3) > info->fix.smem_len
|| !(compute_imstt_regvals(par, info->var.xres, info->var.yres))) {
printk("imsttfb: %ux%ux%u not supported\n", info->var.xres, info->var.yres, info->var.bits_per_pixel);
- framebuffer_release(info);
return -ENODEV;
}
@@ -1452,14 +1451,11 @@ static int init_imstt(struct fb_info *info)
FBINFO_HWACCEL_FILLRECT |
FBINFO_HWACCEL_YPAN;
- if (fb_alloc_cmap(&info->cmap, 0, 0)) {
- framebuffer_release(info);
+ if (fb_alloc_cmap(&info->cmap, 0, 0))
return -ENODEV;
- }
if (register_framebuffer(info) < 0) {
fb_dealloc_cmap(&info->cmap);
- framebuffer_release(info);
return -ENODEV;
}
