diff options
| author | Guoniu.Zhou <guoniu.zhou@nxp.com> | 2017-01-11 10:07:28 +0800 |
|---|---|---|
| committer | Anson Huang <Anson.Huang@nxp.com> | 2017-06-08 20:59:21 +0800 |
| commit | 3c2d2708a80336da60a0307259726270fa889c3a (patch) | |
| tree | 3d20a062a2ec9da98263ca0f95b6a8842d88550b /drivers/video | |
| parent | 0bb88505f78cd5540e2b5c5d9c7c1d316e597d2e (diff) | |
MLK-13739 video: mxsfb: use a pointer after free.
In mxsfb_overlay_exit, a pointer to freed memory is dereferenced, used as a
function argument, exchange the reference and freed function position.
Signed-off-by: Guoniu.Zhou <guoniu.zhou@nxp.com>
Diffstat (limited to 'drivers/video')
| -rw-r--r-- | drivers/video/fbdev/mxsfb.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/video/fbdev/mxsfb.c b/drivers/video/fbdev/mxsfb.c index e76bb3129670..b00ba512996b 100644 --- a/drivers/video/fbdev/mxsfb.c +++ b/drivers/video/fbdev/mxsfb.c @@ -1986,8 +1986,8 @@ static void mxsfb_overlay_exit(struct mxsfb_info *fbi) dma_free_writecombine(ofb->dev, ofb->video_mem_size, ofb->video_mem, ofb->video_mem_phys); - framebuffer_release(ofb->ol_fb); unregister_framebuffer(ofb->ol_fb); + framebuffer_release(ofb->ol_fb); } } #else |