mirror of https://github.com/torvalds/linux.git
7f138de156
linedisp_release() currently retrieves the enclosing struct linedisp via
to_linedisp(). That lookup depends on the attachment list, but the
attachment may already have been removed before put_device() invokes the
release callback. This can happen in linedisp_unregister(), and can also
be reached from some linedisp_register() error paths.
In that case, to_linedisp() returns NULL and linedisp_release()
dereferences it while freeing the display resources.
The struct device released here is the embedded linedisp->dev used by
linedisp_register(), so retrieve the enclosing object directly with
container_of() instead.
Fixes:
|
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| arm-charlcd.c | ||
| cfag12864b.c | ||
| cfag12864bfb.c | ||
| charlcd.c | ||
| charlcd.h | ||
| hd44780.c | ||
| hd44780_common.c | ||
| hd44780_common.h | ||
| ht16k33.c | ||
| img-ascii-lcd.c | ||
| ks0108.c | ||
| lcd2s.c | ||
| line-display.c | ||
| line-display.h | ||
| max6959.c | ||
| panel.c | ||
| seg-led-gpio.c | ||