Skip to content

Commit 135332f

Browse files
Revert "fbdev: Make fb_release() return -ENODEV if fbdev was unregistered"
This reverts commit aafa025. That commit attempted to fix a NULL pointer dereference, caused by the struct fb_info associated with a framebuffer device to not longer be valid when the file descriptor was closed. The issue was exposed by commit 27599aa ("fbdev: Hot-unplug firmware fb devices on forced removal"), which added a new path that goes through the struct device removal instead of directly unregistering the fb. Most fbdev drivers have issues with the fb_info lifetime, because call to framebuffer_release() from their driver's .remove callback, rather than doing from fbops.fb_destroy callback. This meant that due to this switch, the fb_info was now destroyed too early, while references still existed, while before it was simply leaked. The patch we're reverting here reinstated that leak, hence "fixed" the regression. But the proper solution is to fix the drivers to not release the fb_info too soon. Suggested-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Javier Martinez Canillas <javierm@redhat.com> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/20220504115917.758787-1-javierm@redhat.com
1 parent 841e512 commit 135332f

1 file changed

Lines changed: 1 addition & 4 deletions

File tree

drivers/video/fbdev/core/fbmem.c

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1434,10 +1434,7 @@ fb_release(struct inode *inode, struct file *file)
14341434
__acquires(&info->lock)
14351435
__releases(&info->lock)
14361436
{
1437-
struct fb_info * const info = file_fb_info(file);
1438-
1439-
if (!info)
1440-
return -ENODEV;
1437+
struct fb_info * const info = file->private_data;
14411438

14421439
lock_fb_info(info);
14431440
if (info->fbops->fb_release)

0 commit comments

Comments
 (0)