Re: [PATCH] gpu/xen: Fix a use after free in xen_drm_drv_init

Hi, good catch On 3/23/21 3:46 AM, Lv Yunlong wrote: > In function displback_changed, has the call chain > displback_connect(front_info)->xen_drm_drv_init(front_info). > We can see that drm_info is assigned to front_info->drm_info > and drm_info is freed in fail branch in xen_drm_drv_init(). > >

[PATCH] gpu/xen: Fix a use after free in xen_drm_drv_init

In function displback_changed, has the call chain displback_connect(front_info)->xen_drm_drv_init(front_info). We can see that drm_info is assigned to front_info->drm_info and drm_info is freed in fail branch in xen_drm_drv_init(). Later displback_disconnect(front_info) is called and it calls xen_