MLK-13739 video: mxsfb: use a pointer after free.

In mxsfb_overlay_exit, a pointer to freed memory is dereferenced, used as a
function argument, exchange the reference and freed function position.

Signed-off-by: Guoniu.Zhou <guoniu.zhou@nxp.com>

diff --git a/drivers/video/fbdev/mxsfb.c b/drivers/video/fbdev/mxsfb.c
index e76bb31..b00ba51 100644 (file)
--- a/drivers/video/fbdev/mxsfb.c
+++ b/drivers/video/fbdev/mxsfb.c
@@ -1986,8 +1986,8 @@ static void mxsfb_overlay_exit(struct mxsfb_info *fbi)
                        dma_free_writecombine(ofb->dev, ofb->video_mem_size,
                                        ofb->video_mem, ofb->video_mem_phys);
 
-               framebuffer_release(ofb->ol_fb);
                unregister_framebuffer(ofb->ol_fb);
+               framebuffer_release(ofb->ol_fb);
        }
 }
 #else