Issue of the Implementation # L0176
m501fb: don't return zero on failure path in sm501fb_probe()
If no framebuffers found, sm501fb_probe() breaks off initialization, deallocates sm501fb_info, but returns zero. As a result, use after free can happen in sm501fb_remove().
Fixed in kernel 3.19-rc1