On 10.05.2022 00:42, Javier Martinez Canillas wrote:
On 5/10/22 00:22, Andrzej Hajda wrote:
[snip]
static void drm_fbdev_fb_destroy(struct fb_info *info)
{
+ if (info->cmap.len)
+ fb_dealloc_cmap(&info->cmap);
+
drm_fbdev_release(info->par);
+ framebuffer_release(info);
I would put drm_fbdev_release at the beginning - it cancels workers
which could expect cmap to be still valid.
Indeed, you are correct again. [0] is the final version of the patch I've
but don't have an i915 test machine to give it a try. I'll test tomorrow
on my test systems to verify that it doesn't cause any regressions since
with other DRM drivers.
I think that besides this patch, drivers shouldn't need to call to the
drm_fb_helper_fini() function directly. Since that would be called during
drm_fbdev_fb_destroy() anyways.
We should probably remove that call in all drivers and make this helper
function static and just private to drm_fb_helper functions.
Or am I missing something here ?
This is question for experts :)
I do not know what are user API/ABI expectations regarding removal of
fbdev driver, I wonder if they are documented somewhere :)
Apparently we have some process of 'zombification' here - we need to
remove the driver without waiting for userspace closing framebuffer(???)
(to unbind ops-es and remove references to driver related things), but
we need to leave some structures to fool userspace, 'info' seems to be
one of them.
So I guess there should be something called on driver's _remove path,
and sth on destroy path.
Regards
Andrzej
[0]:
From 5170cafcf2936da8f1c53231e3baa7d7a2b16c61 Mon Sep 17 00:00:00 2001
From: Javier Martinez Canillas <javierm@xxxxxxxxxx>
Date: Tue May 10 00:39:55 2022 +0200
Subject: [RFT PATCH] drm/fb-helper: Don't deallocate fb colormap and free fb info
too early
Currently these are done in drm_fb_helper_fini() but this helper is called
by drivers in their .remove callback, which could lead to a use-after-free
if a process has opened the emulated fbdev node while a driver is removed.
For example, in i915 driver the call chain during remove is the following:
struct pci_driver i915_pci_driver = {
...
.remove = i915_pci_remove,
...
};
i915_pci_remove
i915_driver_remove
intel_modeset_driver_remove_noirq
intel_fbdev_fini
intel_fbdev_destroy
drm_fb_helper_fini
framebuffer_release
Later the process will close the fbdev node file descriptor leading to the
mentioned use-after-free bug in drm_fbdev_fb_destroy(), due the following:
drm_fbdev_fb_destroy
drm_fbdev_release(info->par); <-- info was already freed on .remove
To prevent that, let's move the framebuffer_release() call to the end of
the drm_fbdev_fb_destroy() function.
Also, the call to fb_dealloc_cmap() in drm_fb_helper_fini() is too early
and is more correct to do it in drm_fbdev_fb_destroy() as well. After a
call to drm_fbdev_release() has been made.
Reported-by: Andrzej Hajda <andrzej.hajda@xxxxxxxxx>
Signed-off-by: Javier Martinez Canillas <javierm@xxxxxxxxxx>
---
drivers/gpu/drm/drm_fb_helper.c | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index d265a73313c9..7288fbd26bcc 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -627,12 +627,6 @@ void drm_fb_helper_fini(struct drm_fb_helper *fb_helper)
cancel_work_sync(&fb_helper->resume_work);
cancel_work_sync(&fb_helper->damage_work);
- info = fb_helper->fbdev;
- if (info) {
- if (info->cmap.len)
- fb_dealloc_cmap(&info->cmap);
- framebuffer_release(info);
- }
fb_helper->fbdev = NULL;
mutex_lock(&kernel_fb_helper_lock);
@@ -2112,6 +2106,9 @@ static void drm_fbdev_release(struct drm_fb_helper *fb_helper)
static void drm_fbdev_fb_destroy(struct fb_info *info)
{
drm_fbdev_release(info->par);
+ if (info->cmap.len)
+ fb_dealloc_cmap(&info->cmap);
+ framebuffer_release(info);
}
static int drm_fbdev_fb_mmap(struct fb_info *info, struct vm_area_struct *vma)
