Hi Am 10.05.22 um 00:42 schrieb Javier Martinez Canillas:
On 5/10/22 00:22, Andrzej Hajda wrote: [snip]static void drm_fbdev_fb_destroy(struct fb_info *info) { + if (info->cmap.len) + fb_dealloc_cmap(&info->cmap); + drm_fbdev_release(info->par); + framebuffer_release(info);I would put drm_fbdev_release at the beginning - it cancels workers which could expect cmap to be still valid.Indeed, you are correct again. [0] is the final version of the patch I've but don't have an i915 test machine to give it a try. I'll test tomorrow on my test systems to verify that it doesn't cause any regressions since with other DRM drivers.
You have to go through all DRM drivers that call drm_fb_helper_fini() and make sure that they free fb_info. For example armada appears to be leaking now. [1]
Best regards Thomas[1] https://elixir.bootlin.com/linux/v5.17.6/source/drivers/gpu/drm/armada/armada_fbdev.c#L152
I think that besides this patch, drivers shouldn't need to call to the drm_fb_helper_fini() function directly. Since that would be called during drm_fbdev_fb_destroy() anyways. We should probably remove that call in all drivers and make this helper function static and just private to drm_fb_helper functions. Or am I missing something here ? [0]: From 5170cafcf2936da8f1c53231e3baa7d7a2b16c61 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas <javierm@xxxxxxxxxx> Date: Tue May 10 00:39:55 2022 +0200 Subject: [RFT PATCH] drm/fb-helper: Don't deallocate fb colormap and free fb info too early Currently these are done in drm_fb_helper_fini() but this helper is called by drivers in their .remove callback, which could lead to a use-after-free if a process has opened the emulated fbdev node while a driver is removed. For example, in i915 driver the call chain during remove is the following: struct pci_driver i915_pci_driver = { ... .remove = i915_pci_remove, ... }; i915_pci_remove i915_driver_remove intel_modeset_driver_remove_noirq intel_fbdev_fini intel_fbdev_destroy drm_fb_helper_fini framebuffer_release Later the process will close the fbdev node file descriptor leading to the mentioned use-after-free bug in drm_fbdev_fb_destroy(), due the following: drm_fbdev_fb_destroy drm_fbdev_release(info->par); <-- info was already freed on .remove To prevent that, let's move the framebuffer_release() call to the end of the drm_fbdev_fb_destroy() function. Also, the call to fb_dealloc_cmap() in drm_fb_helper_fini() is too early and is more correct to do it in drm_fbdev_fb_destroy() as well. After a call to drm_fbdev_release() has been made. Reported-by: Andrzej Hajda <andrzej.hajda@xxxxxxxxx> Signed-off-by: Javier Martinez Canillas <javierm@xxxxxxxxxx> --- drivers/gpu/drm/drm_fb_helper.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c index d265a73313c9..7288fbd26bcc 100644 --- a/drivers/gpu/drm/drm_fb_helper.c +++ b/drivers/gpu/drm/drm_fb_helper.c @@ -627,12 +627,6 @@ void drm_fb_helper_fini(struct drm_fb_helper *fb_helper) cancel_work_sync(&fb_helper->resume_work); cancel_work_sync(&fb_helper->damage_work);- info = fb_helper->fbdev;- if (info) { - if (info->cmap.len) - fb_dealloc_cmap(&info->cmap); - framebuffer_release(info); - } fb_helper->fbdev = NULL;mutex_lock(&kernel_fb_helper_lock);@@ -2112,6 +2106,9 @@ static void drm_fbdev_release(struct drm_fb_helper *fb_helper) static void drm_fbdev_fb_destroy(struct fb_info *info) { drm_fbdev_release(info->par); + if (info->cmap.len) + fb_dealloc_cmap(&info->cmap); + framebuffer_release(info); }static int drm_fbdev_fb_mmap(struct fb_info *info, struct vm_area_struct *vma)
-- Thomas Zimmermann Graphics Driver Developer SUSE Software Solutions Germany GmbH Maxfeldstr. 5, 90409 Nürnberg, Germany (HRB 36809, AG Nürnberg) Geschäftsführer: Ivo Totev
Attachment:
OpenPGP_signature
Description: OpenPGP digital signature
