Re: [PATCH v3 1/4] fbdev: Prevent possible use-after-free in fb_release()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi

Am 10.05.22 um 10:30 schrieb Javier Martinez Canillas:
Hello Thomas,

On 5/10/22 10:04, Thomas Zimmermann wrote:
Hi

Am 10.05.22 um 00:42 schrieb Javier Martinez Canillas:
On 5/10/22 00:22, Andrzej Hajda wrote:

[snip]

    static void drm_fbdev_fb_destroy(struct fb_info *info)
    {
+       if (info->cmap.len)
+               fb_dealloc_cmap(&info->cmap);
+
           drm_fbdev_release(info->par);
+       framebuffer_release(info);

I would put drm_fbdev_release at the beginning - it cancels workers
which could expect cmap to be still valid.


Indeed, you are correct again. [0] is the final version of the patch I've
but don't have an i915 test machine to give it a try. I'll test tomorrow
on my test systems to verify that it doesn't cause any regressions since
with other DRM drivers.

You have to go through all DRM drivers that call drm_fb_helper_fini()
and make sure that they free fb_info. For example armada appears to be
leaking now. [1]


But shouldn't fb_info be freed when unregister_framebuffer() is called
through drm_dev_unregister() ? AFAICT the call chain is the following:

drm_put_dev()
   drm_dev_unregister()
     drm_client_dev_unregister()
       drm_fbdev_client_unregister()
         drm_fb_helper_unregister_fbi()
           unregister_framebuffer()
             do_unregister_framebuffer()
               put_fb_info()
                 drm_fbdev_fb_destroy()
                   framebuffer_release()

which is the reason why I believe that drm_fb_helper_fini() should be
an internal static function and only called from drm_fbdev_fb_destroy().

Drivers shouldn't really explicitly call this helper in my opinion.

Thanks.  That makes sense.

Best regards
Thomas




--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Maxfeldstr. 5, 90409 Nürnberg, Germany
(HRB 36809, AG Nürnberg)
Geschäftsführer: Ivo Totev

Attachment: OpenPGP_signature
Description: OpenPGP digital signature


[Index of Archives]     [Linux DRI Users]     [Linux Intel Graphics]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [XFree86]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [XFree86]
  Powered by Linux