lkml.org 
[lkml]   [2022]   [May]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH v3 1/4] fbdev: Prevent possible use-after-free in fb_release()
From
Hello Thomas,

On 5/10/22 10:04, Thomas Zimmermann wrote:
> Hi
>
> Am 10.05.22 um 00:42 schrieb Javier Martinez Canillas:
>> On 5/10/22 00:22, Andrzej Hajda wrote:
>>
>> [snip]
>>
>>>> static void drm_fbdev_fb_destroy(struct fb_info *info)
>>>> {
>>>> + if (info->cmap.len)
>>>> + fb_dealloc_cmap(&info->cmap);
>>>> +
>>>> drm_fbdev_release(info->par);
>>>> + framebuffer_release(info);
>>>
>>> I would put drm_fbdev_release at the beginning - it cancels workers
>>> which could expect cmap to be still valid.
>>>
>>
>> Indeed, you are correct again. [0] is the final version of the patch I've
>> but don't have an i915 test machine to give it a try. I'll test tomorrow
>> on my test systems to verify that it doesn't cause any regressions since
>> with other DRM drivers.
>
> You have to go through all DRM drivers that call drm_fb_helper_fini()
> and make sure that they free fb_info. For example armada appears to be
> leaking now. [1]
>

But shouldn't fb_info be freed when unregister_framebuffer() is called
through drm_dev_unregister() ? AFAICT the call chain is the following:

drm_put_dev()
drm_dev_unregister()
drm_client_dev_unregister()
drm_fbdev_client_unregister()
drm_fb_helper_unregister_fbi()
unregister_framebuffer()
do_unregister_framebuffer()
put_fb_info()
drm_fbdev_fb_destroy()
framebuffer_release()

which is the reason why I believe that drm_fb_helper_fini() should be
an internal static function and only called from drm_fbdev_fb_destroy().

Drivers shouldn't really explicitly call this helper in my opinion.

--
Best regards,

Javier Martinez Canillas
Linux Engineering
Red Hat

\
 
 \ /
  Last update: 2022-05-10 10:32    [W:0.134 / U:0.416 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site