lkml.org 
[lkml]   [2022]   [May]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH v3 1/4] fbdev: Prevent possible use-after-free in fb_release()
From
On 5/10/22 11:39, Thomas Zimmermann wrote:

[snip]

>>
>> 3) Set .fb_destroy to drm_fbdev_fb_destroy() if isn't set by drivers when
>> they call drm_fb_helper_initial_config() or drm_fb_helper_fill_info().
>>
>> I'm leaning towards option (3). Then the fb_info release will be automatic
>> whether drivers are using the generic setup or a custom one.
>
> IMHO this would just be another glitch to paper over all the broken
> code. And if you follow through drm_fbdev_fb_helper(), [1] it'll call
> _fini at some point and probably blow up in some other way. Instances of
> struct fb_ops are also usually const.
>
> The only reliable way AFAICT is to do what generic fbdev does: use
> unregister_framebuffer and do the software cleanup somewhere within
> fb_destroy. And then fix all drivers to use that pattern.
>

Right. We can't really abstract this away from drivers that are not
using the generic fbdev helpers. So then they will have to provide
their own .fb_destroy() callback and do the cleanup.

--
Best regards,

Javier Martinez Canillas
Linux Engineering
Red Hat

\
 
 \ /
  Last update: 2022-05-10 11:45    [W:0.047 / U:1.280 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site