Messages in this thread | | | Date | Tue, 10 May 2022 09:19:56 +0200 | Subject | Re: [PATCH v3 1/4] fbdev: Prevent possible use-after-free in fb_release() | From | Andrzej Hajda <> |
| |
On 10.05.2022 00:42, Javier Martinez Canillas wrote: > On 5/10/22 00:22, Andrzej Hajda wrote: > > [snip] > >>> static void drm_fbdev_fb_destroy(struct fb_info *info) >>> { >>> + if (info->cmap.len) >>> + fb_dealloc_cmap(&info->cmap); >>> + >>> drm_fbdev_release(info->par); >>> + framebuffer_release(info); >> I would put drm_fbdev_release at the beginning - it cancels workers >> which could expect cmap to be still valid. >> > Indeed, you are correct again. [0] is the final version of the patch I've > but don't have an i915 test machine to give it a try. I'll test tomorrow > on my test systems to verify that it doesn't cause any regressions since > with other DRM drivers. > > I think that besides this patch, drivers shouldn't need to call to the > drm_fb_helper_fini() function directly. Since that would be called during > drm_fbdev_fb_destroy() anyways. > > We should probably remove that call in all drivers and make this helper > function static and just private to drm_fb_helper functions. > > Or am I missing something here ?
This is question for experts :) I do not know what are user API/ABI expectations regarding removal of fbdev driver, I wonder if they are documented somewhere :) Apparently we have some process of 'zombification' here - we need to remove the driver without waiting for userspace closing framebuffer(???) (to unbind ops-es and remove references to driver related things), but we need to leave some structures to fool userspace, 'info' seems to be one of them. So I guess there should be something called on driver's _remove path, and sth on destroy path.
Regards Andrzej
> > [0]: > From 5170cafcf2936da8f1c53231e3baa7d7a2b16c61 Mon Sep 17 00:00:00 2001 > From: Javier Martinez Canillas <javierm@redhat.com> > Date: Tue May 10 00:39:55 2022 +0200 > Subject: [RFT PATCH] drm/fb-helper: Don't deallocate fb colormap and free fb info > too early > > Currently these are done in drm_fb_helper_fini() but this helper is called > by drivers in their .remove callback, which could lead to a use-after-free > if a process has opened the emulated fbdev node while a driver is removed. > > For example, in i915 driver the call chain during remove is the following: > > struct pci_driver i915_pci_driver = { > ... > .remove = i915_pci_remove, > ... > }; > > i915_pci_remove > i915_driver_remove > intel_modeset_driver_remove_noirq > intel_fbdev_fini > intel_fbdev_destroy > drm_fb_helper_fini > framebuffer_release > > Later the process will close the fbdev node file descriptor leading to the > mentioned use-after-free bug in drm_fbdev_fb_destroy(), due the following: > > drm_fbdev_fb_destroy > drm_fbdev_release(info->par); <-- info was already freed on .remove > > To prevent that, let's move the framebuffer_release() call to the end of > the drm_fbdev_fb_destroy() function. > > Also, the call to fb_dealloc_cmap() in drm_fb_helper_fini() is too early > and is more correct to do it in drm_fbdev_fb_destroy() as well. After a > call to drm_fbdev_release() has been made. > > Reported-by: Andrzej Hajda <andrzej.hajda@intel.com> > Signed-off-by: Javier Martinez Canillas <javierm@redhat.com> > --- > drivers/gpu/drm/drm_fb_helper.c | 9 +++------ > 1 file changed, 3 insertions(+), 6 deletions(-) > > diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c > index d265a73313c9..7288fbd26bcc 100644 > --- a/drivers/gpu/drm/drm_fb_helper.c > +++ b/drivers/gpu/drm/drm_fb_helper.c > @@ -627,12 +627,6 @@ void drm_fb_helper_fini(struct drm_fb_helper *fb_helper) > cancel_work_sync(&fb_helper->resume_work); > cancel_work_sync(&fb_helper->damage_work); > > - info = fb_helper->fbdev; > - if (info) { > - if (info->cmap.len) > - fb_dealloc_cmap(&info->cmap); > - framebuffer_release(info); > - } > fb_helper->fbdev = NULL; > > mutex_lock(&kernel_fb_helper_lock); > @@ -2112,6 +2106,9 @@ static void drm_fbdev_release(struct drm_fb_helper *fb_helper) > static void drm_fbdev_fb_destroy(struct fb_info *info) > { > drm_fbdev_release(info->par); > + if (info->cmap.len) > + fb_dealloc_cmap(&info->cmap); > + framebuffer_release(info); > } > > static int drm_fbdev_fb_mmap(struct fb_info *info, struct vm_area_struct *vma)
| |