Re: [PATCH] drm/logicvc: keep the IRQ within the display resource lifetime

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] drm/logicvc: UAF of drm_plane during probe failure or unbind
--

commit 81e314862f436f8aee3b4c3a043bbab040bd125b
Author: Myeonghun Pak <mhun512@gmail.com>

drm/logicvc: keep the IRQ within the display resource lifetime

The interrupt handler accesses the CRTC and the register map. Its
device-managed release currently happens after remove has unprepared
the clocks, and the CRTC is allocated after the interrupt is requested.
Consequently a running handler can outlive the resources it uses, both
on removal and when probe unwinds.

Request the interrupt after initializing the display objects, and
release it explicitly before tearing down the mode state and clocks.
Keep it available through drm_atomic_helper_shutdown(), which may need
vblank completion. Also release it on drm_dev_register() failure before
unwinding the display resources.

> diff --git a/drivers/gpu/drm/logicvc/logicvc_drm.c b/drivers/gpu/drm/logicvc/logicvc_drm.c
> index bbebf4fc7f51a..cf60bbb9800c5 100644
> --- a/drivers/gpu/drm/logicvc/logicvc_drm.c
> +++ b/drivers/gpu/drm/logicvc/logicvc_drm.c
[ ... ]
> @@ -434,16 +428,26 @@ static int logicvc_drm_probe(struct platform_device *pdev)
>  		goto error_clocks;
>  	}
>  
> +	ret = devm_request_irq(dev, irq, logicvc_drm_irq_handler, 0,
> +			       dev_name(dev), logicvc);
> +	if (ret) {
> +		drm_err(drm_dev, "Failed to request IRQ\n");
> +		goto error_mode;
> +	}
> +

[Severity: Critical]
Does this error path (and other probe failures or device unbinds) trigger a
use-after-free of the drm_plane structures?

During probe failure unwinding or device unbind, devres will automatically
free the layer memory (which contains the drm_plane) because it was allocated
with devm_kzalloc(). 

However, neither devres nor logicvc_layer_fini() calls drm_plane_cleanup()
before the memory is freed:

drivers/gpu/drm/logicvc/logicvc_layer.c:logicvc_layer_fini() {
	struct device *dev = logicvc->drm_dev.dev;

	list_del(&layer->list);
	devm_kfree(dev, layer);
}

Because the plane is still linked in the DRM core plane list, the later call
to drm_mode_config_cleanup() traverses the list and dereferences the already
freed memory:

drivers/gpu/drm/drm_mode_config.c:drm_mode_config_cleanup() {
	...
	list_for_each_entry_safe(plane, plt, &dev->mode_config.plane_list, head) {
		plane->funcs->destroy(plane);
	}
	...
}

Should logicvc_layer_fini() call drm_plane_cleanup() before explicitly freeing
the layer structure?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/179203400409.2736079.4502160101423826217.G31.logicvc-irq@gmail.com?part=1