From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 35655C433EF for ; Tue, 10 May 2022 08:30:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238034AbiEJIex (ORCPT ); Tue, 10 May 2022 04:34:53 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45618 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238040AbiEJIeu (ORCPT ); Tue, 10 May 2022 04:34:50 -0400 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 0E30235858 for ; Tue, 10 May 2022 01:30:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1652171448; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=1m42YOS6adkVOttPvzzPcpB4bdLVq0RFj4rgcIuwmIE=; b=goZPeP17u9qT3qm+qQj//FDuxEpAl7t68g+stlH4Rv+K0oZCAAx+fifJVhtR162AWQz5Io cDu919LRUj8PiSGRL3tGycC6qSzp61WovzHvJHwMTjJDRW1GiL4YKxdYf7Uzm2b0IszzAt QxjLwOmrzlytsPJNCtVkGAg8mVlcYSE= Received: from mail-wm1-f70.google.com (mail-wm1-f70.google.com [209.85.128.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-650-p1LjmR57OCqxTHC-vBQNSg-1; Tue, 10 May 2022 04:30:47 -0400 X-MC-Unique: p1LjmR57OCqxTHC-vBQNSg-1 Received: by mail-wm1-f70.google.com with SMTP id r186-20020a1c44c3000000b00393f52ed5ceso929107wma.7 for ; Tue, 10 May 2022 01:30:46 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:message-id:date:mime-version:user-agent:subject :content-language:to:cc:references:from:in-reply-to :content-transfer-encoding; bh=1m42YOS6adkVOttPvzzPcpB4bdLVq0RFj4rgcIuwmIE=; b=tZiLRMc4n93WkuwoMi2biFEdmxIvemICIABXUNrUsP/pkOQSOHP291n0XlE/nNiYJd sKdqmkKbiemI6h+aWnIxZVoNF6EbCCHJ98qgtfsSdLv6bG8ZHN0L8nA3Ih7yv6ho7Op0 P5aVN3yE0SOmnYyFYpLXdkRNTRXt1V2rsVe2xDLOGP/kwvTg6ngeT266OdS6bLib9s10 10MVOJRTRB9NqcsV24TsbhsSJYf5p2daMbtXz97ObLTsZTqlPnSkQ6TkM7XcgOiuI9nX ne/zK81lJdUnAiw4y75wD9gIPY83M/ak9dNOjnzOLMSXdAESP6sWQbUIEY7a3DPH3UEg oQPA== X-Gm-Message-State: AOAM533o5x1nDycZcQ4yUaySZyW8QL4uaFX/noQRkggx7O8iIAA5Rkmf sz0rr3Dz7qXWip49d2IEFLZUOuTc+LcVcTEun1RVSV2gPWj2RXf4XRrXVNeLefF/lonIIxvWEkW EdUOk5W2mmsJtVTwBaD42vDM= X-Received: by 2002:a5d:4703:0:b0:20a:ce3c:7528 with SMTP id y3-20020a5d4703000000b0020ace3c7528mr17564139wrq.688.1652171445793; Tue, 10 May 2022 01:30:45 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwoBMj8kXDsvsfO4i+XkAgVG6qM0AfXiyKEYB6N5jwKUXVSznUhS5NktRYArBUXsTfI3Cbm7g== X-Received: by 2002:a5d:4703:0:b0:20a:ce3c:7528 with SMTP id y3-20020a5d4703000000b0020ace3c7528mr17564116wrq.688.1652171445454; Tue, 10 May 2022 01:30:45 -0700 (PDT) Received: from [192.168.1.129] (205.pool92-176-231.dynamic.orange.es. [92.176.231.205]) by smtp.gmail.com with ESMTPSA id l29-20020a05600c1d1d00b003942a244f53sm1816260wms.44.2022.05.10.01.30.44 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 10 May 2022 01:30:45 -0700 (PDT) Message-ID: <2d8d8583-3a39-b826-dd83-ba5bc4c5b082@redhat.com> Date: Tue, 10 May 2022 10:30:44 +0200 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.8.0 Subject: Re: [PATCH v3 1/4] fbdev: Prevent possible use-after-free in fb_release() Content-Language: en-US To: Thomas Zimmermann , Andrzej Hajda , linux-kernel@vger.kernel.org Cc: linux-fbdev@vger.kernel.org, Daniel Vetter , Helge Deller , dri-devel@lists.freedesktop.org, Daniel Vetter References: <20220505215947.364694-1-javierm@redhat.com> <20220505220413.365977-1-javierm@redhat.com> <753d0350-42dc-389b-b10b-4533ddcf32ac@intel.com> <1f788b8f-0bea-1818-349e-b1bc907bf251@redhat.com> <3b7fe4fe-fdec-cef2-4e0e-309d9dc4a8af@redhat.com> <2bf27b09-0896-1849-254f-d5b19abdc892@redhat.com> <1c36d431-d5c0-7278-c9e0-61867e9dc174@redhat.com> <79aaea41-5dab-f896-ab3d-d6bc9a5de615@suse.de> From: Javier Martinez Canillas In-Reply-To: <79aaea41-5dab-f896-ab3d-d6bc9a5de615@suse.de> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: bulk List-ID: X-Mailing-List: linux-fbdev@vger.kernel.org Hello Thomas, On 5/10/22 10:04, Thomas Zimmermann wrote: > Hi > > Am 10.05.22 um 00:42 schrieb Javier Martinez Canillas: >> On 5/10/22 00:22, Andrzej Hajda wrote: >> >> [snip] >> >>>> static void drm_fbdev_fb_destroy(struct fb_info *info) >>>> { >>>> + if (info->cmap.len) >>>> + fb_dealloc_cmap(&info->cmap); >>>> + >>>> drm_fbdev_release(info->par); >>>> + framebuffer_release(info); >>> >>> I would put drm_fbdev_release at the beginning - it cancels workers >>> which could expect cmap to be still valid. >>> >> >> Indeed, you are correct again. [0] is the final version of the patch I've >> but don't have an i915 test machine to give it a try. I'll test tomorrow >> on my test systems to verify that it doesn't cause any regressions since >> with other DRM drivers. > > You have to go through all DRM drivers that call drm_fb_helper_fini() > and make sure that they free fb_info. For example armada appears to be > leaking now. [1] > But shouldn't fb_info be freed when unregister_framebuffer() is called through drm_dev_unregister() ? AFAICT the call chain is the following: drm_put_dev() drm_dev_unregister() drm_client_dev_unregister() drm_fbdev_client_unregister() drm_fb_helper_unregister_fbi() unregister_framebuffer() do_unregister_framebuffer() put_fb_info() drm_fbdev_fb_destroy() framebuffer_release() which is the reason why I believe that drm_fb_helper_fini() should be an internal static function and only called from drm_fbdev_fb_destroy(). Drivers shouldn't really explicitly call this helper in my opinion. -- Best regards, Javier Martinez Canillas Linux Engineering Red Hat