Re: [PATCH v3 1/4] fbdev: Prevent possible use-after-free in fb_release()

[Thomas Zimmermann <tzimmermann@suse.de>]

[-- Attachment #1.1: Type: text/plain, Size: 2113 bytes --]

Hi

Am 10.05.22 um 10:30 schrieb Javier Martinez Canillas:
> Hello Thomas,
> 
> On 5/10/22 10:04, Thomas Zimmermann wrote:
>> Hi
>>
>> Am 10.05.22 um 00:42 schrieb Javier Martinez Canillas:
>>> On 5/10/22 00:22, Andrzej Hajda wrote:
>>>
>>> [snip]
>>>
>>>>>     static void drm_fbdev_fb_destroy(struct fb_info *info)
>>>>>     {
>>>>> +       if (info->cmap.len)
>>>>> +               fb_dealloc_cmap(&info->cmap);
>>>>> +
>>>>>            drm_fbdev_release(info->par);
>>>>> +       framebuffer_release(info);
>>>>
>>>> I would put drm_fbdev_release at the beginning - it cancels workers
>>>> which could expect cmap to be still valid.
>>>>
>>>
>>> Indeed, you are correct again. [0] is the final version of the patch I've
>>> but don't have an i915 test machine to give it a try. I'll test tomorrow
>>> on my test systems to verify that it doesn't cause any regressions since
>>> with other DRM drivers.
>>
>> You have to go through all DRM drivers that call drm_fb_helper_fini()
>> and make sure that they free fb_info. For example armada appears to be
>> leaking now. [1]
>>
> 
> But shouldn't fb_info be freed when unregister_framebuffer() is called
> through drm_dev_unregister() ? AFAICT the call chain is the following:
> 
> drm_put_dev()
>    drm_dev_unregister()
>      drm_client_dev_unregister()
>        drm_fbdev_client_unregister()
>          drm_fb_helper_unregister_fbi()
>            unregister_framebuffer()
>              do_unregister_framebuffer()
>                put_fb_info()
>                  drm_fbdev_fb_destroy()
>                    framebuffer_release()
> 
> which is the reason why I believe that drm_fb_helper_fini() should be
> an internal static function and only called from drm_fbdev_fb_destroy().
> 
> Drivers shouldn't really explicitly call this helper in my opinion.

Thanks.  That makes sense.

Best regards
Thomas


> 

-- 
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Maxfeldstr. 5, 90409 Nürnberg, Germany
(HRB 36809, AG Nürnberg)
Geschäftsführer: Ivo Totev

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 840 bytes --]