linux-kernel - Re: [PATCH] mx3fb: fix NULL pointer dereference in screen blanking.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <4E8B6AEA.2060608@gmx.de>
Date:	Tue, 04 Oct 2011 20:22:02 +0000
From:	Florian Tobias Schandinat <FlorianSchandinat@....de>
To:	Michael Thalmeier <michael.thalmeier@...e.at>
CC:	linux-fbdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] mx3fb: fix NULL pointer dereference in screen blanking.

On 09/23/2011 12:09 PM, Michael Thalmeier wrote:
> From: Wolfram Stering <wolfram.stering@...e.at>
> 
> When blanking an already blanked framebuffer, a kernel NULL pointer
> dereference occurred, because mx3fb driver handles all kinds of screen
> blanking (normal, vsync suspend, powerdown) in the same way.
> Certain programs (Xorg X11 server) first do a normal blank, followed by
> a powerdown blank, which triggered the bug.
> 
> Add an additional safeguard and make sdc_disable_channel() safe against
> multiple calls independent of other logic.
> 
> Signed-off-by: Michael Thalmeier <michael.thalmeier@...e.at>

Applied.


Thanks,

Florian Tobias Schandinat

> ---
>  drivers/video/mx3fb.c |   13 +++++++++++++
>  1 files changed, 13 insertions(+), 0 deletions(-)
> 
> diff --git a/drivers/video/mx3fb.c b/drivers/video/mx3fb.c
> index 7e3a490..286be99 100644
> --- a/drivers/video/mx3fb.c
> +++ b/drivers/video/mx3fb.c
> @@ -382,6 +382,9 @@ static void sdc_disable_channel(struct mx3fb_info *mx3_fbi)
>  	uint32_t enabled;
>  	unsigned long flags;
>  
> +	if (mx3_fbi->txd == NULL)
> +		return;
> +
>  	spin_lock_irqsave(&mx3fb->lock, flags);
>  
>  	enabled = sdc_fb_uninit(mx3_fbi);
> @@ -986,9 +989,19 @@ static void __blank(int blank, struct fb_info *fbi)
>  {
>  	struct mx3fb_info *mx3_fbi = fbi->par;
>  	struct mx3fb_data *mx3fb = mx3_fbi->mx3fb;
> +	int was_blank = mx3_fbi->blank;
>  
>  	mx3_fbi->blank = blank;
>  
> +	/* Attention!
> +	 * Do not call sdc_disable_channel() for a channel that is disabled
> +	 * already! This will result in a kernel NULL pointer dereference
> +	 * (mx3_fbi->txd is NULL). Hide the fact, that all blank modes are
> +	 * handled equally by this driver.
> +	 */
> +	if (blank > FB_BLANK_UNBLANK && was_blank > FB_BLANK_UNBLANK)
> +		return;
> +
>  	switch (blank) {
>  	case FB_BLANK_POWERDOWN:
>  	case FB_BLANK_VSYNC_SUSPEND:

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/