linux-kernel - Re: [PATCH] video/logo: fix use logo after free prevention

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <5530E31F.2010300@ti.com>
Date:	Fri, 17 Apr 2015 13:40:31 +0300
From:	Tomi Valkeinen <tomi.valkeinen@...com>
To:	Manfred Schlaegl <manfred.schlaegl@....at>,
	Jean-Christophe Plagniol-Villard <plagnioj@...osoft.com>
CC:	<linux-fbdev@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
	Manfred Schlaegl <manfred.schlaegl@...zinger.com>
Subject: Re: [PATCH] video/logo: fix use logo after free prevention

Hi,

On 04/17/2015 12:48 PM, Manfred Schlaegl wrote:
> After 92b004d1aa9f367c372511ca0330f58216b25703 the logos disappeared on
> Freescale i.MX53 and i.MX6 SoC's (detected on linux-3.12.37).
> This happens because the fb_find_logo function is validly called
> (initdata still not freed) AFTER newly introduced latecall
> fb_logo_late_init.
>
> Instead of stetting a logos_freed flag somewhere in lateinit, this patch
> uses system_state==SYSTEM_BOOTING as indication for valid initdata.

The kernel init does free_initmem() call before setting the system_state 
to SYSTEM_RUNNING, so there's a period of time when the logos are freed, 
but the check in you patch does not catch it.

  Tomi
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/