linux-kernel - Re: [PATCH v3 1/4] fbdev: Prevent possible use-after-free in fb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 10 May 2022 11:39:37 +0200
From:   Thomas Zimmermann <tzimmermann@...e.de>
To:     Javier Martinez Canillas <javierm@...hat.com>,
        Andrzej Hajda <andrzej.hajda@...el.com>,
        linux-kernel@...r.kernel.org
Cc:     Daniel Vetter <daniel.vetter@...ll.ch>,
        linux-fbdev@...r.kernel.org, Helge Deller <deller@....de>,
        dri-devel@...ts.freedesktop.org,
        Daniel Vetter <daniel.vetter@...el.com>
Subject: Re: [PATCH v3 1/4] fbdev: Prevent possible use-after-free in
 fb_release()

Hi Javier

Am 10.05.22 um 11:06 schrieb Javier Martinez Canillas:
> Hello Thomas,
> 
> On 5/10/22 10:50, Thomas Zimmermann wrote:
> 
> [snip]
> 
>>>> Drivers shouldn't really explicitly call this helper in my opinion.
>>
>> One more stupid question: does armada actually use
>> drm_fbdev_fb_destroy()? It's supposed to be a callback for struct
>> fb_ops. Armada uses it's own instance of fb_ops, which apparently
>> doesn't contain fb_destroy. [1]
>>
> 
> No stupid question at all. You are correct on this. So I guess we still
> need this call in the drivers that don't provide a .fb_destroy() handler.
> 
> I see many options here:
> 
> 1) Document in drm_fb_helper_alloc_fbi() that drivers only need to call
>     drm_fb_helper_fini() explicitly if they are not setting up a fbdev
>     with drm_fbdev_generic_setup(), otherwise is not needed.
> 
> 2) Make drm_fbdev_fb_destroy() an exported symbol so drivers that have
>     custom fb_ops can use it.
> 
> 3) Set .fb_destroy to drm_fbdev_fb_destroy() if isn't set by drivers when
>     they call drm_fb_helper_initial_config() or drm_fb_helper_fill_info().
> 
> I'm leaning towards option (3). Then the fb_info release will be automatic
> whether drivers are using the generic setup or a custom one.

IMHO this would just be another glitch to paper over all the broken 
code. And if you follow through drm_fbdev_fb_helper(), [1] it'll call 
_fini at some point and probably blow up in some other way. Instances of 
struct fb_ops are also usually const.

The only reliable way AFAICT is to do what generic fbdev does: use 
unregister_framebuffer and do the software cleanup somewhere within 
fb_destroy. And then fix all drivers to use that pattern.

Best regards
Thomas

[1] 
https://elixir.bootlin.com/linux/v5.17.6/source/drivers/gpu/drm/drm_fb_helper.c#L2082

> 

-- 
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Maxfeldstr. 5, 90409 Nürnberg, Germany
(HRB 36809, AG Nürnberg)
Geschäftsführer: Ivo Totev

Download attachment "OpenPGP_signature" of type "application/pgp-signature" (841 bytes)