[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <e7067cfb-9279-7811-03a0-aa7807423f07@gmx.de>
Date: Thu, 11 May 2023 19:03:23 +0200
From: Helge Deller <deller@....de>
To: Zheng Wang <zyytlz.wz@....com>
Cc: javierm@...hat.com, tzimmermann@...e.de,
linux-fbdev@...r.kernel.org, dri-devel@...ts.freedesktop.org,
linux-kernel@...r.kernel.org, hackerzheng666@...il.com,
1395428693sheep@...il.com, alex000young@...il.com
Subject: Re: [PATCH v2] video: imsttfb: Fix use after free bug in
imsttfb_probe due to lack of error-handling of init_imstt
On 4/27/23 05:08, Zheng Wang wrote:
> A use-after-free bug may occur if init_imstt invokes framebuffer_release
> and free the info ptr. The caller, imsttfb_probe didn't notice that and
> still keep the ptr as private data in pdev.
>
> If we remove the driver which will call imsttfb_remove to make cleanup,
> UAF happens.
>
> Fix it by return error code if bad case happens in init_imstt.
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Zheng Wang <zyytlz.wz@....com>
applied.
Thanks!
Helge
> ---
> v2:
> - add return error code in another location.
> ---
> drivers/video/fbdev/imsttfb.c | 15 ++++++++-------
> 1 file changed, 8 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/video/fbdev/imsttfb.c b/drivers/video/fbdev/imsttfb.c
> index bea45647184e..975dd682fae4 100644
> --- a/drivers/video/fbdev/imsttfb.c
> +++ b/drivers/video/fbdev/imsttfb.c
> @@ -1347,7 +1347,7 @@ static const struct fb_ops imsttfb_ops = {
> .fb_ioctl = imsttfb_ioctl,
> };
>
> -static void init_imstt(struct fb_info *info)
> +static int init_imstt(struct fb_info *info)
> {
> struct imstt_par *par = info->par;
> __u32 i, tmp, *ip, *end;
> @@ -1420,7 +1420,7 @@ static void init_imstt(struct fb_info *info)
> || !(compute_imstt_regvals(par, info->var.xres, info->var.yres))) {
> printk("imsttfb: %ux%ux%u not supported\n", info->var.xres, info->var.yres, info->var.bits_per_pixel);
> framebuffer_release(info);
> - return;
> + return -ENODEV;
> }
>
> sprintf(info->fix.id, "IMS TT (%s)", par->ramdac == IBM ? "IBM" : "TVP");
> @@ -1456,12 +1456,13 @@ static void init_imstt(struct fb_info *info)
>
> if (register_framebuffer(info) < 0) {
> framebuffer_release(info);
> - return;
> + return -ENODEV;
> }
>
> tmp = (read_reg_le32(par->dc_regs, SSTATUS) & 0x0f00) >> 8;
> fb_info(info, "%s frame buffer; %uMB vram; chip version %u\n",
> info->fix.id, info->fix.smem_len >> 20, tmp);
> + return 0;
> }
>
> static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
> @@ -1529,10 +1530,10 @@ static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
> if (!par->cmap_regs)
> goto error;
> info->pseudo_palette = par->palette;
> - init_imstt(info);
> -
> - pci_set_drvdata(pdev, info);
> - return 0;
> + ret = init_imstt(info);
> + if (!ret)
> + pci_set_drvdata(pdev, info);
> + return ret;
>
> error:
> if (par->dc_regs)
Powered by blists - more mailing lists