linux-kernel - Re: [PATCH] drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20230817151739.GEZN46E2T/1GS+baIZ@fat_crate.local>
Date:   Thu, 17 Aug 2023 17:17:39 +0200
From:   Borislav Petkov <bp@...en8.de>
To:     Karol Herbst <kherbst@...hat.com>
Cc:     linux-kernel@...r.kernel.org, Ben Skeggs <bskeggs@...hat.com>,
        Lyude Paul <lyude@...hat.com>, dri-devel@...ts.freedesktop.org,
        nouveau@...ts.freedesktop.org, Takashi Iwai <tiwai@...e.de>
Subject: Re: [PATCH] drm/nouveau/disp: fix use-after-free in error handling
 of nouveau_connector_create

On Thu, Aug 17, 2023 at 12:24:45PM +0200, Karol Herbst wrote:
> simply throw a
> 
> printk(KERN_WARNING "nvkm_uconn_uevent %u\n", outp->info.location);
> 
> inside drivers/gpu/drm/nouveau/nvkm/engine/disp/uconn.c:104 after that
> mentioned comment.

diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/uconn.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/uconn.c
index 46b057fe1412..661fd0cf3b3b 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/uconn.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/uconn.c
@@ -101,6 +101,7 @@ nvkm_uconn_uevent(struct nvkm_object *object, void *argv, u32 argc, struct nvkm_
        if (args->v0.types & NVIF_CONN_EVENT_V0_UNPLUG) bits |= NVKM_GPIO_LO;
        if (args->v0.types & NVIF_CONN_EVENT_V0_IRQ) {
                /* TODO: support DP IRQ on ANX9805 and remove this hack. */
+               printk(KERN_WARNING "nvkm_uconn_uevent %u\n", outp->info.location);
                if (!outp->info.location)
                        return -EINVAL;
        }

result:

[   10.566759] ACPI: bus type drm_connector registered
[   10.591171] Console: switching to colour dummy device 80x25
[   10.598472] nouveau 0000:03:00.0: vgaarb: deactivate vga console
[   10.607121] nouveau 0000:03:00.0: NVIDIA GT218 (0a8c00b1)
[   10.728361] nouveau 0000:03:00.0: bios: version 70.18.83.00.08
[   10.742137] nouveau 0000:03:00.0: fb: 512 MiB DDR3
[   11.059848] nouveau 0000:03:00.0: DRM: VRAM: 512 MiB
[   11.064911] nouveau 0000:03:00.0: DRM: GART: 1048576 MiB
[   11.070302] nouveau 0000:03:00.0: DRM: TMDS table version 2.0
[   11.076126] nouveau 0000:03:00.0: DRM: DCB version 4.0
[   11.081335] nouveau 0000:03:00.0: DRM: DCB outp 00: 02000360 00000000
[   11.087865] nouveau 0000:03:00.0: DRM: DCB outp 01: 02000362 00020010
[   11.094395] nouveau 0000:03:00.0: DRM: DCB outp 02: 028003a6 0f220010
[   11.100912] nouveau 0000:03:00.0: DRM: DCB outp 03: 01011380 00000000
[   11.107422] nouveau 0000:03:00.0: DRM: DCB outp 04: 08011382 00020010
[   11.113940] nouveau 0000:03:00.0: DRM: DCB outp 05: 088113c6 0f220010
[   11.120457] nouveau 0000:03:00.0: DRM: DCB conn 00: 00101064
[   11.126182] nouveau 0000:03:00.0: DRM: DCB conn 01: 00202165
[   11.138865] nouveau 0000:03:00.0: DRM: MM: using COPY for buffer copies
[   11.151291] nvkm_uconn_uevent 0
[   11.154643] nvkm_uconn_uevent 0
[   11.157975] nvkm_uconn_uevent 0
[   11.161298] nvkm_uconn_uevent 0
[   11.164616] nvkm_uconn_uevent 0
[   11.167943] nvkm_uconn_uevent 0
[   11.176010] [drm] Initialized nouveau 1.3.1 20120801 for 0000:03:00.0 on minor 0
[   11.184186] nouveau 0000:03:00.0: [drm] Cannot find any crtc or sizes
[   11.260527] megasas: 07.725.01.00-rc1
[   11.264555] st: Version 20160209, fixed bufsize 32768, s/g segs 256

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette