linux-kernel - Re: [PATCH stable-6.7] soc: qcom: pmic_glink

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sat, 16 Mar 2024 06:41:44 -0400
From: Sasha Levin <sashal@...nel.org>
To: Johan Hovold <johan+linaro@...nel.org>
Cc: stable@...r.kernel.org, Bjorn Andersson <andersson@...nel.org>,
	Konrad Dybcio <konrad.dybcio@...aro.org>,
	linux-arm-msm@...r.kernel.org, dri-devel@...ts.freedesktop.org,
	linux-kernel@...r.kernel.org,
	Dmitry Baryshkov <dmitry.baryshkov@...aro.org>
Subject: Re: [PATCH stable-6.7] soc: qcom: pmic_glink_altmode: fix drm bridge
 use-after-free

On Fri, Mar 08, 2024 at 10:03:57AM +0100, Johan Hovold wrote:
>commit b979f2d50a099f3402418d7ff5f26c3952fb08bb upstream.
>
>A recent DRM series purporting to simplify support for "transparent
>bridges" and handling of probe deferrals ironically exposed a
>use-after-free issue on pmic_glink_altmode probe deferral.
>
>This has manifested itself as the display subsystem occasionally failing
>to initialise and NULL-pointer dereferences during boot of machines like
>the Lenovo ThinkPad X13s.
>
>Specifically, the dp-hpd bridge is currently registered before all
>resources have been acquired which means that it can also be
>deregistered on probe deferrals.
>
>In the meantime there is a race window where the new aux bridge driver
>(or PHY driver previously) may have looked up the dp-hpd bridge and
>stored a (non-reference-counted) pointer to the bridge which is about to
>be deallocated.
>
>When the display controller is later initialised, this triggers a
>use-after-free when attaching the bridges:
>
>	dp -> aux -> dp-hpd (freed)
>
>which may, for example, result in the freed bridge failing to attach:
>
>	[drm:drm_bridge_attach [drm]] *ERROR* failed to attach bridge /soc@...hy@...b000 to encoder TMDS-31: -16
>
>or a NULL-pointer dereference:
>
>	Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
>	...
>	Call trace:
>	  drm_bridge_attach+0x70/0x1a8 [drm]
>	  drm_aux_bridge_attach+0x24/0x38 [aux_bridge]
>	  drm_bridge_attach+0x80/0x1a8 [drm]
>	  dp_bridge_init+0xa8/0x15c [msm]
>	  msm_dp_modeset_init+0x28/0xc4 [msm]
>
>The DRM bridge implementation is clearly fragile and implicitly built on
>the assumption that bridges may never go away. In this case, the fix is
>to move the bridge registration in the pmic_glink_altmode driver to
>after all resources have been looked up.
>
>Incidentally, with the new dp-hpd bridge implementation, which registers
>child devices, this is also a requirement due to a long-standing issue
>in driver core that can otherwise lead to a probe deferral loop (see
>commit fbc35b45f9f6 ("Add documentation on meaning of -EPROBE_DEFER")).
>
>[DB: slightly fixed commit message by adding the word 'commit']
>Fixes: 080b4e24852b ("soc: qcom: pmic_glink: Introduce altmode support")
>Fixes: 2bcca96abfbf ("soc: qcom: pmic-glink: switch to DRM_AUX_HPD_BRIDGE")
>Cc: <stable@...r.kernel.org>      # 6.3
>Cc: Bjorn Andersson <andersson@...nel.org>
>Cc: Dmitry Baryshkov <dmitry.baryshkov@...aro.org>
>Signed-off-by: Johan Hovold <johan+linaro@...nel.org>
>Reviewed-by: Bjorn Andersson <andersson@...nel.org>
>Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@...aro.org>
>Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@...aro.org>
>Link: https://patchwork.freedesktop.org/patch/msgid/20240217150228.5788-4-johan+linaro@kernel.org
>[ johan: backport to 6.7 which does not have DRM aux bridge ]
>Signed-off-by: Johan Hovold <johan+linaro@...nel.org>

Queued up, thanks!

-- 
Thanks,
Sasha