linux-kernel - Re: [PATCH] drm/mxsfb: fix missing rollback on failure in mxsfb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <46140633-a41d-4498-bc78-e43a1bd6b348@suse.de>
Date: Fri, 14 Mar 2025 09:08:41 +0100
From: Thomas Zimmermann <tzimmermann@...e.de>
To: Dario Binacchi <dario.binacchi@...rulasolutions.com>
Cc: Luca Ceresoli <luca.ceresoli@...tlin.com>, Marek Vasut <marex@...x.de>,
 Stefan Agner <stefan@...er.ch>,
 Maarten Lankhorst <maarten.lankhorst@...ux.intel.com>,
 Maxime Ripard <mripard@...nel.org>, David Airlie <airlied@...il.com>,
 Simona Vetter <simona@...ll.ch>, Shawn Guo <shawnguo@...nel.org>,
 Sascha Hauer <s.hauer@...gutronix.de>,
 Pengutronix Kernel Team <kernel@...gutronix.de>,
 Fabio Estevam <festevam@...il.com>,
 Michael Trimarchi <michael@...rulasolutions.com>,
 Thomas Petazzoni <thomas.petazzoni@...tlin.com>,
 dri-devel@...ts.freedesktop.org, imx@...ts.linux.dev,
 linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] drm/mxsfb: fix missing rollback on failure in
 mxsfb_probe()

Hi

Am 13.03.25 um 21:43 schrieb Dario Binacchi:
> Hi All,
>
> On Thu, Mar 13, 2025 at 3:40 PM Thomas Zimmermann <tzimmermann@...e.de> wrote:
>> Hi
>>
>> Am 13.03.25 um 15:25 schrieb Luca Ceresoli:
>>> When aperture_remove_all_conflicting_devices() fails, the current code
>>> returns without going through the rollback actions at the end of the
>>> function, thus the actions done by drm_dev_alloc() and mxsfb_load() are not
>>> undone.
>>>
>>> Fix by using a goto statament, as done for the previous and following error
>>> conditions.
>>>
>>> Fixes: c8e7b185d45b ("drm/mxsfb: Remove generic DRM drivers in probe function")
>>> Signed-off-by: Luca Ceresoli <luca.ceresoli@...tlin.com>
>>> ---
>>> The offending commit is not yet merged into master, and even less in a
>>> released kernel, so this does not need to go through stable.
>>> ---
>>>    drivers/gpu/drm/mxsfb/mxsfb_drv.c | 7 ++++---
>>>    1 file changed, 4 insertions(+), 3 deletions(-)
>>>
>>> diff --git a/drivers/gpu/drm/mxsfb/mxsfb_drv.c b/drivers/gpu/drm/mxsfb/mxsfb_drv.c
>>> index c183b1112bc4e9fe4f3b048a2b6e4c98d1d47cb3..b4273e678d26dbc3dee2014266d61470da4e8010 100644
>>> --- a/drivers/gpu/drm/mxsfb/mxsfb_drv.c
>>> +++ b/drivers/gpu/drm/mxsfb/mxsfb_drv.c
>>> @@ -365,9 +365,10 @@ static int mxsfb_probe(struct platform_device *pdev)
>>>         * located anywhere in RAM
>>>         */
>>>        ret = aperture_remove_all_conflicting_devices(mxsfb_driver.name);
>>> -     if (ret)
>>> -             return dev_err_probe(&pdev->dev, ret,
>>> -                                  "can't kick out existing framebuffers\n");
>>> +     if (ret) {
>>> +             dev_err_probe(&pdev->dev, ret, "can't kick out existing framebuffers\n");
>>> +             goto err_unload;
>>> +     }
>> I must have missed that when I reviewed the patch. But this call should
>> happen much earlier. right at the top of the probe function before
>> drm_dev_alloc().
> I had added the call to aperture_remove_all_conflicting_devices()
> after mxsfb_load() to
> keep the splash screen loaded by U-Boot. So, IMHO, it would be better
> to add the
> goto in case of an error rather than moving
> aperture_remove_all_conflicting_devices()
> to the beginning of the probe function.

But is that really safe?  Once you start touching any of the graphics 
registers, the previous framebuffer and display mode potentially becomes 
invalid. (Depends on the details of the driver and hardware, of course.)

Best regards
Thomas

>
> Thanks and regards,
> Dario
>
>> Conflicting drivers need to be kicked out before
>> setting up DRM. Could you please send a patch to move the call to the
>> top? No extra cleanup would be required then.
>>
>> Best regards
>> Thomas
>>
>>>        ret = drm_dev_register(drm, 0);
>>>        if (ret)
>>>
>>> ---
>>> base-commit: f9f087d946266bc5da7c3a17bd8fd9d01969e3cf
>>> change-id: 20250313-mxsfb_probe-fix-rollback-on-error-3074b9080f34
>>>
>>> Best regards,
>> --
>> --
>> Thomas Zimmermann
>> Graphics Driver Developer
>> SUSE Software Solutions Germany GmbH
>> Frankenstrasse 146, 90461 Nuernberg, Germany
>> GF: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman
>> HRB 36809 (AG Nuernberg)
>>
>

-- 
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstrasse 146, 90461 Nuernberg, Germany
GF: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman
HRB 36809 (AG Nuernberg)