linux-kernel - Re: [PATCH v3] fbdev/simplefb: Fix use after free in simplefb_detach

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250915132621.GA1931265@robin.jannau.net>
Date: Mon, 15 Sep 2025 15:26:21 +0200
From: Janne Grunau <j@...nau.net>
To: Hans de Goede <hansg@...nel.org>
Cc: Helge Deller <deller@....de>, Thierry Reding <treding@...dia.com>,
	linux-fbdev@...r.kernel.org, dri-devel@...ts.freedesktop.org,
	linux-kernel@...r.kernel.org, Daniel Huhardeaux <tech@...tai.net>,
	stable@...r.kernel.org
Subject: Re: [PATCH v3] fbdev/simplefb: Fix use after free in
 simplefb_detach_genpds()

On Mon, Sep 15, 2025 at 02:19:30PM +0200, Hans de Goede wrote:
> Hi,
> 
> On 15-Sep-25 8:36 AM, Janne Grunau wrote:
> > The pm_domain cleanup can not be devres managed as it uses struct
> > simplefb_par which is allocated within struct fb_info by
> > framebuffer_alloc(). This allocation is explicitly freed by
> > unregister_framebuffer() in simplefb_remove().
> > Devres managed cleanup runs after the device remove call and thus can no
> > longer access struct simplefb_par.
> > Call simplefb_detach_genpds() explicitly from simplefb_destroy() like
> > the cleanup functions for clocks and regulators.
> > 
> > Fixes an use after free on M2 Mac mini during
> > aperture_remove_conflicting_devices() using the downstream asahi kernel
> > with Debian's kernel config. For unknown reasons this started to
> > consistently dereference an invalid pointer in v6.16.3 based kernels.
> 
> Thanks, this v3 patch looks good to me:
> 
> Reviewed-by: Hans de Goede <hansg@...nel.org>
> 
> I assume that you will push this do drm-misc yourself ?

I don't have drm-misc commit access yet. I took this as reminder to
request access so I will either commit it myself or ask someone else in
a couple of days (if nobody beats me to it).

thanks,
Janne