All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH v3 0/4] fbdev: Fix use-after-free caused by wrong fb_info cleanup in drivers
@ 2022-05-05 21:59 ` Javier Martinez Canillas
  0 siblings, 0 replies; 56+ messages in thread
From: Javier Martinez Canillas @ 2022-05-05 21:59 UTC (permalink / raw)
  To: linux-kernel
  Cc: Javier Martinez Canillas, Daniel Vetter, Hans de Goede,
	Helge Deller, Peter Jones, Thomas Zimmermann, Zack Rusin,
	dri-devel, linux-fbdev

Hello,

This series contains patches suggested by Daniel Vetter to fix a use-after-free
error in the fb_release() function, due a fb_info associated with a fbdev being
freed too early while a user-space process still has the fbdev dev node opened.

That is caused by a wrong management of the struct fb_info lifetime in drivers,
but the fbdev core can also be made more resilient about it an leak

This can easily be reproduced with the simplefb driver doing the following:

$ cat < /dev/fb0 &
$ echo simple-framebuffer.0 > /sys/bus/platform/drivers/simple-framebuffer/unbind
$ kill %1

[  257.490471] ------------[ cut here ]------------
...
[  257.495125] refcount_t: underflow; use-after-free.
[  257.495222] WARNING: CPU: 0 PID: 975 at lib/refcount.c:28 refcount_warn_saturate+0xf4/0x144
...
[  257.637482] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[  257.644441] pc : refcount_warn_saturate+0xf4/0x144
[  257.649226] lr : refcount_warn_saturate+0xf4/0x144
[  257.654009] sp : ffff80000a06bbf0
[  257.657315] x29: ffff80000a06bbf0 x28: 000000000000000a x27: 000000000000000a
[  257.664448] x26: 0000000000000000 x25: ffff470b88c6a180 x24: 000000000000000a
[  257.671581] x23: ffff470b81706480 x22: ffff470b808c2160 x21: ffff470b8922ba20
[  257.678713] x20: ffff470b891f5810 x19: ffff470b891f5800 x18: ffffffffffffffff
[  257.685846] x17: 3a725f7463656a62 x16: ffffbb18c6465fd4 x15: 0720072007200720
[  257.692978] x14: 0720072d072d072d x13: 0a2e656572662d72 x12: 657466612d657375
[  257.700110] x11: 203b776f6c667265 x10: 646e75203a745f74 x9 : ffffbb18c58f6c90
[  257.707242] x8 : 75203b776f6c6672 x7 : 65646e75203a745f x6 : 0000000000000001
[  257.714373] x5 : ffff470bff8ec418 x4 : 0000000000000000 x3 : 0000000000000027
[  257.721506] x2 : 0000000000000000 x1 : 0000000000000027 x0 : 0000000000000026
[  257.728638] Call trace:
[  257.731075]  refcount_warn_saturate+0xf4/0x144
[  257.735513]  put_fb_info+0x70/0x7c
[  257.738916]  fb_release+0x60/0x74
[  257.742225]  __fput+0x88/0x240
[  257.745276]  ____fput+0x1c/0x30
[  257.748410]  task_work_run+0xc4/0x21c
[  257.752066]  do_exit+0x170/0x370
[  257.755288]  do_group_exit+0x40/0xb4
[  257.758858]  get_signal+0x8e0/0x90c
[  257.762339]  do_signal+0x1a0/0x280
[  257.765733]  do_notify_resume+0xc8/0x390
[  257.769650]  el0_da+0xe8/0xf0
[  257.772613]  el0t_64_sync_handler+0xe8/0x130
[  257.776877]  el0t_64_sync+0x190/0x194
[  257.780534] ---[ end trace 0000000000000000 ]---

Patch #1 adds a WARN_ON() to framebuffer_release() to prevent the use-after-free
to happen.

Patch #2, #3 and #4 fix the simplefb, efifb and vesafb drivers respectively, to
free the resources at the correct place.

Changes in v3:
- Add Fixes: tag (Daniel Vetter).
- Include in commit message a note that drivers are still broken
  but at least reverts to the previous behavior (Daniel Vetter).
- Only move framebuffer_release() and don't do any other change
  (Daniel Vetter).

Changes in v2:
- Also do the change for vesafb (Thomas Zimmermann).

Daniel Vetter (1):
  fbdev: Prevent possible use-after-free in fb_release()

Javier Martinez Canillas (3):
  fbdev: simplefb: Cleanup fb_info in .fb_destroy rather than .remove
  fbdev: efifb: Cleanup fb_info in .fb_destroy rather than .remove
  fbdev: vesafb: Cleanup fb_info in .fb_destroy rather than .remove

 drivers/video/fbdev/core/fbsysfs.c | 4 ++++
 drivers/video/fbdev/efifb.c        | 9 ++++++++-
 drivers/video/fbdev/simplefb.c     | 8 +++++++-
 drivers/video/fbdev/vesafb.c       | 8 +++++++-
 4 files changed, 26 insertions(+), 3 deletions(-)

-- 
2.35.1


^ permalink raw reply	[flat|nested] 56+ messages in thread

end of thread, other threads:[~2022-05-11 13:19 UTC | newest]

Thread overview: 56+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-05-05 21:59 [PATCH v3 0/4] fbdev: Fix use-after-free caused by wrong fb_info cleanup in drivers Javier Martinez Canillas
2022-05-05 21:59 ` Javier Martinez Canillas
2022-05-05 22:04 ` [PATCH v3 1/4] fbdev: Prevent possible use-after-free in fb_release() Javier Martinez Canillas
2022-05-05 22:04   ` Javier Martinez Canillas
2022-05-09 14:56   ` Andrzej Hajda
2022-05-09 14:56     ` Andrzej Hajda
2022-05-09 15:30     ` Javier Martinez Canillas
2022-05-09 15:51       ` Andrzej Hajda
2022-05-09 15:51         ` Andrzej Hajda
2022-05-09 16:33         ` Javier Martinez Canillas
2022-05-09 18:12           ` Thomas Zimmermann
2022-05-09 18:12             ` Thomas Zimmermann
2022-05-09 20:03             ` Javier Martinez Canillas
2022-05-09 20:03               ` Javier Martinez Canillas
2022-05-09 22:22               ` Andrzej Hajda
2022-05-09 22:22                 ` Andrzej Hajda
2022-05-09 22:42                 ` Javier Martinez Canillas
2022-05-09 22:42                   ` Javier Martinez Canillas
2022-05-10  7:19                   ` Andrzej Hajda
2022-05-10  7:19                     ` Andrzej Hajda
2022-05-10  7:50                     ` Javier Martinez Canillas
2022-05-10  7:50                       ` Javier Martinez Canillas
2022-05-11 13:18                       ` Daniel Vetter
2022-05-11 13:18                         ` Daniel Vetter
2022-05-10  8:04                   ` Thomas Zimmermann
2022-05-10  8:04                     ` Thomas Zimmermann
2022-05-10  8:30                     ` Javier Martinez Canillas
2022-05-10  8:30                       ` Javier Martinez Canillas
2022-05-10  8:37                       ` Thomas Zimmermann
2022-05-10  8:37                         ` Thomas Zimmermann
2022-05-10  8:50                         ` Thomas Zimmermann
2022-05-10  8:50                           ` Thomas Zimmermann
2022-05-10  9:06                           ` Javier Martinez Canillas
2022-05-10  9:06                             ` Javier Martinez Canillas
2022-05-10  9:39                             ` Thomas Zimmermann
2022-05-10  9:44                               ` Javier Martinez Canillas
2022-05-09 18:32           ` Thomas Zimmermann
2022-05-09 18:32             ` Thomas Zimmermann
2022-05-09 20:00             ` Javier Martinez Canillas
2022-05-09 20:00               ` Javier Martinez Canillas
2022-05-11 13:15               ` Daniel Vetter
2022-05-11 13:15                 ` Daniel Vetter
2022-05-05 22:04 ` [PATCH v3 2/4] fbdev: simplefb: Cleanup fb_info in .fb_destroy rather than .remove Javier Martinez Canillas
2022-05-05 22:04   ` Javier Martinez Canillas
2022-05-05 22:05 ` [PATCH v3 3/4] fbdev: efifb: " Javier Martinez Canillas
2022-05-05 22:05   ` Javier Martinez Canillas
2022-05-06 13:07   ` Andrzej Hajda
2022-05-06 13:07     ` Andrzej Hajda
2022-05-06 13:18     ` Javier Martinez Canillas
2022-05-08 15:40   ` [fbdev] c6a2b1a999: BUG:KASAN:use-after-free_in_efifb_destroy kernel test robot
2022-05-08 15:40     ` kernel test robot
2022-05-08 15:40     ` kernel test robot
2022-05-05 22:06 ` [PATCH v3 4/4] fbdev: vesafb: Cleanup fb_info in .fb_destroy rather than .remove Javier Martinez Canillas
2022-05-05 22:06   ` Javier Martinez Canillas
2022-05-06  7:34 ` [PATCH v3 0/4] fbdev: Fix use-after-free caused by wrong fb_info cleanup in drivers Javier Martinez Canillas
2022-05-06  7:34   ` Javier Martinez Canillas

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.