* [PATCH AUTOSEL 5.15 07/11] fbdev: imsttfb: Fix use after free bug in imsttfb_probe
[not found] <20230520182215.845131-1-sashal@kernel.org>
@ 2023-05-20 18:22 ` Sasha Levin
2023-05-20 18:22 ` [PATCH AUTOSEL 5.15 08/11] fbdev: modedb: Add 1920x1080 at 60 Hz video mode Sasha Levin
2023-05-20 18:22 ` [PATCH AUTOSEL 5.15 09/11] fbdev: stifb: Fix info entry in sti_struct on error path Sasha Levin
2 siblings, 0 replies; 3+ messages in thread
From: Sasha Levin @ 2023-05-20 18:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Zheng Wang, Helge Deller, Sasha Levin, tzimmermann, javierm,
linux-fbdev, dri-devel
From: Zheng Wang <zyytlz.wz@163.com>
[ Upstream commit c75f5a55061091030a13fef71b9995b89bc86213 ]
A use-after-free bug may occur if init_imstt invokes framebuffer_release
and free the info ptr. The caller, imsttfb_probe didn't notice that and
still keep the ptr as private data in pdev.
If we remove the driver which will call imsttfb_remove to make cleanup,
UAF happens.
Fix it by return error code if bad case happens in init_imstt.
Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/imsttfb.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
diff --git a/drivers/video/fbdev/imsttfb.c b/drivers/video/fbdev/imsttfb.c
index 16f272a508112..1b2fb8ed76237 100644
--- a/drivers/video/fbdev/imsttfb.c
+++ b/drivers/video/fbdev/imsttfb.c
@@ -1346,7 +1346,7 @@ static const struct fb_ops imsttfb_ops = {
.fb_ioctl = imsttfb_ioctl,
};
-static void init_imstt(struct fb_info *info)
+static int init_imstt(struct fb_info *info)
{
struct imstt_par *par = info->par;
__u32 i, tmp, *ip, *end;
@@ -1419,7 +1419,7 @@ static void init_imstt(struct fb_info *info)
|| !(compute_imstt_regvals(par, info->var.xres, info->var.yres))) {
printk("imsttfb: %ux%ux%u not supported\n", info->var.xres, info->var.yres, info->var.bits_per_pixel);
framebuffer_release(info);
- return;
+ return -ENODEV;
}
sprintf(info->fix.id, "IMS TT (%s)", par->ramdac == IBM ? "IBM" : "TVP");
@@ -1455,12 +1455,13 @@ static void init_imstt(struct fb_info *info)
if (register_framebuffer(info) < 0) {
framebuffer_release(info);
- return;
+ return -ENODEV;
}
tmp = (read_reg_le32(par->dc_regs, SSTATUS) & 0x0f00) >> 8;
fb_info(info, "%s frame buffer; %uMB vram; chip version %u\n",
info->fix.id, info->fix.smem_len >> 20, tmp);
+ return 0;
}
static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
@@ -1523,10 +1524,10 @@ static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
if (!par->cmap_regs)
goto error;
info->pseudo_palette = par->palette;
- init_imstt(info);
-
- pci_set_drvdata(pdev, info);
- return 0;
+ ret = init_imstt(info);
+ if (!ret)
+ pci_set_drvdata(pdev, info);
+ return ret;
error:
if (par->dc_regs)
--
2.39.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH AUTOSEL 5.15 08/11] fbdev: modedb: Add 1920x1080 at 60 Hz video mode
[not found] <20230520182215.845131-1-sashal@kernel.org>
2023-05-20 18:22 ` [PATCH AUTOSEL 5.15 07/11] fbdev: imsttfb: Fix use after free bug in imsttfb_probe Sasha Levin
@ 2023-05-20 18:22 ` Sasha Levin
2023-05-20 18:22 ` [PATCH AUTOSEL 5.15 09/11] fbdev: stifb: Fix info entry in sti_struct on error path Sasha Levin
2 siblings, 0 replies; 3+ messages in thread
From: Sasha Levin @ 2023-05-20 18:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Helge Deller, Sasha Levin, daniel, tzimmermann, javierm,
linux-fbdev, dri-devel
From: Helge Deller <deller@gmx.de>
[ Upstream commit c8902258b2b8ecaa1b8d88c312853c5b14c2553d ]
Add typical resolution for Full-HD monitors.
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/core/modedb.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/video/fbdev/core/modedb.c b/drivers/video/fbdev/core/modedb.c
index 6473e0dfe1464..e78ec7f728463 100644
--- a/drivers/video/fbdev/core/modedb.c
+++ b/drivers/video/fbdev/core/modedb.c
@@ -257,6 +257,11 @@ static const struct fb_videomode modedb[] = {
{ NULL, 72, 480, 300, 33386, 40, 24, 11, 19, 80, 3, 0,
FB_VMODE_DOUBLE },
+ /* 1920x1080 @ 60 Hz, 67.3 kHz hsync */
+ { NULL, 60, 1920, 1080, 6734, 148, 88, 36, 4, 44, 5, 0,
+ FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
+ FB_VMODE_NONINTERLACED },
+
/* 1920x1200 @ 60 Hz, 74.5 Khz hsync */
{ NULL, 60, 1920, 1200, 5177, 128, 336, 1, 38, 208, 3,
FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
--
2.39.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH AUTOSEL 5.15 09/11] fbdev: stifb: Fix info entry in sti_struct on error path
[not found] <20230520182215.845131-1-sashal@kernel.org>
2023-05-20 18:22 ` [PATCH AUTOSEL 5.15 07/11] fbdev: imsttfb: Fix use after free bug in imsttfb_probe Sasha Levin
2023-05-20 18:22 ` [PATCH AUTOSEL 5.15 08/11] fbdev: modedb: Add 1920x1080 at 60 Hz video mode Sasha Levin
@ 2023-05-20 18:22 ` Sasha Levin
2 siblings, 0 replies; 3+ messages in thread
From: Sasha Levin @ 2023-05-20 18:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Helge Deller, Sasha Levin, James.Bottomley, linux-parisc,
linux-fbdev, dri-devel
From: Helge Deller <deller@gmx.de>
[ Upstream commit 0bdf1ad8d10bd4e50a8b1a2c53d15984165f7fea ]
Minor fix to reset the info field to NULL in case of error.
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/stifb.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/video/fbdev/stifb.c b/drivers/video/fbdev/stifb.c
index ef8a4c5fc6875..63f51783352dc 100644
--- a/drivers/video/fbdev/stifb.c
+++ b/drivers/video/fbdev/stifb.c
@@ -1413,6 +1413,7 @@ static int __init stifb_init_fb(struct sti_struct *sti, int bpp_pref)
iounmap(info->screen_base);
out_err0:
kfree(fb);
+ sti->info = NULL;
return -ENXIO;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2023-05-20 18:25 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <20230520182215.845131-1-sashal@kernel.org>
2023-05-20 18:22 ` [PATCH AUTOSEL 5.15 07/11] fbdev: imsttfb: Fix use after free bug in imsttfb_probe Sasha Levin
2023-05-20 18:22 ` [PATCH AUTOSEL 5.15 08/11] fbdev: modedb: Add 1920x1080 at 60 Hz video mode Sasha Levin
2023-05-20 18:22 ` [PATCH AUTOSEL 5.15 09/11] fbdev: stifb: Fix info entry in sti_struct on error path Sasha Levin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).