Thread (29 messages) 29 messages, 4 authors, 2022-05-11

Re: [PATCH v3 1/4] fbdev: Prevent possible use-after-free in fb_release()

From: Thomas Zimmermann <tzimmermann@suse.de>
Date: 2022-05-10 09:39:55
Also in: dri-devel, lkml

Hi Javier

Am 10.05.22 um 11:06 schrieb Javier Martinez Canillas:
Hello Thomas,

On 5/10/22 10:50, Thomas Zimmermann wrote:

[snip]
quoted
quoted
quoted
Drivers shouldn't really explicitly call this helper in my opinion.
One more stupid question: does armada actually use
drm_fbdev_fb_destroy()? It's supposed to be a callback for struct
fb_ops. Armada uses it's own instance of fb_ops, which apparently
doesn't contain fb_destroy. [1]
No stupid question at all. You are correct on this. So I guess we still
need this call in the drivers that don't provide a .fb_destroy() handler.

I see many options here:

1) Document in drm_fb_helper_alloc_fbi() that drivers only need to call
    drm_fb_helper_fini() explicitly if they are not setting up a fbdev
    with drm_fbdev_generic_setup(), otherwise is not needed.

2) Make drm_fbdev_fb_destroy() an exported symbol so drivers that have
    custom fb_ops can use it.

3) Set .fb_destroy to drm_fbdev_fb_destroy() if isn't set by drivers when
    they call drm_fb_helper_initial_config() or drm_fb_helper_fill_info().

I'm leaning towards option (3). Then the fb_info release will be automatic
whether drivers are using the generic setup or a custom one.
IMHO this would just be another glitch to paper over all the broken 
code. And if you follow through drm_fbdev_fb_helper(), [1] it'll call 
_fini at some point and probably blow up in some other way. Instances of 
struct fb_ops are also usually const.

The only reliable way AFAICT is to do what generic fbdev does: use 
unregister_framebuffer and do the software cleanup somewhere within 
fb_destroy. And then fix all drivers to use that pattern.

Best regards
Thomas

[1] 
https://elixir.bootlin.com/linux/v5.17.6/source/drivers/gpu/drm/drm_fb_helper.c#L2082
-- 
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Maxfeldstr. 5, 90409 Nürnberg, Germany
(HRB 36809, AG Nürnberg)
Geschäftsführer: Ivo Totev

Attachments

Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help