leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity
1c3dc1731e
linux/drivers/video/fbdev/core
History
Zhen Lei 0af778269a fbmem: Do not delete the mode that is still in use 
The execution of fb_delete_videomode() is not based on the result of the
previous fbcon_mode_deleted(). As a result, the mode is directly deleted,
regardless of whether it is still in use, which may cause UAF.

==================================================================
BUG: KASAN: use-after-free in fb_mode_is_equal+0x36e/0x5e0 \
drivers/video/fbdev/core/modedb.c:924
Read of size 4 at addr ffff88807e0ddb1c by task syz-executor.0/18962

CPU: 2 PID: 18962 Comm: syz-executor.0 Not tainted 5.10.45-rc1+ #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ...
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x137/0x1be lib/dump_stack.c:118
 print_address_description+0x6c/0x640 mm/kasan/report.c:385
 __kasan_report mm/kasan/report.c:545 [inline]
 kasan_report+0x13d/0x1e0 mm/kasan/report.c:562
 fb_mode_is_equal+0x36e/0x5e0 drivers/video/fbdev/core/modedb.c:924
 fbcon_mode_deleted+0x16a/0x220 drivers/video/fbdev/core/fbcon.c:2746
 fb_set_var+0x1e1/0xdb0 drivers/video/fbdev/core/fbmem.c:975
 do_fb_ioctl+0x4d9/0x6e0 drivers/video/fbdev/core/fbmem.c:1108
 vfs_ioctl fs/ioctl.c:48 [inline]
 __do_sys_ioctl fs/ioctl.c:753 [inline]
 __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:739
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Freed by task 18960:
 kasan_save_stack mm/kasan/common.c:48 [inline]
 kasan_set_track+0x3d/0x70 mm/kasan/common.c:56
 kasan_set_free_info+0x17/0x30 mm/kasan/generic.c:355
 __kasan_slab_free+0x108/0x140 mm/kasan/common.c:422
 slab_free_hook mm/slub.c:1541 [inline]
 slab_free_freelist_hook+0xd6/0x1a0 mm/slub.c:1574
 slab_free mm/slub.c:3139 [inline]
 kfree+0xca/0x3d0 mm/slub.c:4121
 fb_delete_videomode+0x56a/0x820 drivers/video/fbdev/core/modedb.c:1104
 fb_set_var+0x1f3/0xdb0 drivers/video/fbdev/core/fbmem.c:978
 do_fb_ioctl+0x4d9/0x6e0 drivers/video/fbdev/core/fbmem.c:1108
 vfs_ioctl fs/ioctl.c:48 [inline]
 __do_sys_ioctl fs/ioctl.c:753 [inline]
 __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:739
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fixes: 13ff178ccd ("fbcon: Call fbcon_mode_deleted/new_modelist directly")
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Cc: <stable@vger.kernel.org> # v5.3+
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20210712085544.2828-1-thunder.leizhen@huawei.com
2021-07-13 17:01:38 +02:00
..
bitblit.c fbcon: Drop EXPORT_SYMBOL 2020-11-17 11:00:43 +01:00
cfbcopyarea.c
cfbfillrect.c
cfbimgblt.c
fb_cmdline.c
fb_ddc.c
fb_defio.c Revert "fb_defio: Remove custom address_space_operations" 2021-06-01 17:38:40 +02:00
fb_draw.h
fb_notify.c video: fbdev: core: Fix kernel-doc warnings in fbmon + fb_notify 2020-12-08 18:31:56 +01:00
fb_sys_fops.c
fbcmap.c fbdev: zero-fill colormap in fbcmap.c 2021-04-10 11:12:08 +02:00
fbcon_ccw.c fbcon: Drop EXPORT_SYMBOL 2020-11-17 11:00:43 +01:00
fbcon_cw.c fbcon: Drop EXPORT_SYMBOL 2020-11-17 11:00:43 +01:00
fbcon_rotate.c fbcon: Drop EXPORT_SYMBOL 2020-11-17 11:00:43 +01:00
fbcon_rotate.h
fbcon_ud.c fbcon: Drop EXPORT_SYMBOL 2020-11-17 11:00:43 +01:00
fbcon.c tty: vt: always invoke vc->vc_sw->con_resize callback 2021-05-15 08:12:12 -07:00
fbcon.h drm-misc-fixes for v5.9: 2020-10-06 12:38:28 +10:00
fbcvt.c
fbmem.c fbmem: Do not delete the mode that is still in use 2021-07-13 17:01:38 +02:00
fbmon.c video: fbdev: core: Fix kernel-doc warnings in fbmon + fb_notify 2020-12-08 18:31:56 +01:00
fbsysfs.c fbmem: pull fbcon_update_vcs() out of fb_set_var() 2020-08-04 07:37:23 +02:00
Makefile
modedb.c
softcursor.c fbcon: Drop EXPORT_SYMBOL 2020-11-17 11:00:43 +01:00
svgalib.c
syscopyarea.c
sysfillrect.c
sysimgblt.c
tileblit.c fbcon: Drop EXPORT_SYMBOL 2020-11-17 11:00:43 +01:00