• Thomas Zimmermann's avatar
    drm/aperture: Run fbdev removal before internal helpers · bf43e452
    Thomas Zimmermann authored
    Always run fbdev removal first to remove simpledrm via
    sysfb_disable(). This clears the internal state. The later call
    to drm_aperture_detach_drivers() then does nothing. Otherwise,
    with drm_aperture_detach_drivers() running first, the call to
    sysfb_disable() uses inconsistent state.
    
    Example backtrace show below:
    
    [   11.663422] ==================================================================
    [   11.663426] BUG: KASAN: use-after-free in device_del+0x79/0x5f0
    [   11.663435] Read of size 8 at addr ffff888108185050 by task systemd-udevd/311
    [   11.663440] CPU: 0 PID: 311 Comm: systemd-udevd Tainted: G            E     5
    	.19.0-rc2-1-default+ #1689
    [   11.663445] Hardware name: HP ProLiant DL120 G7, BIOS J01 04/21/2011
    [   11.663447] Call Trace:
    [   11.663449]  <TASK>
    [   11.663451]  ? device_del+0x79/0x5f0
    [   11.663456]  dump_stack_lvl+0x5b/0x73
    [   11.663462]  print_address_description.constprop.0+0x1f/0x1b0
    [   11.663468]  ? device_del+0x79/0x5f0
    [   11.663471]  ? device_del+0x79/0x5f0
    [   11.663475]  print_report.cold+0x3c/0x21c
    [   11.663481]  ? lock_acquired+0x87/0x1e0
    [   11.663484]  ? lock_acquired+0x87/0x1e0
    [   11.663489]  ? device_del+0x79/0x5f0
    [   11.663492]  kasan_report+0xbf/0xf0
    [   11.663498]  ? device_del+0x79/0x5f0
    [   11.663503]  device_del+0x79/0x5f0
    [   11.663509]  ? device_remove_attrs+0x170/0x170
    [   11.663514]  ? lock_is_held_type+0xe8/0x140
    [   11.663523]  platform_device_del.part.0+0x19/0xe0
    [   11.663530]  platform_device_unregister+0x1c/0x30
    [   11.663535]  sysfb_disable+0x2d/0x70
    [   11.663540]  remove_conflicting_framebuffers+0x1c/0xf0
    [   11.663546]  remove_conflicting_pci_framebuffers+0x130/0x1a0
    [   11.663554]  drm_aperture_remove_conflicting_pci_framebuffers+0x86/0xb0
    [   11.663561]  ? mgag200_pci_remove+0x30/0x30 [mgag200]
    [   11.663578]  mgag200_pci_probe+0x2d/0x140 [mgag200]
    Reported-by: default avatarZack Rusin <zackr@vmware.com>
    Signed-off-by: default avatarThomas Zimmermann <tzimmermann@suse.de>
    Reviewed-by: default avatarJavier Martinez Canillas <javierm@redhat.com>
    Reviewed-by: default avatarZack Rusin <zackr@vmware.com>
    Fixes: ee7a69aa ("fbdev: Disable sysfb device registration when removing conflicting FBs")
    Cc: Javier Martinez Canillas <javierm@redhat.com>
    Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
    Cc: Daniel Vetter <daniel@ffwll.ch>
    Cc: Sam Ravnborg <sam@ravnborg.org>
    Cc: Helge Deller <deller@gmx.de>
    Cc: Thomas Zimmermann <tzimmermann@suse.de>
    Cc: Alex Deucher <alexander.deucher@amd.com>
    Cc: Zhen Lei <thunder.leizhen@huawei.com>
    Cc: Changcheng Deng <deng.changcheng@zte.com.cn>
    Link: https://patchwork.freedesktop.org/patch/msgid/20220617121027.30273-1-tzimmermann@suse.de
    (cherry picked from commit fb84efa2)
    Signed-off-by: default avatarThomas Zimmermann <tzimmermann@suse.de>
    bf43e452
drm_aperture.c 10.4 KB