Files
linux-stable-mirror/drivers/video/fbdev/core/fbsysfs.c
T
Ian BridgesandHelge Deller 2c1c805c65 fbdev: fix use-after-free in store_modes()
store_modes() replaces a framebuffer's modelist with modes from userspace.
On success it frees the old modelist with fb_destroy_modelist(). Two
fields still point into that freed list.

One pointer is fb_display[i].mode, the mode a console is using.
fbcon_new_modelist() moves these pointers to the new list. It only does so
for consoles still mapped to the framebuffer. An unmapped console is
skipped and keeps its stale pointer. Unbinding fbcon, for example, sets
con2fb_map[i] to -1 but leaves fb_display[i].mode set. An
FBIOPUT_VSCREENINFO ioctl with FB_ACTIVATE_INV_MODE later reaches
fbcon_mode_deleted(). That function reads the stale fb_display[i].mode
through fb_mode_is_equal(). The read is a use-after-free.

The other pointer is fb_info->mode, the current mode. It is set through
the mode sysfs attribute. store_modes() does not update fb_info->mode, so
it is left pointing into the freed list. show_mode(), the attribute's read
handler, dereferences the stale fb_info->mode through mode_string(). The
read is a use-after-free.

Clear both pointers before freeing the list. Commit a1f3058930 ("fbcon:
Set fb_display[i]->mode to NULL when the mode is released") added the
helper fbcon_delete_modelist(). It clears every fb_display[i].mode that
points into a given list. So far it is called only from the unregister
path. Call it from store_modes() too, and set fb_info->mode to NULL.

Reported-by: syzbot+81c7c6b52649fd07299d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=81c7c6b52649fd07299d
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/ajjoDhAi2y4ArSlz@dev/
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Ian Bridges <icb@fastmail.org>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-06-26 14:56:13 +02:00

485 lines
12 KiB
C

// SPDX-License-Identifier: GPL-2.0-or-later
/*
* fbsysfs.c - framebuffer device class and attributes
*
* Copyright (c) 2004 James Simmons <jsimmons@infradead.org>
*/
#include <linux/console.h>
#include <linux/fb.h>
#include <linux/major.h>
#include "fb_internal.h"
#include "fbcon.h"
static int activate(struct fb_info *fb_info, struct fb_var_screeninfo *var)
{
int err;
var->activate |= FB_ACTIVATE_FORCE;
console_lock();
lock_fb_info(fb_info);
err = fb_set_var_from_user(fb_info, var);
unlock_fb_info(fb_info);
console_unlock();
if (err)
return err;
return 0;
}
static int mode_string(char *buf, unsigned int offset,
const struct fb_videomode *mode)
{
char m = 'U';
char v = 'p';
if (mode->flag & FB_MODE_IS_DETAILED)
m = 'D';
if (mode->flag & FB_MODE_IS_VESA)
m = 'V';
if (mode->flag & FB_MODE_IS_STANDARD)
m = 'S';
if (mode->vmode & FB_VMODE_INTERLACED)
v = 'i';
if (mode->vmode & FB_VMODE_DOUBLE)
v = 'd';
return snprintf(&buf[offset], PAGE_SIZE - offset, "%c:%dx%d%c-%d\n",
m, mode->xres, mode->yres, v, mode->refresh);
}
static ssize_t store_mode(struct device *device, struct device_attribute *attr,
const char *buf, size_t count)
{
struct fb_info *fb_info = dev_get_drvdata(device);
char mstr[100];
struct fb_var_screeninfo var;
struct fb_modelist *modelist;
struct fb_videomode *mode;
size_t i;
int err;
memset(&var, 0, sizeof(var));
list_for_each_entry(modelist, &fb_info->modelist, list) {
mode = &modelist->mode;
i = mode_string(mstr, 0, mode);
if (strncmp(mstr, buf, max(count, i)) == 0) {
var = fb_info->var;
fb_videomode_to_var(&var, mode);
if ((err = activate(fb_info, &var)))
return err;
fb_info->mode = mode;
return count;
}
}
return -EINVAL;
}
static ssize_t show_mode(struct device *device, struct device_attribute *attr,
char *buf)
{
struct fb_info *fb_info = dev_get_drvdata(device);
if (!fb_info->mode)
return 0;
return mode_string(buf, 0, fb_info->mode);
}
static ssize_t store_modes(struct device *device,
struct device_attribute *attr,
const char *buf, size_t count)
{
struct fb_info *fb_info = dev_get_drvdata(device);
LIST_HEAD(old_list);
int i = count / sizeof(struct fb_videomode);
if (i * sizeof(struct fb_videomode) != count)
return -EINVAL;
console_lock();
lock_fb_info(fb_info);
list_splice(&fb_info->modelist, &old_list);
fb_videomode_to_modelist((const struct fb_videomode *)buf, i,
&fb_info->modelist);
if (fb_new_modelist(fb_info)) {
fb_destroy_modelist(&fb_info->modelist);
list_splice(&old_list, &fb_info->modelist);
} else {
/*
* fb_display[i].mode and fb_info->mode both point into the old
* list. Clear them before it is freed.
*/
fbcon_delete_modelist(&old_list);
fb_info->mode = NULL;
fb_destroy_modelist(&old_list);
}
unlock_fb_info(fb_info);
console_unlock();
return 0;
}
static ssize_t show_modes(struct device *device, struct device_attribute *attr,
char *buf)
{
struct fb_info *fb_info = dev_get_drvdata(device);
unsigned int i;
struct fb_modelist *modelist;
const struct fb_videomode *mode;
i = 0;
list_for_each_entry(modelist, &fb_info->modelist, list) {
mode = &modelist->mode;
i += mode_string(buf, i, mode);
}
return i;
}
static ssize_t store_bpp(struct device *device, struct device_attribute *attr,
const char *buf, size_t count)
{
struct fb_info *fb_info = dev_get_drvdata(device);
struct fb_var_screeninfo var;
char ** last = NULL;
int err;
var = fb_info->var;
var.bits_per_pixel = simple_strtoul(buf, last, 0);
if ((err = activate(fb_info, &var)))
return err;
return count;
}
static ssize_t show_bpp(struct device *device, struct device_attribute *attr,
char *buf)
{
struct fb_info *fb_info = dev_get_drvdata(device);
return sysfs_emit(buf, "%d\n", fb_info->var.bits_per_pixel);
}
static ssize_t store_rotate(struct device *device,
struct device_attribute *attr,
const char *buf, size_t count)
{
struct fb_info *fb_info = dev_get_drvdata(device);
struct fb_var_screeninfo var;
char **last = NULL;
int err;
var = fb_info->var;
var.rotate = simple_strtoul(buf, last, 0);
if ((err = activate(fb_info, &var)))
return err;
return count;
}
static ssize_t show_rotate(struct device *device,
struct device_attribute *attr, char *buf)
{
struct fb_info *fb_info = dev_get_drvdata(device);
return sysfs_emit(buf, "%d\n", fb_info->var.rotate);
}
static ssize_t store_virtual(struct device *device,
struct device_attribute *attr,
const char *buf, size_t count)
{
struct fb_info *fb_info = dev_get_drvdata(device);
struct fb_var_screeninfo var;
char *last = NULL;
int err;
var = fb_info->var;
var.xres_virtual = simple_strtoul(buf, &last, 0);
last++;
if (last - buf >= count)
return -EINVAL;
var.yres_virtual = simple_strtoul(last, &last, 0);
if ((err = activate(fb_info, &var)))
return err;
return count;
}
static ssize_t show_virtual(struct device *device,
struct device_attribute *attr, char *buf)
{
struct fb_info *fb_info = dev_get_drvdata(device);
return sysfs_emit(buf, "%d,%d\n", fb_info->var.xres_virtual,
fb_info->var.yres_virtual);
}
static ssize_t show_stride(struct device *device,
struct device_attribute *attr, char *buf)
{
struct fb_info *fb_info = dev_get_drvdata(device);
return sysfs_emit(buf, "%d\n", fb_info->fix.line_length);
}
static ssize_t store_blank(struct device *device,
struct device_attribute *attr,
const char *buf, size_t count)
{
struct fb_info *fb_info = dev_get_drvdata(device);
char *last = NULL;
int err, arg;
arg = simple_strtoul(buf, &last, 0);
console_lock();
err = fb_blank_from_user(fb_info, arg);
console_unlock();
if (err < 0)
return err;
return count;
}
static ssize_t show_blank(struct device *device, struct device_attribute *attr, char *buf)
{
struct fb_info *fb_info = dev_get_drvdata(device);
return sysfs_emit(buf, "%d\n", fb_info->blank);
}
static ssize_t store_console(struct device *device,
struct device_attribute *attr,
const char *buf, size_t count)
{
// struct fb_info *fb_info = dev_get_drvdata(device);
return 0;
}
static ssize_t show_console(struct device *device,
struct device_attribute *attr, char *buf)
{
// struct fb_info *fb_info = dev_get_drvdata(device);
return 0;
}
static ssize_t store_cursor(struct device *device,
struct device_attribute *attr,
const char *buf, size_t count)
{
// struct fb_info *fb_info = dev_get_drvdata(device);
return 0;
}
static ssize_t show_cursor(struct device *device,
struct device_attribute *attr, char *buf)
{
// struct fb_info *fb_info = dev_get_drvdata(device);
return 0;
}
static ssize_t store_pan(struct device *device,
struct device_attribute *attr,
const char *buf, size_t count)
{
struct fb_info *fb_info = dev_get_drvdata(device);
struct fb_var_screeninfo var;
char *last = NULL;
int err;
var = fb_info->var;
var.xoffset = simple_strtoul(buf, &last, 0);
last++;
if (last - buf >= count)
return -EINVAL;
var.yoffset = simple_strtoul(last, &last, 0);
console_lock();
err = fb_pan_display(fb_info, &var);
console_unlock();
if (err < 0)
return err;
return count;
}
static ssize_t show_pan(struct device *device,
struct device_attribute *attr, char *buf)
{
struct fb_info *fb_info = dev_get_drvdata(device);
return sysfs_emit(buf, "%d,%d\n", fb_info->var.xoffset,
fb_info->var.yoffset);
}
static ssize_t show_name(struct device *device,
struct device_attribute *attr, char *buf)
{
struct fb_info *fb_info = dev_get_drvdata(device);
return sysfs_emit(buf, "%s\n", fb_info->fix.id);
}
static ssize_t store_fbstate(struct device *device,
struct device_attribute *attr,
const char *buf, size_t count)
{
struct fb_info *fb_info = dev_get_drvdata(device);
u32 state;
char *last = NULL;
state = simple_strtoul(buf, &last, 0);
console_lock();
lock_fb_info(fb_info);
fb_set_suspend(fb_info, (int)state);
unlock_fb_info(fb_info);
console_unlock();
return count;
}
static ssize_t show_fbstate(struct device *device,
struct device_attribute *attr, char *buf)
{
struct fb_info *fb_info = dev_get_drvdata(device);
return sysfs_emit(buf, "%d\n", fb_info->state);
}
#if IS_ENABLED(CONFIG_FB_BACKLIGHT)
static ssize_t store_bl_curve(struct device *device,
struct device_attribute *attr,
const char *buf, size_t count)
{
struct fb_info *fb_info = dev_get_drvdata(device);
u8 tmp_curve[FB_BACKLIGHT_LEVELS];
unsigned int i;
/* Some drivers don't use framebuffer_alloc(), but those also
* don't have backlights.
*/
if (!fb_info || !fb_info->bl_dev)
return -ENODEV;
if (count != (FB_BACKLIGHT_LEVELS / 8 * 24))
return -EINVAL;
for (i = 0; i < (FB_BACKLIGHT_LEVELS / 8); ++i)
if (sscanf(&buf[i * 24],
"%2hhx %2hhx %2hhx %2hhx %2hhx %2hhx %2hhx %2hhx\n",
&tmp_curve[i * 8 + 0],
&tmp_curve[i * 8 + 1],
&tmp_curve[i * 8 + 2],
&tmp_curve[i * 8 + 3],
&tmp_curve[i * 8 + 4],
&tmp_curve[i * 8 + 5],
&tmp_curve[i * 8 + 6],
&tmp_curve[i * 8 + 7]) != 8)
return -EINVAL;
/* If there has been an error in the input data, we won't
* reach this loop.
*/
mutex_lock(&fb_info->bl_curve_mutex);
for (i = 0; i < FB_BACKLIGHT_LEVELS; ++i)
fb_info->bl_curve[i] = tmp_curve[i];
mutex_unlock(&fb_info->bl_curve_mutex);
return count;
}
static ssize_t show_bl_curve(struct device *device,
struct device_attribute *attr, char *buf)
{
struct fb_info *fb_info = dev_get_drvdata(device);
ssize_t len = 0;
unsigned int i;
/* Some drivers don't use framebuffer_alloc(), but those also
* don't have backlights.
*/
if (!fb_info || !fb_info->bl_dev)
return -ENODEV;
mutex_lock(&fb_info->bl_curve_mutex);
for (i = 0; i < FB_BACKLIGHT_LEVELS; i += 8)
len += scnprintf(&buf[len], PAGE_SIZE - len, "%8ph\n",
fb_info->bl_curve + i);
mutex_unlock(&fb_info->bl_curve_mutex);
return len;
}
#endif
/* When cmap is added back in it should be a binary attribute
* not a text one. Consideration should also be given to converting
* fbdev to use configfs instead of sysfs */
static DEVICE_ATTR(bits_per_pixel, 0644, show_bpp, store_bpp);
static DEVICE_ATTR(blank, 0644, show_blank, store_blank);
static DEVICE_ATTR(console, 0644, show_console, store_console);
static DEVICE_ATTR(cursor, 0644, show_cursor, store_cursor);
static DEVICE_ATTR(mode, 0644, show_mode, store_mode);
static DEVICE_ATTR(modes, 0644, show_modes, store_modes);
static DEVICE_ATTR(pan, 0644, show_pan, store_pan);
static DEVICE_ATTR(virtual_size, 0644, show_virtual, store_virtual);
static DEVICE_ATTR(name, 0444, show_name, NULL);
static DEVICE_ATTR(stride, 0444, show_stride, NULL);
static DEVICE_ATTR(rotate, 0644, show_rotate, store_rotate);
static DEVICE_ATTR(state, 0644, show_fbstate, store_fbstate);
#if IS_ENABLED(CONFIG_FB_BACKLIGHT)
static DEVICE_ATTR(bl_curve, 0644, show_bl_curve, store_bl_curve);
#endif
static struct attribute *fb_device_attrs[] = {
&dev_attr_bits_per_pixel.attr,
&dev_attr_blank.attr,
&dev_attr_console.attr,
&dev_attr_cursor.attr,
&dev_attr_mode.attr,
&dev_attr_modes.attr,
&dev_attr_pan.attr,
&dev_attr_virtual_size.attr,
&dev_attr_name.attr,
&dev_attr_stride.attr,
&dev_attr_rotate.attr,
&dev_attr_state.attr,
#if IS_ENABLED(CONFIG_FB_BACKLIGHT)
&dev_attr_bl_curve.attr,
#endif
NULL,
};
ATTRIBUTE_GROUPS(fb_device);
int fb_device_create(struct fb_info *fb_info)
{
int node = fb_info->node;
dev_t devt = MKDEV(FB_MAJOR, node);
int ret;
fb_info->dev = device_create_with_groups(fb_class, fb_info->device, devt, fb_info,
fb_device_groups, "fb%d", node);
if (IS_ERR(fb_info->dev)) {
/* Not fatal */
ret = PTR_ERR(fb_info->dev);
pr_warn("Unable to create device for framebuffer %d; error %d\n", node, ret);
fb_info->dev = NULL;
}
return 0;
}
void fb_device_destroy(struct fb_info *fb_info)
{
dev_t devt = MKDEV(FB_MAJOR, fb_info->node);
if (!fb_info->dev)
return;
device_destroy(fb_class, devt);
fb_info->dev = NULL;
}