Quanmin Yan and Greg Kroah-Hartman
468f78276a
fbcon: Set fb_display[i]->mode to NULL when the mode is released
...
commit a1f3058930 upstream.
Recently, we discovered the following issue through syzkaller:
BUG: KASAN: slab-use-after-free in fb_mode_is_equal+0x285/0x2f0
Read of size 4 at addr ff11000001b3c69c by task syz.xxx
...
Call Trace:
<TASK>
dump_stack_lvl+0xab/0xe0
print_address_description.constprop.0+0x2c/0x390
print_report+0xb9/0x280
kasan_report+0xb8/0xf0
fb_mode_is_equal+0x285/0x2f0
fbcon_mode_deleted+0x129/0x180
fb_set_var+0xe7f/0x11d0
do_fb_ioctl+0x6a0/0x750
fb_ioctl+0xe0/0x140
__x64_sys_ioctl+0x193/0x210
do_syscall_64+0x5f/0x9c0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
Based on experimentation and analysis, during framebuffer unregistration,
only the memory of fb_info->modelist is freed, without setting the
corresponding fb_display[i]->mode to NULL for the freed modes. This leads
to UAF issues during subsequent accesses. Here's an example of reproduction
steps:
1. With /dev/fb0 already registered in the system, load a kernel module
to register a new device /dev/fb1;
2. Set fb1's mode to the global fb_display[] array (via FBIOPUT_CON2FBMAP);
3. Switch console from fb to VGA (to allow normal rmmod of the ko);
4. Unload the kernel module, at this point fb1's modelist is freed, leaving
a wild pointer in fb_display[];
5. Trigger the bug via system calls through fb0 attempting to delete a mode
from fb0.
Add a check in do_unregister_framebuffer(): if the mode to be freed exists
in fb_display[], set the corresponding mode pointer to NULL.
Signed-off-by: Quanmin Yan <yanquanmin1@huawei.com >
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de >
Signed-off-by: Helge Deller <deller@gmx.de >
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org >
2025-11-24 10:29:11 +01:00
..
2024-12-09 10:32:02 +01:00
2025-01-02 10:31:59 +01:00
2024-12-19 18:11:29 +01:00
2024-10-22 15:46:19 +02:00
2025-11-02 22:14:42 +09:00
2024-12-14 19:59:46 +01:00
2025-10-19 16:30:39 +02:00
2024-10-22 15:46:35 +02:00
2025-02-08 09:51:57 +01:00
2025-06-04 14:42:09 +02:00
2025-09-25 11:00:06 +02:00
2025-06-27 11:08:51 +01:00
2025-05-09 09:43:58 +02:00
2025-02-08 09:51:54 +01:00
2024-09-12 11:11:32 +02:00
2025-08-28 16:28:42 +02:00
2024-09-08 07:54:43 +02:00
2025-03-07 16:45:36 +01:00
2025-10-23 16:16:29 +02:00
2025-06-27 11:08:52 +01:00
2024-09-12 11:11:40 +02:00
2025-08-28 16:28:42 +02:00
2025-06-19 15:28:08 +02:00
2024-11-14 13:19:38 +01:00
2025-09-04 15:30:21 +02:00
2025-11-02 22:14:40 +09:00
2025-04-25 10:45:45 +02:00
2025-02-17 09:40:03 +01:00
2025-06-19 15:28:44 +02:00
2024-10-04 16:29:59 +02:00
2025-11-02 22:14:42 +09:00
2025-11-02 22:14:42 +09:00
2025-08-28 16:28:40 +02:00
2025-02-21 13:57:09 +01:00
2024-12-09 10:32:56 +01:00
2025-05-09 09:43:54 +02:00
2025-09-09 18:56:18 +02:00
2025-10-15 11:57:54 +02:00
2025-02-08 09:52:26 +01:00
2025-06-19 15:28:44 +02:00
2025-02-21 13:57:17 +01:00
2025-01-09 13:31:53 +01:00
2025-03-13 12:58:27 +01:00
2024-12-09 10:32:46 +01:00
2024-12-09 10:32:46 +01:00
2025-09-19 16:32:03 +02:00
2024-11-08 16:28:20 +01:00
2025-10-02 13:42:55 +02:00
2025-07-06 11:00:10 +02:00
2025-04-10 14:37:36 +02:00
2025-06-04 14:42:24 +02:00
2025-04-10 14:37:32 +02:00
2025-09-11 17:20:27 +02:00
2025-10-23 16:16:26 +02:00
2024-11-22 15:38:35 +01:00
2025-10-12 12:56:22 +02:00
2025-06-04 14:41:53 +02:00
2024-12-14 20:00:16 +01:00
2025-02-21 13:57:17 +01:00
2025-08-28 16:28:42 +02:00
2024-12-14 19:59:58 +01:00
2025-07-10 16:03:18 +02:00
2024-10-04 16:29:37 +02:00
2024-12-14 20:00:05 +01:00
2025-11-24 10:29:11 +01:00
2024-10-10 11:58:00 +02:00
2025-05-09 09:43:54 +02:00
2025-08-15 12:08:39 +02:00
2025-08-28 16:28:39 +02:00
2024-09-08 07:54:44 +02:00
2025-04-10 14:37:29 +02:00
2025-06-19 15:28:44 +02:00
2025-06-04 14:42:21 +02:00
2024-12-09 10:31:48 +01:00
2025-06-04 14:42:22 +02:00
2024-11-08 16:28:27 +01:00
2025-06-27 11:09:00 +01:00
2024-09-08 07:54:43 +02:00
2025-07-06 11:00:09 +02:00
2025-08-28 16:28:11 +02:00
2024-10-10 11:58:01 +02:00
2025-03-22 12:50:37 -07:00
2025-02-08 09:51:58 +01:00
2025-08-28 16:28:23 +02:00
2024-12-09 10:32:59 +01:00
2024-10-17 15:24:26 +02:00
2025-04-10 14:37:26 +02:00
2025-06-19 15:28:44 +02:00
2024-12-27 13:58:55 +01:00
2024-11-08 16:28:19 +01:00
2025-08-28 16:28:47 +02:00
2025-07-06 11:00:16 +02:00
2025-08-01 09:47:29 +01:00
2024-10-17 15:24:13 +02:00
2024-12-09 10:31:50 +01:00
2025-02-08 09:52:27 +01:00
2025-10-19 16:30:58 +02:00
2025-02-17 09:40:16 +01:00
2024-12-14 20:00:12 +01:00
2025-07-10 16:03:15 +02:00
2024-12-09 10:32:45 +01:00
2025-06-04 14:42:01 +02:00
2025-07-17 18:35:22 +02:00
2025-06-19 15:28:19 +02:00
2025-01-09 13:31:40 +01:00
2024-11-01 01:58:25 +01:00
2025-08-28 16:28:39 +02:00
2024-10-17 15:24:10 +02:00
2025-10-02 13:42:56 +02:00
2025-01-17 13:36:26 +01:00
2025-10-23 16:16:44 +02:00
2024-11-22 15:38:37 +01:00
2024-12-09 10:32:59 +01:00
2025-05-18 08:24:11 +02:00
2025-08-15 12:08:57 +02:00
2025-02-08 09:52:02 +01:00
2025-06-04 14:42:06 +02:00
2025-01-09 13:31:41 +01:00
2025-06-27 11:09:03 +01:00
2024-10-17 15:24:29 +02:00
2024-12-09 10:32:12 +01:00
2025-06-04 14:42:25 +02:00
2025-09-04 15:30:20 +02:00
2025-04-25 10:45:46 +02:00
2025-01-17 13:36:09 +01:00
2025-03-22 12:50:43 -07:00
2024-09-18 19:24:04 +02:00
2025-02-27 04:10:47 -08:00
2024-12-09 10:31:56 +01:00
2025-02-08 09:51:51 +01:00
2024-12-09 10:32:59 +01:00
2025-10-15 11:57:54 +02:00
2025-06-04 14:42:21 +02:00
2025-09-25 11:00:10 +02:00
2024-10-17 15:24:22 +02:00
2025-10-23 16:16:42 +02:00
2025-06-04 14:42:13 +02:00
2025-09-19 16:32:01 +02:00
2025-09-19 16:32:01 +02:00
2025-06-19 15:28:19 +02:00
2025-10-23 16:16:39 +02:00
2025-01-23 17:21:14 +01:00
2025-08-15 12:08:42 +02:00
2025-08-15 12:08:54 +02:00
2024-09-18 19:24:03 +02:00
2025-01-23 17:21:12 +01:00
2025-08-15 12:08:46 +02:00
2025-10-23 16:16:41 +02:00
2025-06-04 14:42:13 +02:00
2025-03-07 16:45:47 +01:00
2025-06-04 14:42:13 +02:00
2025-04-25 10:45:06 +02:00
2025-01-09 13:31:41 +01:00
2024-10-04 16:29:38 +02:00
2024-12-14 19:59:50 +01:00
2025-10-19 16:30:59 +02:00
2025-02-01 18:37:51 +01:00
2025-01-09 13:32:05 +01:00
2024-12-09 10:31:51 +01:00
2025-02-27 04:10:45 -08:00
2025-08-28 16:28:23 +02:00
2025-02-27 04:10:50 -08:00
2024-12-09 10:32:10 +01:00
2024-11-22 15:38:32 +01:00
2025-01-09 13:31:41 +01:00
2025-08-01 09:47:30 +01:00
2024-12-19 18:11:37 +01:00
2024-10-10 11:58:08 +02:00
2025-10-02 13:42:49 +02:00
2024-11-01 01:58:20 +01:00
2024-10-17 15:24:23 +02:00
2024-11-08 16:28:16 +01:00
2024-11-14 13:19:37 +01:00
2025-05-22 14:12:12 +02:00
2025-04-10 14:37:41 +02:00
2025-06-04 14:41:54 +02:00
2025-06-04 14:41:54 +02:00
2025-05-18 08:24:09 +02:00
2024-11-08 16:28:26 +01:00
2024-10-10 11:57:36 +02:00
2024-11-14 13:19:39 +01:00
2024-12-09 10:33:06 +01:00
2024-10-10 11:57:17 +02:00
2025-08-28 16:28:25 +02:00
2025-09-09 18:56:26 +02:00
2025-01-02 10:32:00 +01:00
2025-08-15 12:09:01 +02:00
2024-12-27 13:58:57 +01:00
2024-10-04 16:30:02 +02:00