Thomas Zimmermann 482330f826 drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup ...

[ Upstream commit eb76d0f555 ]

Protect vga_switcheroo_client_fb_set() with console lock. Avoids OOB
access in fbcon_remap_all(). Without holding the console lock the call
races with switching outputs.

VGA switcheroo calls fbcon_remap_all() when switching clients. The fbcon
function uses struct fb_info.node, which is set by register_framebuffer().
As the fb-helper code currently sets up VGA switcheroo before registering
the framebuffer, the value of node is -1 and therefore not a legal value.
For example, fbcon uses the value within set_con2fb_map() [1] as an index
into an array.

Moving vga_switcheroo_client_fb_set() after register_framebuffer() can
result in VGA switching that does not switch fbcon correctly.

Therefore move vga_switcheroo_client_fb_set() under fbcon_fb_registered(),
which already holds the console lock. Fbdev calls fbcon_fb_registered()
from within register_framebuffer(). Serializes the helper with VGA
switcheroo's call to fbcon_remap_all().

Although vga_switcheroo_client_fb_set() takes an instance of struct fb_info
as parameter, it really only needs the contained fbcon state. Moving the
call to fbcon initialization is therefore cleaner than before. Only amdgpu,
i915, nouveau and radeon support vga_switcheroo. For all other drivers,
this change does nothing.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://elixir.bootlin.com/linux/v6.17/source/drivers/video/fbdev/core/fbcon.c#L2942 # [1]
Fixes: 6a9ee8af34 ("vga_switcheroo: initial implementation (v15)")
Acked-by: Javier Martinez Canillas <javierm@redhat.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Cc: dri-devel@lists.freedesktop.org
Cc: nouveau@lists.freedesktop.org
Cc: amd-gfx@lists.freedesktop.org
Cc: linux-fbdev@vger.kernel.org
Cc: <stable@vger.kernel.org> # v2.6.34+
Link: https://patch.msgid.link/20251105161549.98836-1-tzimmermann@suse.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2025-12-07 06:25:03 +09:00

..

bitblit.c

…

cfbcopyarea.c

…

cfbfillrect.c

…

cfbimgblt.c

…

fb_backlight.c

…

fb_chrdev.c

…

fb_cmdline.c

…

fb_ddc.c

…

fb_defio.c

…

fb_draw.h

…

fb_info.c

…

fb_internal.h

…

fb_io_fops.c

…

fb_logo.c

…

fb_notify.c

…

fb_procfs.c

…

fb_sys_fops.c

…

fbcmap.c

…

fbcon_ccw.c

…

fbcon_cw.c

…

fbcon_rotate.c

…

fbcon_rotate.h

…

fbcon_ud.c

…

fbcon.c

…

fbcon.h

…

fbcvt.c

…

fbmem.c

…

fbmon.c

…

fbsysfs.c

…

Kconfig

…

Makefile

…

modedb.c

…

softcursor.c

…

svgalib.c

…

syscopyarea.c

…

sysfillrect.c

…

sysimgblt.c

…

tileblit.c

…