• Thomas Zimmermann's avatar
    drm/aperture: Run fbdev removal before internal helpers · 84499c5d
    Thomas Zimmermann authored
    Always run fbdev removal first to remove simpledrm via sysfb_disable().
    This clears the internal state.
    
    The later call to drm_aperture_detach_drivers() then does nothing.
    Otherwise, with drm_aperture_detach_drivers() running first, the call to
    sysfb_disable() uses inconsistent state.
    
    Example backtrace show below:
    
      BUG: KASAN: use-after-free in device_del+0x79/0x5f0
      Read of size 8 at addr ffff888108185050 by task systemd-udevd/311
      CPU: 0 PID: 311 Comm: systemd-udevd Tainted: G            E     5.19.0-rc2-1-default+ #1689
      Hardware name: HP ProLiant DL120 G7, BIOS J01 04/21/2011
      Call Trace:
        device_del+0x79/0x5f0
        platform_device_del.part.0+0x19/0xe0
        platform_device_unregister+0x1c/0x30
        sysfb_disable+0x2d/0x70
        remove_conflicting_framebuffers+0x1c/0xf0
        remove_conflicting_pci_framebuffers+0x130/0x1a0
        drm_aperture_remove_conflicting_pci_framebuffers+0x86/0xb0
        mgag200_pci_probe+0x2d/0x140 [mgag200]
    Signed-off-by: default avatarThomas Zimmermann <tzimmermann@suse.de>
    Fixes: 873eb3b1 ("fbdev: Disable sysfb device registration when removing conflicting FBs")
    Cc: Javier Martinez Canillas <javierm@redhat.com>
    Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
    Cc: Daniel Vetter <daniel@ffwll.ch>
    Cc: Sam Ravnborg <sam@ravnborg.org>
    Cc: Helge Deller <deller@gmx.de>
    Cc: Thomas Zimmermann <tzimmermann@suse.de>
    Cc: Alex Deucher <alexander.deucher@amd.com>
    Cc: Zhen Lei <thunder.leizhen@huawei.com>
    Cc: Changcheng Deng <deng.changcheng@zte.com.cn>
    Reviewed-by: default avatarZack Rusin <zackr@vmware.com>
    Reviewed-by: default avatarJavier Martinez Canillas <javierm@redhat.com>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    84499c5d
drm_aperture.c 10.4 KB