[PATCH] fbdev: core: Initialize modelist in framebuffer_alloc()

[PATCH] fbdev: core: Initialize modelist in framebuffer_alloc()

[Andrey Misiurov]

framebuffer_alloc() returns zeroed memory, so info->modelist starts out
with NULL next and prev pointers. The list head is initialized only
later, by fb_videomode_to_modelist() or by do_register_framebuffer().

The "fix potential memory leak" commits listed below added
fb_destroy_modelist(&info->modelist) to the probe error paths of s3fb,
tdfxfb, tridentfb, i740fb and carminefb. These paths can run before
the list head is initialized:

 - s3fb, tdfxfb, tridentfb and i740fb call fb_videomode_to_modelist()
   only after a successful EDID read, and tridentfb can also hit the
   error path on an ioremap() or kmalloc() failure before that;
 - carminefb jumps to the error path when fb_find_mode() fails, before
   its fb_videomode_to_modelist() call.

fb_destroy_modelist() then dereferences the NULL head. Reproduced on
Debian 12 (6.1.180) by binding s3fb to a VGA device without EDID and
forcing fb_alloc_cmap() to fail:

  s3fb 0000:00:03.0: cannot allocate colormap
  BUG: kernel NULL pointer dereference, address: 0000000000000000
  RIP: 0010:fb_destroy_modelist+0x10/0x80
  Call Trace:
   s3_pci_probe.cold+0x12b/0x2bf [s3fb]
   local_pci_probe+0x41/0x80
   pci_device_probe+0xc3/0x240
   really_probe+0xde/0x380
   __driver_probe_device+0x84/0x150
   driver_probe_device+0x1f/0x90
   __driver_attach+0xce/0x1c0
   bus_for_each_dev+0x87/0xd0
   bus_add_driver+0x1ae/0x200
   driver_register+0x89/0xe0
   do_one_initcall+0x59/0x220
   do_init_module+0x4a/0x1f0

Initialize the list head in framebuffer_alloc(), so info->modelist is
always a valid, possibly empty, list and fb_destroy_modelist() is safe
on every error path. Keep the lazy initialization in
do_register_framebuffer(), as drivers that embed struct fb_info rather
than calling framebuffer_alloc() still depend on it.

Fixes: 3b0ed04bc852 ("fbdev: s3fb: fix potential memory leak in s3_pci_probe()")
Fixes: bb019d755366 ("fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()")
Fixes: 7a35ec619d9a ("fbdev: tridentfb: fix potential memory leak in trident_pci_probe()")
Fixes: 5936063409af ("fbdev: i740fb: fix potential memory leak in i740fb_probe()")
Fixes: 6fcca16a2b19 ("fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()")
Cc: stable@vger.kernel.org
Signed-off-by: Andrey Misiurov <andrey.misyrov@gmail.com>
---
 drivers/video/fbdev/core/fb_info.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/video/fbdev/core/fb_info.c b/drivers/video/fbdev/core/fb_info.c
index 52f9bd2..05988a9 100644
--- a/drivers/video/fbdev/core/fb_info.c
+++ b/drivers/video/fbdev/core/fb_info.c
@@ -43,6 +43,7 @@ struct fb_info *framebuffer_alloc(size_t size, struct device *dev)
 	info->device = dev;
 	info->fbcon_rotate_hint = -1;
 	info->blank = FB_BLANK_UNBLANK;
+	INIT_LIST_HEAD(&info->modelist);
 
 #if IS_ENABLED(CONFIG_FB_BACKLIGHT)
 	mutex_init(&info->bl_curve_mutex);
-- 
2.43.7

Re: [PATCH] fbdev: core: Initialize modelist in framebuffer_alloc()

[Helge Deller]

On 10/12/26 19:53, Andrey Misiurov wrote:
> framebuffer_alloc() returns zeroed memory, so info->modelist starts out
> with NULL next and prev pointers. The list head is initialized only
> later, by fb_videomode_to_modelist() or by do_register_framebuffer().
> 
> The "fix potential memory leak" commits listed below added
> fb_destroy_modelist(&info->modelist) to the probe error paths of s3fb,
> tdfxfb, tridentfb, i740fb and carminefb. These paths can run before
> the list head is initialized:
> 
>   - s3fb, tdfxfb, tridentfb and i740fb call fb_videomode_to_modelist()
>     only after a successful EDID read, and tridentfb can also hit the
>     error path on an ioremap() or kmalloc() failure before that;
>   - carminefb jumps to the error path when fb_find_mode() fails, before
>     its fb_videomode_to_modelist() call.
> 
> fb_destroy_modelist() then dereferences the NULL head. Reproduced on
> Debian 12 (6.1.180) by binding s3fb to a VGA device without EDID and
> forcing fb_alloc_cmap() to fail:
> 
>    s3fb 0000:00:03.0: cannot allocate colormap
>    BUG: kernel NULL pointer dereference, address: 0000000000000000
>    RIP: 0010:fb_destroy_modelist+0x10/0x80
>    Call Trace:
>     s3_pci_probe.cold+0x12b/0x2bf [s3fb]
>     local_pci_probe+0x41/0x80
>     pci_device_probe+0xc3/0x240
>     really_probe+0xde/0x380
>     __driver_probe_device+0x84/0x150
>     driver_probe_device+0x1f/0x90
>     __driver_attach+0xce/0x1c0
>     bus_for_each_dev+0x87/0xd0
>     bus_add_driver+0x1ae/0x200
>     driver_register+0x89/0xe0
>     do_one_initcall+0x59/0x220
>     do_init_module+0x4a/0x1f0
> 
> Initialize the list head in framebuffer_alloc(), so info->modelist is
> always a valid, possibly empty, list and fb_destroy_modelist() is safe
> on every error path. Keep the lazy initialization in
> do_register_framebuffer(), as drivers that embed struct fb_info rather
> than calling framebuffer_alloc() still depend on it.
> 
> Fixes: 3b0ed04bc852 ("fbdev: s3fb: fix potential memory leak in s3_pci_probe()")
> Fixes: bb019d755366 ("fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()")
> Fixes: 7a35ec619d9a ("fbdev: tridentfb: fix potential memory leak in trident_pci_probe()")
> Fixes: 5936063409af ("fbdev: i740fb: fix potential memory leak in i740fb_probe()")
> Fixes: 6fcca16a2b19 ("fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Andrey Misiurov <andrey.misyrov@gmail.com>
> ---
>   drivers/video/fbdev/core/fb_info.c | 1 +
>   1 file changed, 1 insertion(+)
applied.

Thanks!
Helge