In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/client: fix restore of partially initialized client<\/p>\n
I got a null-ptr-deref report when closing a DRM file descriptor:<\/p>\n
WARNING: drivers\/gpu\/drm\/drm_atomic.c:2031 at
\n__drm_atomic_helper_set_config+0x18e\/0x1b0 [drm]<\/p>\n
Call Trace:
\ndrm_client_modeset_commit_atomic+0x16b\/0x220 [drm]
\ndrm_client_modeset_commit_locked+0x56\/0x160 [drm]
\ndrm_client_modeset_commit+0x21\/0x40 [drm]
\n__drm_fb_helper_restore_fbdev_mode_unlocked.part.0+0x7b\/0x80
\ndrm_fbdev_client_restore+0xe\/0x20 [drm_client_lib]
\ndrm_client_dev_restore+0x9f\/0xc0 [drm]
\ndrm_release+0xc5\/0xe0 [drm]<\/p>\n
The warning is followed by a NULL pointer dereference:<\/p>\n
BUG: kernel NULL pointer dereference, address: 0000000000000008<\/p>\n
RIP:
\n__drm_fb_helper_restore_fbdev_mode_unlocked.part.0+0x41\/0x80
\n[drm_kms_helper]<\/p>\n
Call Trace:
\ndrm_fbdev_client_restore+0xe\/0x20 [drm_client_lib]
\ndrm_client_dev_restore+0x9f\/0xc0 [drm]
\ndrm_release+0xc5\/0xe0 [drm]
\n__fput+0xdc\/0x2b0
\n__x64_sys_close+0x39\/0x80
\ndo_syscall_64+0x8d\/0x460
\nentry_SYSCALL_64_after_hwframe+0x76\/0x7e<\/p>\n
drm_client_register() adds the DRM client to the device client list
\nbefore invoking the initial hotplug callback. If the hotplug callback
\nfails, the client remains registered.<\/p>\n
For the fbdev client, a failure during drm_fb_helper_initial_config()
\ncauses the partially initialized fbdev helper to be cleaned up.
\ndrm_fb_helper_fini() releases fb_helper->info and leaves it NULL.<\/p>\n
The fbdev client therefore remains registered even though there is no
\nfully initialized framebuffer device.<\/p>\n
Later, when userspace closes the DRM file descriptor, drm_release()
\ncan invoke the restore callbacks of registered DRM clients:<\/p>\n
drm_release()
\ndrm_client_dev_restore()
\ndrm_fbdev_client_restore()
\ndrm_fb_helper_restore_fbdev_mode_unlocked()<\/p>\n
drm_fbdev_client_restore() currently restores the fbdev state
\nunconditionally. For a partially initialized fbdev client this can
\nsubmit an incomplete modeset state and subsequently access fbdev
\nstate which has not been initialized, resulting in the warning and
\nNULL pointer dereference above.<\/p>\n
drm_fbdev_client_unregister() already uses fb_helper->info to
\ndistinguish a fully probed framebuffer device from a partially
\ninitialized client.<\/p>\n
Use the same condition in drm_fbdev_client_restore() and skip restore
\nif no framebuffer device has been successfully initialized.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/client: fix restore of partially initialized client<\/p>\n
I got a null-ptr-deref report when closing a DRM file descriptor:<\/p>\n
WARNING<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-40995","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/40995","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=40995"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=40995"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=40995"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}