tree 288cc729c754f28eb59608ac8c85b6fb1ded3b50
parent 1b929c02afd37871d5afb9d498426f83432e71c2
author Hang Zhang <zh.nvgt@gmail.com> 1672382128 -0800
committer Helge Deller <deller@gmx.de> 1672918602 +0100

fbdev: fbmem: prevent potential use-after-free issues with console_lock()

In do_fb_ioctl(), user specified "fb_info" can be freed in the callee
fbcon_get_con2fb_map_ioctl() -> set_con2fb_map() ->
con2fb_release_oldinfo(), this free operation is protected by
console_lock() in fbcon_set_con2fb_map_ioctl(), it also results in
the change of certain states such as "minfo->dead" in matroxfb_remove(),
so that it can be checked to avoid use-after-free before the use sites
(e.g., the check at the beginning of matroxfb_ioctl()). However,
the problem is that the use site is not protected by the same locks
as for the free operation, e.g., "default" case in do_fb_ioctl()
can lead to "matroxfb_ioctl()" but it's not protected by console_lock(),
which can invalidate the aforementioned state set and check in a
concurrent setting.

Prevent the potential use-after-free issues by protecting the "default"
case in do_fb_ioctl() with console_lock(), similarly as for many other
cases like "case FBIOBLANK" and "case FBIOPAN_DISPLAY".

Signed-off-by: Hang Zhang <zh.nvgt@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>