kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
No description
1,164,980 commits 117 branches 5,799 tags 5.6 GiB
  • C 96.9%
  • Assembly 0.9%
  • Rust 0.6%
  • Shell 0.6%
  • Python 0.5%
  • Other 0.3%
Find a file
Quanmin Yan 4ac18f0e6a fbcon: Set fb_display[i]->mode to NULL when the mode is released 
commit a1f3058930 upstream.

Recently, we discovered the following issue through syzkaller:

BUG: KASAN: slab-use-after-free in fb_mode_is_equal+0x285/0x2f0
Read of size 4 at addr ff11000001b3c69c by task syz.xxx
...
Call Trace:
 <TASK>
 dump_stack_lvl+0xab/0xe0
 print_address_description.constprop.0+0x2c/0x390
 print_report+0xb9/0x280
 kasan_report+0xb8/0xf0
 fb_mode_is_equal+0x285/0x2f0
 fbcon_mode_deleted+0x129/0x180
 fb_set_var+0xe7f/0x11d0
 do_fb_ioctl+0x6a0/0x750
 fb_ioctl+0xe0/0x140
 __x64_sys_ioctl+0x193/0x210
 do_syscall_64+0x5f/0x9c0
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Based on experimentation and analysis, during framebuffer unregistration,
only the memory of fb_info->modelist is freed, without setting the
corresponding fb_display[i]->mode to NULL for the freed modes. This leads
to UAF issues during subsequent accesses. Here's an example of reproduction
steps:
1. With /dev/fb0 already registered in the system, load a kernel module
   to register a new device /dev/fb1;
2. Set fb1's mode to the global fb_display[] array (via FBIOPUT_CON2FBMAP);
3. Switch console from fb to VGA (to allow normal rmmod of the ko);
4. Unload the kernel module, at this point fb1's modelist is freed, leaving
   a wild pointer in fb_display[];
5. Trigger the bug via system calls through fb0 attempting to delete a mode
   from fb0.

Add a check in do_unregister_framebuffer(): if the mode to be freed exists
in fb_display[], set the corresponding mode pointer to NULL.

Signed-off-by: Quanmin Yan <yanquanmin1@huawei.com>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-12-07 06:12:10 +09:00
arch arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c 2025-12-07 06:12:09 +09:00
block blk-crypto: fix missing blktrace bio split events 2025-10-19 16:23:12 +02:00
certs sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3 2025-04-25 10:44:04 +02:00
crypto crypto: essiv - Check ssize for decryption and in-place encryption 2025-10-19 16:23:10 +02:00
Documentation xhci: dbc: Allow users to modify DbC poll interval via sysfs 2025-12-07 06:12:10 +09:00
drivers fbcon: Set fb_display[i]->mode to NULL when the mode is released 2025-12-07 06:12:10 +09:00
fs NFSD: Fix crash in nfsd4_read_release() 2025-12-07 06:12:10 +09:00
include fbcon: Set fb_display[i]->mode to NULL when the mode is released 2025-12-07 06:12:10 +09:00
init init: handle bootloader identifier in kernel parameters 2025-10-19 16:23:13 +02:00
io_uring io_uring: correct __must_hold annotation in io_install_fixed_file 2025-10-29 14:04:38 +01:00
ipc ipc: fix to protect IPCS lookups using RCU 2025-06-27 11:07:30 +01:00
kernel perf: Have get_perf_callchain() return NULL if crosstask and user are set 2025-12-07 06:12:09 +09:00
lib asm-generic/io: Add _RET_IP_ to MMIO trace for more accurate debug info 2025-10-19 16:23:22 +02:00
LICENSES LICENSES/LGPL-2.1: Add LGPL-2.1-or-later as valid identifiers 2021-12-16 14:33:10 +01:00
mm mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 2025-10-19 16:23:18 +02:00
net mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR 2025-12-07 06:12:09 +09:00
rust mm/ksm: fix flag-dropping behavior in ksm_madvise 2025-10-29 14:04:43 +01:00
samples ftrace/samples: Fix function size computation 2025-09-19 16:29:56 +02:00
scripts gcc-plugins: Remove TODO_verify_il for GCC >= 16 2025-10-15 11:56:20 +02:00
security KEYS: trusted_tpm1: Compare HMAC values in constant time 2025-10-19 16:23:14 +02:00
sound ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card 2025-10-29 14:04:35 +01:00
tools selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported 2025-12-07 06:12:10 +09:00
usr kbuild: hdrcheck: fix cross build with clang 2025-06-27 11:07:25 +01:00
virt KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() 2024-06-27 13:46:21 +02:00
.clang-format inet: ping: use hlist_nulls rcu iterator during lookup 2022-12-01 12:42:46 +01:00
.cocciconfig scripts: add Linux .cocciconfig for coccinelle 2016-07-22 12:13:39 +02:00
.get_maintainer.ignore get_maintainer: add Alan to .get_maintainer.ignore 2022-08-20 15:17:44 -07:00
.gitattributes .gitattributes: use 'dts' diff driver for dts files 2019-12-04 19:44:11 -08:00
.gitignore Remove *.orig pattern from .gitignore 2024-10-17 15:21:15 +02:00
.mailmap 9 hotfixes. 6 for MM, 3 for other areas. Four of these patches address 2022-12-10 17:10:52 -08:00
.rustfmt.toml rust: add .rustfmt.toml 2022-09-28 09:02:20 +02:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS MAINTAINERS: Remove Michal Marek from Kbuild maintainers 2022-11-16 14:53:00 +09:00
Kbuild Kbuild updates for v6.1 2022-10-10 12:00:45 -07:00
Kconfig kbuild: ensure full rebuild when the compiler is updated 2020-05-12 13:28:33 +09:00
MAINTAINERS sign-file,extract-cert: move common SSL helper functions to a header 2025-04-25 10:44:04 +02:00
Makefile Linux 6.1.158 2025-10-29 14:04:43 +01:00
README Drop all 00-INDEX files from Documentation/ 2018-09-09 15:08:58 -06:00

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.