git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From 52b330799e2d6f825ae2bb74662ec1b10eb954bb Mon Sep 17 00:00:00 2001
   2 From: Jeongjun Park <aha310510@gmail.com>
   3 Date: Mon, 19 Jan 2026 17:25:53 +0900
   4 Subject: drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free
   5
   6 From: Jeongjun Park <aha310510@gmail.com>
   7
   8 commit 52b330799e2d6f825ae2bb74662ec1b10eb954bb upstream.
   9
  10 Exynos Virtual Display driver performs memory alloc/free operations
  11 without lock protection, which easily causes concurrency problem.
  12
  13 For example, use-after-free can occur in race scenario like this:
  14 ```
  15         CPU0                            CPU1                            CPU2
  16         ----                            ----                            ----
  17   vidi_connection_ioctl()
  18     if (vidi->connection) // true
  19       drm_edid = drm_edid_alloc(); // alloc drm_edid
  20       ...
  21       ctx->raw_edid = drm_edid;
  22       ...
  23                                                                 drm_mode_getconnector()
  24                                                                   drm_helper_probe_single_connector_modes()
  25                                                                     vidi_get_modes()
  26                                                                       if (ctx->raw_edid) // true
  27                                                                         drm_edid_dup(ctx->raw_edid);
  28                                                                           if (!drm_edid) // false
  29                                                                           ...
  30                                 vidi_connection_ioctl()
  31                                   if (vidi->connection) // false
  32                                     drm_edid_free(ctx->raw_edid); // free drm_edid
  33                                     ...
  34                                                                           drm_edid_alloc(drm_edid->edid)
  35                                                                             kmemdup(edid); // UAF!!
  36                                                                             ...
  37 ```
  38
  39 To prevent these vulns, at least in vidi_context, member variables related
  40 to memory alloc/free should be protected with ctx->lock.
  41
  42 Cc: <stable@vger.kernel.org>
  43 Signed-off-by: Jeongjun Park <aha310510@gmail.com>
  44 Signed-off-by: Inki Dae <inki.dae@samsung.com>
  45 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  46 ---
  47  drivers/gpu/drm/exynos/exynos_drm_vidi.c |   38 ++++++++++++++++++++++++++-----
  48  1 file changed, 32 insertions(+), 6 deletions(-)
  49
  50 --- a/drivers/gpu/drm/exynos/exynos_drm_vidi.c
  51 +++ b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
  52 @@ -186,29 +186,37 @@ static ssize_t vidi_store_connection(str
  53                                 const char *buf, size_t len)
  54  {
  55         struct vidi_context *ctx = dev_get_drvdata(dev);
  56 -       int ret;
  57 +       int ret, new_connected;
  58
  59 -       ret = kstrtoint(buf, 0, &ctx->connected);
  60 +       ret = kstrtoint(buf, 0, &new_connected);
  61         if (ret)
  62                 return ret;
  63 -
  64 -       if (ctx->connected > 1)
  65 +       if (new_connected > 1)
  66                 return -EINVAL;
  67
  68 +       mutex_lock(&ctx->lock);
  69 +
  70         /*
  71          * Use fake edid data for test. If raw_edid is set then it can't be
  72          * tested.
  73          */
  74         if (ctx->raw_edid) {
  75                 DRM_DEV_DEBUG_KMS(dev, "edid data is not fake data.\n");
  76 -               return -EINVAL;
  77 +               ret = -EINVAL;
  78 +               goto fail;
  79         }
  80
  81 +       ctx->connected = new_connected;
  82 +       mutex_unlock(&ctx->lock);
  83 +
  84         DRM_DEV_DEBUG_KMS(dev, "requested connection.\n");
  85
  86         drm_helper_hpd_irq_event(ctx->drm_dev);
  87
  88         return len;
  89 +fail:
  90 +       mutex_unlock(&ctx->lock);
  91 +       return ret;
  92  }
  93
  94  static DEVICE_ATTR(connection, 0644, vidi_show_connection,
  95 @@ -238,11 +246,14 @@ int vidi_connection_ioctl(struct drm_dev
  96                 return -EINVAL;
  97         }
  98
  99 +       mutex_lock(&ctx->lock);
 100         if (ctx->connected == vidi->connection) {
 101 +               mutex_unlock(&ctx->lock);
 102                 DRM_DEV_DEBUG_KMS(ctx->dev,
 103                                   "same connection request.\n");
 104                 return -EINVAL;
 105         }
 106 +       mutex_unlock(&ctx->lock);
 107
 108         if (vidi->connection) {
 109                 const struct drm_edid *drm_edid;
 110 @@ -262,14 +273,21 @@ int vidi_connection_ioctl(struct drm_dev
 111                                           "edid data is invalid.\n");
 112                         return -EINVAL;
 113                 }
 114 +               mutex_lock(&ctx->lock);
 115                 ctx->raw_edid = drm_edid;
 116 +               mutex_unlock(&ctx->lock);
 117         } else {
 118                 /* with connection = 0, free raw_edid */
 119 +               mutex_lock(&ctx->lock);
 120                 drm_edid_free(ctx->raw_edid);
 121                 ctx->raw_edid = NULL;
 122 +               mutex_unlock(&ctx->lock);
 123         }
 124
 125 +       mutex_lock(&ctx->lock);
 126         ctx->connected = vidi->connection;
 127 +       mutex_unlock(&ctx->lock);
 128 +
 129         drm_helper_hpd_irq_event(ctx->drm_dev);
 130
 131         return 0;
 132 @@ -284,7 +302,7 @@ static enum drm_connector_status vidi_de
 133          * connection request would come from user side
 134          * to do hotplug through specific ioctl.
 135          */
 136 -       return ctx->connected ? connector_status_connected :
 137 +       return READ_ONCE(ctx->connected) ? connector_status_connected :
 138                         connector_status_disconnected;
 139  }
 140
 141 @@ -307,11 +325,15 @@ static int vidi_get_modes(struct drm_con
 142         const struct drm_edid *drm_edid;
 143         int count;
 144
 145 +       mutex_lock(&ctx->lock);
 146 +
 147         if (ctx->raw_edid)
 148                 drm_edid = drm_edid_dup(ctx->raw_edid);
 149         else
 150                 drm_edid = drm_edid_alloc(fake_edid_info, sizeof(fake_edid_info));
 151
 152 +       mutex_unlock(&ctx->lock);
 153 +
 154         drm_edid_connector_update(connector, drm_edid);
 155
 156         count = drm_edid_connector_add_modes(connector);
 157 @@ -456,9 +478,13 @@ static void vidi_remove(struct platform_
 158  {
 159         struct vidi_context *ctx = platform_get_drvdata(pdev);
 160
 161 +       mutex_lock(&ctx->lock);
 162 +
 163         drm_edid_free(ctx->raw_edid);
 164         ctx->raw_edid = NULL;
 165
 166 +       mutex_unlock(&ctx->lock);
 167 +
 168         component_del(&pdev->dev, &vidi_component_ops);
 169  }
 170