Commit 26580a96 authored Nov 18, 2024 by Thomas Zimmermann Committed by dinglongwei Nov 18, 2024

firmware: sysfb: Fix reference count of sysfb parent device

mainline inclusion
from mainline-v6.10-rc7
commit 3285d8f0a2ede604c368155c9c0921e16d41f70a
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR4KI
CVE: CVE-2024-46698

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3285d8f0a2ede604c368155c9c0921e16d41f70a



--------------------------------

Retrieving the system framebuffer's parent device in sysfb_init()
increments the parent device's reference count. Hence release the
reference before leaving the init function.

Adding the sysfb platform device acquires and additional reference
for the parent. This keeps the parent device around while the system
framebuffer is in use.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: 9eac534db001 ("firmware/sysfb: Set firmware-framebuffer parent device")
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Javier Martinez Canillas <javierm@redhat.com>
Cc: Helge Deller <deller@gmx.de>
Cc: Jani Nikula <jani.nikula@intel.com>
Cc: Dan Carpenter <dan.carpenter@linaro.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Sui Jingfeng <suijingfeng@loongson.cn>
Cc: <stable@vger.kernel.org> # v6.9+
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240625081818.15696-1-tzimmermann@suse.de


Signed-off-by: dinglongwei <dinglongwei1@huawei.com>

parent d524d9ea

drivers/firmware/sysfb.c

+8 −4

Original line number	Diff line number	Diff line
		@@ -108,8 +108,10 @@ static struct device sysfb_parent_dev(const struct screen_info si)
		if (IS_ERR(pdev)) {
		return ERR_CAST(pdev);
		} else if (pdev) {
		if (!sysfb_pci_dev_is_enabled(pdev))
		if (!sysfb_pci_dev_is_enabled(pdev)) {
		pci_dev_put(pdev);
		return ERR_PTR(-ENODEV);
		}
		return &pdev->dev;
		}

		@@ -144,7 +146,7 @@ static __init int sysfb_init(void)
		if (compatible) {
		pd = sysfb_create_simplefb(si, &mode, parent);
		if (!IS_ERR(pd))
		goto unlock_mutex;
		goto put_device;
		}

		/* if the FB is incompatible, create a legacy framebuffer device */
		@@ -162,7 +164,7 @@ static __init int sysfb_init(void)
		pd = platform_device_alloc(name, 0);
		if (!pd) {
		ret = -ENOMEM;
		goto unlock_mutex;
		goto put_device;
		}

		pd->dev.parent = parent;
		@@ -177,9 +179,11 @@ static __init int sysfb_init(void)
		if (ret)
		goto err;

		goto unlock_mutex;
		goto put_device;
		err:
		platform_device_put(pd);
		put_device:
		put_device(parent);
		unlock_mutex:
		mutex_unlock(&disable_lock);
		return ret;