On 9/9/26 21:10, Weiming Shi wrote:
FBIOGETCMAP takes a shallow snapshot of info->cmap and performs the
usercopy after dropping info->lock. vfb_remove() frees the colormap
immediately after unregistering the framebuffer, even when an open file
still holds a reference to fb_info. A concurrent driver unbind can
therefore free the colormap while the ioctl copies it to userspace.

KASAN reports:

   BUG: KASAN: slab-use-after-free in _copy_to_user
   Read of size 512 by task poc/125

    _copy_to_user (./include/linux/instrumented.h:129 
./include/linux/uaccess.h:201 lib/usercopy.c:24)
    fb_cmap_to_user (./include/linux/uaccess.h:230 
drivers/video/fbdev/core/fbcmap.c:211)
    do_fb_ioctl (drivers/video/fbdev/core/fb_chrdev.c:114)

    Allocated by task 1:
    fb_alloc_cmap_gfp (./include/linux/slab.h:973 ./include/linux/slab.h:1290 
drivers/video/fbdev/core/fbcmap.c:108)
    vfb_probe (drivers/video/fbdev/vfb.c:459)

    Freed by task 124:
    fb_dealloc_cmap (drivers/video/fbdev/core/fbcmap.c:151)
    vfb_remove (drivers/video/fbdev/vfb.c:489)

unregister_framebuffer() drops the registration reference, and fbdev calls
fb_destroy after the last put_fb_info(). Move the registered framebuffer's
cleanup into an fb_destroy callback so its colormap and screen buffer stay
alive until all file references have been released.

Fixes: 5e266e2e0e19 ("vfb: fix memory leaks in removal path")
Reported-by: [email protected]
Closes: 
https://lore.kernel.org/linux-fbdev/[email protected]/
Assisted-by: Codex:gpt-5
Signed-off-by: Weiming Shi <[email protected]>
---
  drivers/video/fbdev/vfb.c | 11 ++++++++---
  1 file changed, 8 insertions(+), 3 deletions(-)
applied.

Thanks!
Helge

Reply via email to