LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Tomi Valkeinen <tomi.valkeinen@ti.com>
Subject: [PATCH 3.10 17/50] video/logo: prevent use of logos after they have been freed
Date: Sun, 25 Jan 2015 10:07:07 -0800	[thread overview]
Message-ID: <20150125180703.545360665@linuxfoundation.org> (raw)
In-Reply-To: <20150125180702.521559311@linuxfoundation.org>

3.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tomi Valkeinen <tomi.valkeinen@ti.com>

commit 92b004d1aa9f367c372511ca0330f58216b25703 upstream.

If the probe of an fb driver has been deferred due to missing
dependencies, and the probe is later ran when a module is loaded, the
fbdev framework will try to find a logo to use.

However, the logos are __initdata, and have already been freed. This
causes sometimes page faults, if the logo memory is not mapped,
sometimes other random crashes as the logo data is invalid, and
sometimes nothing, if the fbdev decides to reject the logo (e.g. the
random value depicting the logo's height is too big).

This patch adds a late_initcall function to mark the logos as freed. In
reality the logos are freed later, and fbdev probe may be ran between
this late_initcall and the freeing of the logos. In that case we will
miss drawing the logo, even if it would be possible.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/video/logo/logo.c |   17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

--- a/drivers/video/logo/logo.c
+++ b/drivers/video/logo/logo.c
@@ -25,6 +25,21 @@ static bool nologo;
 module_param(nologo, bool, 0);
 MODULE_PARM_DESC(nologo, "Disables startup logo");
 
+/*
+ * Logos are located in the initdata, and will be freed in kernel_init.
+ * Use late_init to mark the logos as freed to prevent any further use.
+ */
+
+static bool logos_freed;
+
+static int __init fb_logo_late_init(void)
+{
+	logos_freed = true;
+	return 0;
+}
+
+late_initcall(fb_logo_late_init);
+
 /* logo's are marked __initdata. Use __init_refok to tell
  * modpost that it is intended that this function uses data
  * marked __initdata.
@@ -33,7 +48,7 @@ const struct linux_logo * __init_refok f
 {
 	const struct linux_logo *logo = NULL;
 
-	if (nologo)
+	if (nologo || logos_freed)
 		return NULL;
 
 	if (depth >= 1) {



  parent reply	other threads:[~2015-01-25 18:11 UTC|newest]

Thread overview: 53+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-01-25 18:06 [PATCH 3.10 00/50] 3.10.66-stable review Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.10 01/50] netlink: Always copy on mmap TX Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.10 02/50] netlink: Dont reorder loads/stores before marking mmap netlink frame as available Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.10 03/50] tg3: tg3_disable_ints using uninitialized mailbox value to disable interrupts Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.10 04/50] tcp: Do not apply TSO segment limit to non-TSO packets Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.10 05/50] alx: fix alx_poll() Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.10 06/50] enic: fix rx skb checksum Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.10 07/50] drm/vmwgfx: Fix fence event code Greg Kroah-Hartman
2015-01-25 18:06 ` [PATCH 3.10 09/50] drm/radeon: properly filter DP1.2 4k modes on non-DP1.2 hw Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 12/50] ARC: [nsimosci] move peripherals to match model to FPGA Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 13/50] cfg80211: Fix 160 MHz channels with 80+80 and 160 MHz drivers Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 14/50] hp_accel: Add support for HP ZBook 15 Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 15/50] iscsi-target: Fail connection on short sendmsg writes Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 16/50] storvsc: ring buffer failures may result in I/O freeze Greg Kroah-Hartman
2015-01-25 18:07 ` Greg Kroah-Hartman [this message]
2015-01-25 18:07 ` [PATCH 3.10 18/50] [media] smiapp-pll: Correct clock debug prints Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 20/50] [media] smiapp: Take mutex during PLL update in sensor initialisation Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 21/50] [media] uvcvideo: Fix destruction order in uvc_delete() Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 22/50] vfio-pci: Fix the check on pci device type in vfio_pci_probe() Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 23/50] ftrace/jprobes/x86: Fix conflict between jprobes and function graph tracing Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 24/50] NFSv4.1: Fix client id trunking on Linux Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 25/50] gpiolib: of: Correct error handling in of_get_named_gpiod_flags Greg Kroah-Hartman
2015-01-25 21:31   ` Guenter Roeck
2015-01-25 22:05     ` Greg Kroah-Hartman
2015-01-26  0:29       ` Guenter Roeck
2015-01-26 18:35         ` Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 26/50] OHCI: add a quirk for ULi M5237 blocking on reset Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 27/50] usb: dwc3: gadget: Fix TRB preparation during SG Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 28/50] usb: dwc3: gadget: Stop TRB preparation after limit is reached Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 29/50] USB: cp210x: fix ID for production CEL MeshConnect USB Stick Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 30/50] USB: cp210x: add IDs for CEL USB sticks and MeshWorks devices Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 31/50] USB: keyspan: fix null-deref at probe Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 32/50] can: kvaser_usb: Dont free packets when tight on URBs Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 33/50] can: kvaser_usb: Reset all URB tx contexts upon channel close Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 34/50] can: kvaser_usb: Dont send a RESET_CHIP for non-existing channels Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 36/50] Input: I8042 - add Acer Aspire 7738 to the nomux list Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 37/50] ARM: dts: imx25: Fix the SPI1 clocks Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 38/50] ARM: imx6q: drop unnecessary semicolon Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 39/50] ARM: clk-imx6q: fix video divider for rev T0 1.0 Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 40/50] ARM: omap5/dra7xx: Fix frequency typos Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 41/50] ARM: shmobile: sh73a0 legacy: Set .control_parent for all irqpin instances Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 42/50] decompress_bunzip2: off by one in get_next_block() Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 43/50] um: Skip futex_atomic_cmpxchg_inatomic() test Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 44/50] x86, um: actually mark system call tables readonly Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 45/50] LOCKD: Fix a race when initialising nlmsvc_timeout Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 46/50] mmc: sdhci: Fix sleep in atomic after inserting SD card Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 47/50] netfilter: ipset: small potential read beyond the end of buffer Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 48/50] fsnotify: next_i is freed during fsnotify_unmount_inodes Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 49/50] s390/3215: fix hanging console issue Greg Kroah-Hartman
2015-01-25 18:07 ` [PATCH 3.10 50/50] s390/3215: fix tty output containing tabs Greg Kroah-Hartman
2015-01-25 20:57 ` [PATCH 3.10 00/50] 3.10.66-stable review Guenter Roeck
2015-01-25 21:35 ` Guenter Roeck
2015-01-26 17:43 ` Shuah Khan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20150125180703.545360665@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=tomi.valkeinen@ti.com \
    --subject='Re: [PATCH 3.10 17/50] video/logo: prevent use of logos after they have been freed' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).