[SRU Bionic 0/1] UBUNTU: SAUCE: fbdev: remove redundant lock_fb_info
Cengiz Can
cengiz.can at canonical.com
Fri Sep 23 22:31:23 UTC 2022
BugLink: https://bugs.launchpad.net/bugs/1990690
SRU Justification:
[Impact]
One of the fixing commits for CVE-2021-33655, commit 159a96b199b4
("fbcon: Prevent that screen size is smaller than font size")
introduced a redundant lock_fb_info line into the ioctl flow in fbmem.c.
Users belonging to video group may trigger a deadlock and potentially
lock the system.
```
============================================
WARNING: possible recursive locking detected
4.15.0-195-generic #206 Not tainted
--------------------------------------------
refresh/1248 is trying to acquire lock:
(&fb_info->lock){+.+.}, at: [<000000004c154cfe>] lock_fb_info+0x1d/0x40
but task is already holding lock:
(&fb_info->lock){+.+.}, at: [<000000004c154cfe>] lock_fb_info+0x1d/0x40
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&fb_info->lock);
lock(&fb_info->lock);
*** DEADLOCK ***
May be due to missing lock nesting notation
2 locks held by refresh/1248:
#0: (console_lock){+.+.}, at: [<000000008000aa2b>] do_fb_ioctl+0x435/0x5e0
#1: (&fb_info->lock){+.+.}, at: [<000000004c154cfe>] lock_fb_info+0x1d/0x40
```
[Test case]
Ran a sample framebuffer userspace test which calls FBIOPUT_VSCREENINFO.
Verified that deadlock is producible.
After removing redundant lock_fb_info, same test program no longer
causes a deadlock.
[Potential regressions]
There are no new potential regressions.
Cengiz Can (1):
UBUNTU: SAUCE: fbdev: remove redundant lock_fb_info
drivers/video/fbdev/core/fbmem.c | 1 -
1 file changed, 1 deletion(-)
--
2.34.1
More information about the kernel-team
mailing list