Re: [Nouveau] [PATCH] drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create

2023-08-17 Thread Borislav Petkov
On Thu, Aug 17, 2023 at 12:24:45PM +0200, Karol Herbst wrote: > simply throw a > > printk(KERN_WARNING "nvkm_uconn_uevent %u\n", outp->info.location); > > inside drivers/gpu/drm/nouveau/nvkm/engine/disp/uconn.c:104 after that > mentioned comment. diff --git

Re: [Nouveau] [PATCH] drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create

2023-08-17 Thread Karol Herbst
On Thu, Aug 17, 2023 at 12:11 PM Borislav Petkov wrote: > > On Thu, Aug 17, 2023 at 12:00:47PM +0200, Karol Herbst wrote: > > btw, what would help is to know where `nvkm_uconn_uevent` actually > > fails, or rather, are you running into this "/* TODO: support DP IRQ > > on ANX9805 and remove this

Re: [Nouveau] [PATCH] drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create

2023-08-17 Thread Borislav Petkov
On Thu, Aug 17, 2023 at 12:00:47PM +0200, Karol Herbst wrote: > btw, what would help is to know where `nvkm_uconn_uevent` actually > fails, or rather, are you running into this "/* TODO: support DP IRQ > on ANX9805 and remove this hack. */" condition? Send me a diff, I'll run it here and catch

Re: [Nouveau] [PATCH] drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create

2023-08-17 Thread Karol Herbst
On Thu, Aug 17, 2023 at 11:58 AM Karol Herbst wrote: > > On Thu, Aug 17, 2023 at 10:10 AM Borislav Petkov wrote: > > > > On Thu, Aug 17, 2023 at 01:18:12AM +0200, Karol Herbst wrote: > > > do you have one of these? https://en.wikipedia.org/wiki/DMS-59 > > > > Ah, DMS == Dual Monitor Solution :-)

Re: [Nouveau] [PATCH] drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create

2023-08-17 Thread Karol Herbst
On Thu, Aug 17, 2023 at 10:10 AM Borislav Petkov wrote: > > On Thu, Aug 17, 2023 at 01:18:12AM +0200, Karol Herbst wrote: > > do you have one of these? https://en.wikipedia.org/wiki/DMS-59 > > Ah, DMS == Dual Monitor Solution :-) > > Yap, that's exactly what the GPU has. And the Y-cable is 2xDVI.

Re: [Nouveau] [PATCH] drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create

2023-08-17 Thread Borislav Petkov
On Thu, Aug 17, 2023 at 01:18:12AM +0200, Karol Herbst wrote: > do you have one of these? https://en.wikipedia.org/wiki/DMS-59 Ah, DMS == Dual Monitor Solution :-) Yap, that's exactly what the GPU has. And the Y-cable is 2xDVI. It is a Dell workstation and it came this way, meaning I haven't

Re: [Nouveau] [PATCH] drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create

2023-08-16 Thread Karol Herbst
On Thu, Aug 17, 2023 at 12:14 AM Borislav Petkov wrote: > > On Wed, Aug 16, 2023 at 11:27:05PM +0200, Karol Herbst wrote: > > that GPU has only a `DMS-59` connector, is that right? > > No clue. How do I figure that out? > do you have one of these? https://en.wikipedia.org/wiki/DMS-59 > -- >

Re: [Nouveau] [PATCH] drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create

2023-08-16 Thread Borislav Petkov
On Wed, Aug 16, 2023 at 11:27:05PM +0200, Karol Herbst wrote: > that GPU has only a `DMS-59` connector, is that right? No clue. How do I figure that out? -- Regards/Gruss, Boris. https://people.kernel.org/tglx/notes-about-netiquette

Re: [Nouveau] [PATCH] drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create

2023-08-16 Thread Karol Herbst
On Wed, Aug 16, 2023 at 5:13 PM Borislav Petkov wrote: > > On Wed, Aug 16, 2023 at 04:57:28PM +0200, Karol Herbst wrote: > > Do you have any connectors listed in "/sys/class/drm"? > > tree /sys/class/drm/ > /sys/class/drm/ > ├── card0 ->

Re: [Nouveau] [PATCH] drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create

2023-08-16 Thread Lyude Paul
Reviewed-by: Lyude Paul On Mon, 2023-08-14 at 16:49 +0200, Karol Herbst wrote: > We can't simply free the connector after calling drm_connector_init on it. > We need to clean up the drm side first. > > It might not fix all regressions from 2b5d1c29f6c4 ("drm/nouveau/disp: > PIOR DP uses GPIO

Re: [Nouveau] [PATCH] drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create

2023-08-16 Thread Borislav Petkov
On Wed, Aug 16, 2023 at 04:57:28PM +0200, Karol Herbst wrote: > Do you have any connectors listed in "/sys/class/drm"? tree /sys/class/drm/ /sys/class/drm/ ├── card0 -> ../../devices/pci:00/:00:02.0/:03:00.0/drm/card0 ├── renderD128 ->

Re: [Nouveau] [PATCH] drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create

2023-08-16 Thread Karol Herbst
On Wed, Aug 16, 2023 at 4:54 PM Borislav Petkov wrote: > > On Wed, Aug 16, 2023 at 11:51:50AM +0200, Karol Herbst wrote: > > Mind sharing your kernel logs with that patch applied? I suspect your > > system boots up but you might just not have the connector available or > > something? It could be

Re: [Nouveau] [PATCH] drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create

2023-08-16 Thread Borislav Petkov
On Wed, Aug 16, 2023 at 11:51:50AM +0200, Karol Herbst wrote: > Mind sharing your kernel logs with that patch applied? I suspect your > system boots up but you might just not have the connector available or > something? It could be that you have one of those GPUs affected by the > original change

Re: [Nouveau] [PATCH] drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create

2023-08-16 Thread Takashi Iwai
On Wed, 16 Aug 2023 12:14:24 +0200, Borislav Petkov wrote: > > On Wed, Aug 16, 2023 at 12:11:57PM +0200, Borislav Petkov wrote: > > Does that help? > > Btw, note that this is *plain* -rc5, without your patch. The UAF looks very same as I had and that's the bug Karol's patch should address. So

Re: [Nouveau] [PATCH] drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create

2023-08-16 Thread Borislav Petkov
On Wed, Aug 16, 2023 at 12:11:57PM +0200, Borislav Petkov wrote: > Does that help? Btw, note that this is *plain* -rc5, without your patch. -- Regards/Gruss, Boris. https://people.kernel.org/tglx/notes-about-netiquette

Re: [Nouveau] [PATCH] drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create

2023-08-16 Thread Borislav Petkov
On Wed, Aug 16, 2023 at 12:03:44PM +0200, Borislav Petkov wrote: > On Wed, Aug 16, 2023 at 11:51:50AM +0200, Karol Herbst wrote: > > Mind sharing your kernel logs with that patch applied? I suspect your > > system boots up but you might just not have the connector available or > > something? It

Re: [Nouveau] [PATCH] drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create

2023-08-16 Thread Borislav Petkov
On Wed, Aug 16, 2023 at 11:51:50AM +0200, Karol Herbst wrote: > Mind sharing your kernel logs with that patch applied? I suspect your > system boots up but you might just not have the connector available or > something? It could be that you have one of those GPUs affected by the > original change

Re: [Nouveau] [PATCH] drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create

2023-08-16 Thread Karol Herbst
On Wed, Aug 16, 2023 at 11:30 AM Borislav Petkov wrote: > > On Mon, Aug 14, 2023 at 04:49:32PM +0200, Karol Herbst wrote: > > We can't simply free the connector after calling drm_connector_init on it. > > We need to clean up the drm side first. > > > > It might not fix all regressions from

Re: [Nouveau] [PATCH] drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create

2023-08-16 Thread Borislav Petkov
On Mon, Aug 14, 2023 at 04:49:32PM +0200, Karol Herbst wrote: > We can't simply free the connector after calling drm_connector_init on it. > We need to clean up the drm side first. > > It might not fix all regressions from 2b5d1c29f6c4 ("drm/nouveau/disp: > PIOR DP uses GPIO for HPD, not PMGR AUX