Use-after-free
Description
The patch fixes a use-after-free vulnerability in the udlfb driver by tracking mmap lifetimes of the framebuffer via vm_ops and an mmap_count on dlfb_data. Previously, dlfb_ops_mmap mapped vmalloc-backed pages without vm_ops and could free the backing pages while user-space mappings persisted, such as after a framebuffer resize via FBIOPUT_VSCREENINFO or USB disconnect. The fix adds vm_open/vm_close callbacks, assigns vm_ops to the VMA, and increments/decrements mmap_count accordingly. dlfb_realloc_framebuffer() now checks mmap_count and returns -EBUSY if mappings are active, preventing buffer replacement while stale user mappings exist. This removes the window for a use-after-free in the mapped framebuffer pages.
Proof of Concept
PoC outline: Run a process that mmap()s the udlfb framebuffer via /dev/fb0, then in a separate thread trigger a framebuffer resize via FBIOPUT_VSCREENINFO to force a reallocation. On a kernel with the patch, the realloc attempt should fail with -EBUSY (due to active mmap_count). On an unpatched kernel, the realloc could proceed, freeing the old pages while user-space mappings remain, enabling a use-after-free under certain access patterns. Steps: 1) Open /dev/fb0 and mmap() the framebuffer with read/write permissions. 2) In another thread, modify the screeninfo with FBIOPUT_VSCREENINFO to a larger resolution/virtual size. 3) Observe the return value of FBIOPUT_VSCREENINFO. 4) If possible, access the previously mapped area after the vulnerable path to demonstrate stale references. Notes: This PoC assumes a vulnerable kernel without the patch; with the patch applied, the operation should return -EBUSY when mmap_count > 0.
Commit Details
Author: Rajat Gupta
Date: 2026-05-04 03:51 UTC
Message:
fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free
dlfb_ops_mmap() uses remap_pfn_range() to map vmalloc framebuffer pages
to userspace but sets no vm_ops on the VMA. This means the kernel cannot
track active mmaps. When dlfb_realloc_framebuffer() replaces the backing
buffer via FBIOPUT_VSCREENINFO, existing mmap PTEs are not invalidated.
On USB disconnect, dlfb_ops_destroy() calls vfree() on the old pages
while userspace PTEs still reference them, resulting in a use-after-free:
the process retains read/write access to freed kernel pages.
Add vm_operations_struct with open/close callbacks that maintain an
atomic mmap_count on struct dlfb_data. In dlfb_realloc_framebuffer(),
check mmap_count and return -EBUSY if the buffer is currently mapped,
preventing buffer replacement while userspace holds stale PTEs.
Tested with PoC using dummy_hcd + raw_gadget USB device emulation.
Signed-off-by: Rajat Gupta <rajgupt@qti.qualcomm.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: stable@vger.kernel.org
Signed-off-by: Helge Deller <deller@gmx.de>
Triage Assessment
Vulnerability Type: Use-after-free
Confidence: HIGH
Reasoning:
The change adds VM area open/close tracking for mmap’ed framebuffer pages and guards reallocations against active mappings. This prevents use-after-free of kernel pages by ensuring backing buffer cannot be replaced while userspace has stale PTEs, addressing a kernel memory safety issue (use-after-free) triggered via mmap of the framebuffer. Code paths explicitly manage mmap_count and bail out with -EBUSY when mappings exist.
Verification Assessment
Vulnerability Type: Use-after-free
Confidence: HIGH
Affected Versions: Prior to commit 8de779dc40d35d39fa07387b6f921eb11df0f511 (unpatched udlfb)
Code Diff
diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c
index c341d76bc5646b..fdbb8671a810c7 100644
--- a/drivers/video/fbdev/udlfb.c
+++ b/drivers/video/fbdev/udlfb.c
@@ -321,12 +321,32 @@ static int dlfb_set_video_mode(struct dlfb_data *dlfb,
return retval;
}
+static void dlfb_vm_open(struct vm_area_struct *vma)
+{
+ struct dlfb_data *dlfb = vma->vm_private_data;
+
+ atomic_inc(&dlfb->mmap_count);
+}
+
+static void dlfb_vm_close(struct vm_area_struct *vma)
+{
+ struct dlfb_data *dlfb = vma->vm_private_data;
+
+ atomic_dec(&dlfb->mmap_count);
+}
+
+static const struct vm_operations_struct dlfb_vm_ops = {
+ .open = dlfb_vm_open,
+ .close = dlfb_vm_close,
+};
+
static int dlfb_ops_mmap(struct fb_info *info, struct vm_area_struct *vma)
{
unsigned long start = vma->vm_start;
unsigned long size = vma->vm_end - vma->vm_start;
unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
unsigned long page, pos;
+ struct dlfb_data *dlfb = info->par;
if (info->fbdefio)
return fb_deferred_io_mmap(info, vma);
@@ -358,6 +378,9 @@ static int dlfb_ops_mmap(struct fb_info *info, struct vm_area_struct *vma)
size = 0;
}
+ vma->vm_ops = &dlfb_vm_ops;
+ vma->vm_private_data = dlfb;
+ atomic_inc(&dlfb->mmap_count);
return 0;
}
@@ -1176,7 +1199,6 @@ static void dlfb_deferred_vfree(struct dlfb_data *dlfb, void *mem)
/*
* Assumes &info->lock held by caller
- * Assumes no active clients have framebuffer open
*/
static int dlfb_realloc_framebuffer(struct dlfb_data *dlfb, struct fb_info *info, u32 new_len)
{
@@ -1188,6 +1210,13 @@ static int dlfb_realloc_framebuffer(struct dlfb_data *dlfb, struct fb_info *info
new_len = PAGE_ALIGN(new_len);
if (new_len > old_len) {
+ if (atomic_read(&dlfb->mmap_count) > 0) {
+ dev_warn(info->dev,
+ "refusing realloc: %d active mmaps\n",
+ atomic_read(&dlfb->mmap_count));
+ return -EBUSY;
+ }
+
/*
* Alloc system memory for virtual framebuffer
*/
diff --git a/include/video/udlfb.h b/include/video/udlfb.h
index 58fb5732831a43..ab34790d57ecd6 100644
--- a/include/video/udlfb.h
+++ b/include/video/udlfb.h
@@ -56,6 +56,7 @@ struct dlfb_data {
spinlock_t damage_lock;
struct work_struct damage_work;
struct fb_ops ops;
+ atomic_t mmap_count;
/* blit-only rendering path metrics, exposed through sysfs */
atomic_t bytes_rendered; /* raw pixel-bytes driver asked to render */
atomic_t bytes_identical; /* saved effort with backbuffer comparison */