[PATCH] fbdev:modedb: fix a possible UAF in fb_find_mode()

[Tuo Li]

If mode_option is NULL, it is assigned from mode_option_buf:

  if (!mode_option) {
    fb_get_options(NULL, &mode_option_buf);
    mode_option = mode_option_buf;
  }

Later, name is assigned from mode_option:

  const char *name = mode_option;

However, mode_option_buf is freed before name is no longer used:

  kfree(mode_option_buf);

while name is still accessed by:

  if ((name_matches(db[i], name, namelen) ||

Since name aliases mode_option_buf, this may result in a
use-after-free.

Fix this by moving the kfree(mode_option_buf) call behind the access, and
add corresponding cleanup before early returns.

Signed-off-by: Tuo Li <isli...@gmail.com>
---
 drivers/video/fbdev/core/modedb.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/video/fbdev/core/modedb.c 
b/drivers/video/fbdev/core/modedb.c
index 703d0b7aec32..91f6c78f9e19 100644
--- a/drivers/video/fbdev/core/modedb.c
+++ b/drivers/video/fbdev/core/modedb.c
@@ -724,7 +724,6 @@ int fb_find_mode(struct fb_var_screeninfo *var,
                        res_specified = 1;
                }
 done:
-               kfree(mode_option_buf);
                if (cvt) {
                        struct fb_videomode cvt_mode;
                        int ret;
@@ -749,6 +748,7 @@ int fb_find_mode(struct fb_var_screeninfo *var,
 
                        if (!ret && !fb_try_mode(var, info, &cvt_mode, bpp)) {
                                DPRINTK("modedb CVT: CVT mode ok\n");
+                               kfree(mode_option_buf);
                                return 1;
                        }
 
@@ -793,8 +793,10 @@ int fb_find_mode(struct fb_var_screeninfo *var,
                                if (!interlace_specified ||
                                    db_interlace == interlace)
                                        if (refresh_specified &&
-                                           db[i].refresh == refresh)
+                                           db[i].refresh == refresh) {
+                                               kfree(mode_option_buf);
                                                return 1;
+                                       }
 
                                if (score < diff) {
                                        diff = score;
@@ -802,6 +804,8 @@ int fb_find_mode(struct fb_var_screeninfo *var,
                                }
                        }
                }
+
+               kfree(mode_option_buf);
                if (best != -1) {
                        fb_try_mode(var, info, &db[best], bpp);
                        return (refresh_specified) ? 2 : 1;
-- 
2.43.0