Bug 2524448 - kmscon: use-after-free crash in seat_go_foreground when DRM device lacks dumb buffer support (RPi4)
Summary: kmscon: use-after-free crash in seat_go_foreground when DRM device lacks dumb...
Keywords:
Status: VERIFIED
Alias: None
Product: Fedora
Classification: Fedora
Component: kmscon
Version: 45
Hardware: aarch64
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Jocelyn Falempe
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: AcceptedFreezeException
Depends On:
Blocks: BetaFreezeException, F45BetaFreezeException
TreeView+ depends on / blocked
 
Reported: 2026-08-26 14:55 UTC by Jaroslav Groman
Modified: 2026-09-05 02:16 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Type: ---
Embargoed:


Attachments (Terms of Use)
Fedora-Minimal-Rawhide-20260903.n.0.aarch64 bootlog (401.60 KB, text/plain)
2026-09-03 08:35 UTC, Jaroslav Groman
no flags Details
Fedora-Minimal-45_Beta-1.2.aarch64 bootlog (399.69 KB, text/plain)
2026-09-04 08:58 UTC, Jaroslav Groman
no flags Details

Description Jaroslav Groman 2026-08-26 14:55:50 UTC
kmscon crashes with SIGSEGV during shutdown on Raspberry Pi 4 Model B. 
The RPi4 has two DRM devices: /dev/dri/card0 (vc4, display output) and 
/dev/dri/card1 (v3d, 3D-only, no dumb buffer support). When seat_go_foreground 
calls seat_video_init for the v3d device and it fails with -EOPNOTSUPP, the error 
handling frees the kmscon_video struct and unlinks it from the seat's video list, but
 does not clear the monitor device's data pointer (uterm_monitor_set_dev_data(vid->udev, NULL)
 is missing). This leaves a dangling pointer in the uterm_monitor_dev. 
During shutdown, uterm_monitor_unref iterates all monitor devices and passes 
the dangling pointer to kmscon_seat_remove_video, which dereferences freed memory 
and crashes.

Reproducible: Always

Steps to Reproduce:
1. Boot Minimal Fedora 45 Branched 20260826.n.0 on Raspberry Pi 4 Model B
2. Run kmscon in oneshot mode so it exits after the child process finishes, e.g.:
   kmscon --vt 7 --no-issue --oneshot --login /bin/true
3. kmscon encounters /dev/dri/card1 (v3d) which lacks dumb buffer support,
   fails to init the video device (-EOPNOTSUPP), but continues on /dev/dri/card0
4. The child process exits, kmscon shuts down
5. kmscon crashes with SIGSEGV during cleanup in kmscon_seat_free

Note: Long-running kmscon instances (e.g. kmsconvt@tty1 providing login prompts)
hit the same v3d init error but do not crash because they don't go through the
shutdown/cleanup path during normal operation.

Actual Results:
kmscon on tty7 runs with --oneshot --login. It spawns the child (run-initial-setup), the child fails (SELinux denials), kmscon exits, triggering kmscon_seat_free → uterm_monitor_unref which hits the dangling pointer.

Expected Results:
kmscon on tty7 does not crash regardless on intial-setup status

Additional Information:
Version-Release number of selected component:
kmscon-10.0.2-2.fc45.aarch64

Crash stack trace:
#0  kmscon_seat_remove_video.part.0 (kmscon + 0x12470)
#1  mon_free_dev (kmscon + 0x15fbc)
#2  uterm_monitor_unref (kmscon + 0x1f544)
#3  kmscon_seat_free.part.0 (kmscon + 0x152d0)
#4  main (kmscon + 0x9fcc)

Relevant journal output:
kmscon[817]: [0000.144541] ERROR: drm_shared: Device /dev/dri/card1 doesn't support universal planes, using legacy
kmscon[817]: [0000.144591] WARNING: drm_shared: Device /dev/dri/card1 doesn't support atomic modesetting, using legacy
kmscon[817]: [0000.144626] ERROR: video_drm2d: driver does not support dumb buffers
kmscon[817]: [0000.144694] ERROR: seat: cannot create video device /dev/dri/card1 on seat seat0: -95
kmscon[817]: [0000.211832] NOTICE: terminal: Display [HDMI-A] with backend [drm2d] text renderer [bbulk] font engine [unifont]
audit[817]: ANOM_ABEND auid=0 uid=0 gid=0 ses=3 pid=817 comm="kmscon" exe="/usr/bin/kmscon" sig=11

Coredump registers at crash:
PC=0x12470 (str x0, [x1, #8] -- NULL pointer dereference, writing to address 0x8)
x0=0x0 x1=0x0 (vid->list.prev and vid->list.next, both NULL from freed memory)
x20=0xaaaaf2e85600 (dangling vid pointer, memory already freed)

Suggested fix in src/seat.c, seat_go_foreground():
Add uterm_monitor_set_dev_data(vid->udev, NULL) before free(vid)
in the seat_video_init failure handling block.

Comment 1 Jaroslav Groman 2026-08-27 08:35:23 UTC
Pull request: https://github.com/kmscon/kmscon/pull/512

Comment 2 Adam Williamson (Red Hat non-Fedora) 2026-08-27 16:39:28 UTC
I get the feeling we'll want to fix this in Beta if possible.

Comment 3 Adam Williamson (Red Hat non-Fedora) 2026-08-31 15:55:06 UTC
In discussing https://bugzilla.redhat.com/show_bug.cgi?id=2526278 , Jeremy Linton thought there might be a lower-level issue: "the simpldrm framebuffer being provided, should be taken over by the vc4 drm driver". It occurred to me that might also be relevant here, so CCing him.

Comment 4 Adam Williamson (Red Hat non-Fedora) 2026-08-31 15:56:06 UTC
+4 in https://forge.fedoraproject.org/quality/blocker-review/issues/2154 , marking accepted - the crash on shutdown is clearly FE-worthy, whether or not the LLM analysis/solution holds.

Comment 5 Jeremy Linton 2026-08-31 16:54:59 UTC
Well vc4 has the usual https://elixir.bootlin.com/linux/v7.2.2/source/drivers/gpu/drm/vc4/vc4_drv.c#L362 which means the simpledrm devices should be removed, but its probably racy, even scanning /sys probably is.

Comment 6 Fedora Update System 2026-09-01 12:13:33 UTC
FEDORA-2026-45ebe41ba6 (kmscon-10.0.3-1.fc45) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-45ebe41ba6

Comment 7 Fedora Update System 2026-09-02 02:21:51 UTC
FEDORA-2026-45ebe41ba6 has been pushed to the Fedora 45 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-45ebe41ba6`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-45ebe41ba6

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 8 Adam Williamson (Fedora) 2026-09-02 17:16:12 UTC
Jaroslav, can you test this? Most convenient way will probably be to test the next Rawhide compose, as that will have the change in it.

Comment 9 Jaroslav Groman 2026-09-03 08:33:49 UTC
I can confirm that on Fedora-Minimal-Rawhide-20260903.n.0.aarch64 kmscon no longer crashes.
Also SELinux policy seems to be fixed since I was able to complete initial-setup and login just fine.

Attaching bootlog.

Comment 10 Jaroslav Groman 2026-09-03 08:35:00 UTC
Created attachment 2156524 [details]
Fedora-Minimal-Rawhide-20260903.n.0.aarch64 bootlog

Comment 11 Jaroslav Groman 2026-09-04 08:57:39 UTC
Verified also on Fedora-Minimal-45_Beta-1.2.aarch64, works out of the box on RPi4.

Comment 12 Jaroslav Groman 2026-09-04 08:58:05 UTC
Created attachment 2156655 [details]
Fedora-Minimal-45_Beta-1.2.aarch64 bootlog

Comment 13 Kamil Páral 2026-09-04 09:00:44 UTC
Setting verified per comment 11

Comment 14 Fedora Update System 2026-09-05 02:16:12 UTC
FEDORA-2026-756d8c0914 has been pushed to the Fedora 45 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-756d8c0914`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-756d8c0914

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.


Note You need to log in before you can comment on or make changes to this bug.