Bug 2524448 - kmscon: use-after-free crash in seat_go_foreground when DRM device lacks dumb buffer support (RPi4)
Summary: kmscon: use-after-free crash in seat_go_foreground when DRM device lacks dumb...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: kmscon
Version: 45
Hardware: aarch64
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Jocelyn Falempe
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: AcceptedFreezeException
Depends On:
Blocks: BetaFreezeException, F45BetaFreezeException
TreeView+ depends on / blocked
 
Reported: 2026-08-26 14:55 UTC by Jaroslav Groman
Modified: 2026-09-10 20:04 UTC (History)
4 users (show)

Fixed In Version: kmscon-10.0.3-2.fc45
Clone Of:
Environment:
Last Closed: 2026-09-10 20:04:05 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
Fedora-Minimal-Rawhide-20260903.n.0.aarch64 bootlog (401.60 KB, text/plain)
2026-09-03 08:35 UTC, Jaroslav Groman
no flags Details
Fedora-Minimal-45_Beta-1.2.aarch64 bootlog (399.69 KB, text/plain)
2026-09-04 08:58 UTC, Jaroslav Groman
no flags Details

Description Jaroslav Groman 2026-08-26 14:55:50 UTC
kmscon crashes with SIGSEGV during shutdown on Raspberry Pi 4 Model B. 
The RPi4 has two DRM devices: /dev/dri/card0 (vc4, display output) and 
/dev/dri/card1 (v3d, 3D-only, no dumb buffer support). When seat_go_foreground 
calls seat_video_init for the v3d device and it fails with -EOPNOTSUPP, the error 
handling frees the kmscon_video struct and unlinks it from the seat's video list, but
 does not clear the monitor device's data pointer (uterm_monitor_set_dev_data(vid->udev, NULL)
 is missing). This leaves a dangling pointer in the uterm_monitor_dev. 
During shutdown, uterm_monitor_unref iterates all monitor devices and passes 
the dangling pointer to kmscon_seat_remove_video, which dereferences freed memory 
and crashes.

Reproducible: Always

Steps to Reproduce:
1. Boot Minimal Fedora 45 Branched 20260826.n.0 on Raspberry Pi 4 Model B
2. Run kmscon in oneshot mode so it exits after the child process finishes, e.g.:
   kmscon --vt 7 --no-issue --oneshot --login /bin/true
3. kmscon encounters /dev/dri/card1 (v3d) which lacks dumb buffer support,
   fails to init the video device (-EOPNOTSUPP), but continues on /dev/dri/card0
4. The child process exits, kmscon shuts down
5. kmscon crashes with SIGSEGV during cleanup in kmscon_seat_free

Note: Long-running kmscon instances (e.g. kmsconvt@tty1 providing login prompts)
hit the same v3d init error but do not crash because they don't go through the
shutdown/cleanup path during normal operation.

Actual Results:
kmscon on tty7 runs with --oneshot --login. It spawns the child (run-initial-setup), the child fails (SELinux denials), kmscon exits, triggering kmscon_seat_free → uterm_monitor_unref which hits the dangling pointer.

Expected Results:
kmscon on tty7 does not crash regardless on intial-setup status

Additional Information:
Version-Release number of selected component:
kmscon-10.0.2-2.fc45.aarch64

Crash stack trace:
#0  kmscon_seat_remove_video.part.0 (kmscon + 0x12470)
#1  mon_free_dev (kmscon + 0x15fbc)
#2  uterm_monitor_unref (kmscon + 0x1f544)
#3  kmscon_seat_free.part.0 (kmscon + 0x152d0)
#4  main (kmscon + 0x9fcc)

Relevant journal output:
kmscon[817]: [0000.144541] ERROR: drm_shared: Device /dev/dri/card1 doesn't support universal planes, using legacy
kmscon[817]: [0000.144591] WARNING: drm_shared: Device /dev/dri/card1 doesn't support atomic modesetting, using legacy
kmscon[817]: [0000.144626] ERROR: video_drm2d: driver does not support dumb buffers
kmscon[817]: [0000.144694] ERROR: seat: cannot create video device /dev/dri/card1 on seat seat0: -95
kmscon[817]: [0000.211832] NOTICE: terminal: Display [HDMI-A] with backend [drm2d] text renderer [bbulk] font engine [unifont]
audit[817]: ANOM_ABEND auid=0 uid=0 gid=0 ses=3 pid=817 comm="kmscon" exe="/usr/bin/kmscon" sig=11

Coredump registers at crash:
PC=0x12470 (str x0, [x1, #8] -- NULL pointer dereference, writing to address 0x8)
x0=0x0 x1=0x0 (vid->list.prev and vid->list.next, both NULL from freed memory)
x20=0xaaaaf2e85600 (dangling vid pointer, memory already freed)

Suggested fix in src/seat.c, seat_go_foreground():
Add uterm_monitor_set_dev_data(vid->udev, NULL) before free(vid)
in the seat_video_init failure handling block.

Comment 1 Jaroslav Groman 2026-08-27 08:35:23 UTC
Pull request: https://github.com/kmscon/kmscon/pull/512

Comment 2 Adam Williamson (Red Hat non-Fedora) 2026-08-27 16:39:28 UTC
I get the feeling we'll want to fix this in Beta if possible.

Comment 3 Adam Williamson (Red Hat non-Fedora) 2026-08-31 15:55:06 UTC
In discussing https://bugzilla.redhat.com/show_bug.cgi?id=2526278 , Jeremy Linton thought there might be a lower-level issue: "the simpldrm framebuffer being provided, should be taken over by the vc4 drm driver". It occurred to me that might also be relevant here, so CCing him.

Comment 4 Adam Williamson (Red Hat non-Fedora) 2026-08-31 15:56:06 UTC
+4 in https://forge.fedoraproject.org/quality/blocker-review/issues/2154 , marking accepted - the crash on shutdown is clearly FE-worthy, whether or not the LLM analysis/solution holds.

Comment 5 Jeremy Linton 2026-08-31 16:54:59 UTC
Well vc4 has the usual https://elixir.bootlin.com/linux/v7.2.2/source/drivers/gpu/drm/vc4/vc4_drv.c#L362 which means the simpledrm devices should be removed, but its probably racy, even scanning /sys probably is.

Comment 6 Fedora Update System 2026-09-01 12:13:33 UTC
FEDORA-2026-45ebe41ba6 (kmscon-10.0.3-1.fc45) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-45ebe41ba6

Comment 7 Fedora Update System 2026-09-02 02:21:51 UTC
FEDORA-2026-45ebe41ba6 has been pushed to the Fedora 45 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-45ebe41ba6`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-45ebe41ba6

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 8 Adam Williamson (Fedora) 2026-09-02 17:16:12 UTC
Jaroslav, can you test this? Most convenient way will probably be to test the next Rawhide compose, as that will have the change in it.

Comment 9 Jaroslav Groman 2026-09-03 08:33:49 UTC
I can confirm that on Fedora-Minimal-Rawhide-20260903.n.0.aarch64 kmscon no longer crashes.
Also SELinux policy seems to be fixed since I was able to complete initial-setup and login just fine.

Attaching bootlog.

Comment 10 Jaroslav Groman 2026-09-03 08:35:00 UTC
Created attachment 2156524 [details]
Fedora-Minimal-Rawhide-20260903.n.0.aarch64 bootlog

Comment 11 Jaroslav Groman 2026-09-04 08:57:39 UTC
Verified also on Fedora-Minimal-45_Beta-1.2.aarch64, works out of the box on RPi4.

Comment 12 Jaroslav Groman 2026-09-04 08:58:05 UTC
Created attachment 2156655 [details]
Fedora-Minimal-45_Beta-1.2.aarch64 bootlog

Comment 13 Kamil Páral (Red Hat) 2026-09-04 09:00:44 UTC
Setting verified per comment 11

Comment 14 Fedora Update System 2026-09-05 02:16:12 UTC
FEDORA-2026-756d8c0914 has been pushed to the Fedora 45 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-756d8c0914`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-756d8c0914

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 15 Fedora Update System 2026-09-10 20:04:05 UTC
FEDORA-2026-756d8c0914 (kmscon-10.0.3-2.fc45) has been pushed to the Fedora 45 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.