kernel/git/next/linux-next.git/drivers/video/fbdev/vfb.c, branch master

fbdev: vfb: defer cleanup until the last reference

2026-09-10T20:52:02+00:00

FBIOGETCMAP takes a shallow snapshot of info->cmap and performs the usercopy after dropping info->lock. vfb_remove() frees the colormap immediately after unregistering the framebuffer, even when an open file still holds a reference to fb_info. A concurrent driver unbind can therefore free the colormap while the ioctl copies it to userspace. KASAN reports: BUG: KASAN: slab-use-after-free in _copy_to_user Read of size 512 by task poc/125 _copy_to_user (./include/linux/instrumented.h:129 ./include/linux/uaccess.h:201 lib/usercopy.c:24) fb_cmap_to_user (./include/linux/uaccess.h:230 drivers/video/fbdev/core/fbcmap.c:211) do_fb_ioctl (drivers/video/fbdev/core/fb_chrdev.c:114) Allocated by task 1: fb_alloc_cmap_gfp (./include/linux/slab.h:973 ./include/linux/slab.h:1290 drivers/video/fbdev/core/fbcmap.c:108) vfb_probe (drivers/video/fbdev/vfb.c:459) Freed by task 124: fb_dealloc_cmap (drivers/video/fbdev/core/fbcmap.c:151) vfb_remove (drivers/video/fbdev/vfb.c:489) unregister_framebuffer() drops the registration reference, and fbdev calls fb_destroy after the last put_fb_info(). Move the registered framebuffer's cleanup into an fb_destroy callback so its colormap and screen buffer stay alive until all file references have been released. Fixes: 5e266e2e0e19 ("vfb: fix memory leaks in removal path") Reported-by: co+c25629c98ba36ebe@bugs.sh Cc: stable@kernel.org Closes: https://lore.kernel.org/linux-fbdev/f2Kf9GYn1lKR5S1dbvGVtykMxK1RlgP5z8sW@bugs.sh/ Assisted-by: Codex:gpt-5 Signed-off-by: Weiming Shi Link: https://lore.kernel.org/linux-fbdev/f2Kf9GYn1lKR5S1dbvGVtykMxK1RlgP5z8sW@bugs.sh/ Signed-off-by: Helge Deller

fbdev: Switch back to struct platform_driver::remove()

2024-10-08T19:47:18+00:00

After commit 0edb555a65d1 ("platform: Make platform_driver::remove() return void") .remove() is (again) the right callback to implement for platform drivers. Convert all platform drivers below drivers/video/fbdev to use .remove(), with the eventual goal to drop struct platform_driver::remove_new(). As .remove() and .remove_new() have the same prototypes, conversion is done by just changing the structure member name in the driver initializer. While touching these files, make indention of the struct initializer consistent in several files. Signed-off-by: Uwe Kleine-König Reviewed-by: Thomas Zimmermann Signed-off-by: Helge Deller

fbdev: vfb: add missing MODULE_DESCRIPTION() macro

2024-06-13T21:10:41+00:00

With ARCH=x86, make allmodconfig && make W=1 C=1 reports: WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/video/fbdev/vfb.o Add the missing invocation of the MODULE_DESCRIPTION() macro. Signed-off-by: Jeff Johnson Signed-off-by: Helge Deller

fbdev: Push pgprot_decrypted() into mmap implementations

2023-11-29T11:20:44+00:00

If a driver sets struct fb_ops.fb_mmap, the fbdev core automatically calls pgprot_decrypted(). But the default fb_mmap code doesn't handle pgprot_decrypted(). Move the call to pgprot_decrypted() into each drivers' fb_mmap function. This only concerns fb_mmap functions for system and DMA memory. For I/O memory, which is the default case, nothing changes. The fb_mmap for I/O-memory can later be moved into a helper as well. DRM's fbdev emulation handles pgprot_decrypted() internally via the Prime helpers. Fbdev doesn't have to do anything in this case. In cases where DRM uses deferred I/O, this patch updates fb_mmap correctly. Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Link: https://patchwork.freedesktop.org/patch/msgid/20231127131655.4020-30-tzimmermann@suse.de

fbdev/vfb: Initialize fb_ops with fbdev macros

2023-11-29T11:20:12+00:00

Initialize the instance of struct fb_ops with fbdev initializer macros for framebuffers in virtual address space. Set the read/write, draw and mmap callbacks to the correct implementation and avoid implicit defaults. Also select the necessary helpers in Kconfig. Fbdev drivers sometimes rely on the callbacks being NULL for a default I/O-memory-based implementation to be invoked; hence requiring the I/O helpers to be built in any case. Setting all callbacks in all drivers explicitly will allow to make the I/O helpers optional. This benefits systems that do not use these functions. Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Link: https://patchwork.freedesktop.org/patch/msgid/20231127131655.4020-5-tzimmermann@suse.de

fbdev/vfb: Set FBINFO_VIRTFB flag

2023-11-29T11:20:11+00:00

The vfb driver operates on system memory. Mark the framebuffer accordingly. Helpers operating on the framebuffer memory will test for the presence of this flag. Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Link: https://patchwork.freedesktop.org/patch/msgid/20231127131655.4020-4-tzimmermann@suse.de

fbdev: Remove FBINFO_FLAG_DEFAULT from framebuffer_alloc()'ed structs

2023-07-24T14:50:39+00:00

The flag FBINFO_FLAG_DEFAULT is 0 and has no effect, as struct fbinfo.flags has been allocated to zero by framebuffer_alloc(). So do not set it. Flags should signal differences from the default values. After cleaning up all occurrences of FBINFO_DEFAULT, the token will be removed. v4: * clarify commit message (Geert, Dan) v2: * fix commit message (Miguel) Signed-off-by: Thomas Zimmermann Acked-by: Sam Ravnborg Cc: Jaya Kumar Cc: Helge Deller Cc: Peter Jones Cc: Sascha Hauer Cc: Pengutronix Kernel Team Cc: Shawn Guo Cc: Fabio Estevam Cc: NXP Linux Team Cc: Maik Broemme Cc: Jingoo Han Cc: Sudip Mukherjee Cc: Teddy Wang Cc: Michal Januszewski Link: https://patchwork.freedesktop.org/patch/msgid/20230715185343.7193-15-tzimmermann@suse.de

Merge tag 'drm-misc-next-2023-05-11' of git://anongit.freedesktop.org/drm/drm-misc into drm-next

2023-05-19T01:37:59+00:00

drm-misc-next for 6.5: UAPI Changes: Cross-subsystem Changes: - arch: Consolidate Core Changes: - aperture: Ignore firmware framebuffers with non-primary devices - fbdev: Use fbdev's I/O helpers - sysfs: Expose DRM connector ID - tests: More tests for drm_rect Driver Changes: - armada: Implement fbdev emulation as a client - bridge: - fsl-ldb: Support i.MX6SX - lt9211: Remove blanking packets - lt9611: Remove blanking packets - tc358768: Implement input bus formats reporting, fix various timings and clocks settings - ti-sn65dsi86: Implement wait_hpd_asserted - nouveau: Improve NULL pointer checks before dereference - panel: - nt36523: Support Lenovo J606F - st7703: Support Anbernic RG353V-V2 - new panels: InnoLux G070ACE-L01 - sun4i: Fix MIPI-DSI dotclock - vc4: RGB Range toggle property, BT601 and BT2020 support for HDMI - vkms: Convert to drmm helpers, Add reflection and rotation support Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/2pxmxdzsk2ekjy6xvbpj67zrhtwvkkhfspuvdm5pfm5i54hed6@sooct7yq6z4w

fbdev: vfb: Remove trailing whitespaces

2023-05-11T13:22:17+00:00

Fix coding style. No functional changes. Signed-off-by: Thomas Zimmermann Acked-by: Helge Deller Signed-off-by: Helge Deller

Merge drm/drm-next into drm-misc-next

2023-05-09T13:03:40+00:00

Start the 6.5 release cycle. Signed-off-by: Maxime Ripard