Rajat Gupta 8de779dc40 fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free ...

dlfb_ops_mmap() uses remap_pfn_range() to map vmalloc framebuffer pages
to userspace but sets no vm_ops on the VMA. This means the kernel cannot
track active mmaps. When dlfb_realloc_framebuffer() replaces the backing
buffer via FBIOPUT_VSCREENINFO, existing mmap PTEs are not invalidated.
On USB disconnect, dlfb_ops_destroy() calls vfree() on the old pages
while userspace PTEs still reference them, resulting in a use-after-free:
the process retains read/write access to freed kernel pages.

Add vm_operations_struct with open/close callbacks that maintain an
atomic mmap_count on struct dlfb_data. In dlfb_realloc_framebuffer(),
check mmap_count and return -EBUSY if the buffer is currently mapped,
preventing buffer replacement while userspace holds stale PTEs.

Tested with PoC using dummy_hcd + raw_gadget USB device emulation.

Signed-off-by: Rajat Gupta <rajgupt@qti.qualcomm.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: stable@vger.kernel.org
Signed-off-by: Helge Deller <deller@gmx.de>

2026-05-04 10:35:55 +02:00

..

aty

fbdev: atyfb: Fix spelling mistake "enfore" -> "enforce"

2026-04-22 15:55:48 +02:00

core

fbdev: defio: Remove duplicate include of linux/module.h

2026-04-28 14:18:51 +02:00

geode

x86/msr: Add explicit includes of <asm/msr.h>

2025-05-02 10:23:47 +02:00

i810

fbdev: i810: use appopriate log interface dev_info

2025-12-02 20:15:51 +01:00

kyro

fbdev: kyro: Use devm_ioremap_wc() for screen mem

2025-07-27 19:56:51 +02:00

matrox

fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break

2026-03-21 07:12:12 +01:00

mb862xx

fbdev: mb862xxfb: Use int type to store negative error codes

2025-09-30 23:21:34 +02:00

mmp

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-21 20:03:00 -08:00

nvidia

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

omap

fbdev: omapfb: Add missing error check for clk_get()

2026-03-10 18:40:21 +01:00

omap2

fbdev: omap2: fix inconsistent lock returns in omapfb_mmap

2026-04-09 10:26:11 +02:00

riva

fbdev: rivafb: fix divide error in nv3_arb()

2026-02-14 11:07:12 +01:00

savage

fbdev: savage: fix probe-path EDID cleanup leaks

2026-04-22 15:45:38 +02:00

sis

fbdev/sisfb: Unexport symbols

2025-06-16 09:08:06 +02:00

via

fbdev: viafb: check ioremap return value in viafb_lcd_get_mobile_state

2026-03-10 17:32:35 +01:00

68328fb.c

fbdev/68328fb: Initialize fb_ops to fbdev I/O-memory helpers

2023-10-19 12:54:16 +02:00

acornfb.c

fbdev/acornfb: Fix name of fb_ops initializer macro

2023-11-29 12:20:08 +01:00

acornfb.h

…

amifb.c

fbdev: Switch back to struct platform_driver::remove()

2024-10-08 21:47:18 +02:00

arcfb.c

fbdev: Switch back to struct platform_driver::remove()

2024-10-08 21:47:18 +02:00

arkfb.c

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-21 20:03:00 -08:00

asiliantfb.c

…

atafb_iplan2p2.c

…

atafb_iplan2p4.c

…

atafb_iplan2p8.c

…

atafb_mfb.c

…

atafb_utils.h

…

atafb.c

fbdev/atafb: Initialize fb_ops to fbdev I/O-memory helpers

2023-10-19 12:54:38 +02:00

atafb.h

…

atmel_lcdfb.c

Backmerge v6.12-rc6 of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux into drm-next

2024-11-04 14:25:33 +10:00

au1100fb.c

fbdev: au1100fb: Fix build on MIPS64

2026-03-05 17:35:12 +01:00

au1200fb.c

fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe()

2026-02-14 11:09:47 +01:00

au1200fb.h

…

broadsheetfb.c

fbdev: Switch back to struct platform_driver::remove()

2024-10-08 21:47:18 +02:00

bt431.h

…

bt455.h

…

bw2.c

fbdev: Constify struct sbus_mmap_map

2024-10-15 10:07:32 +02:00

c2p_core.h

…

c2p_iplan2.c

fbdev/c2p: Include <linux/export.h>

2025-06-16 09:06:58 +02:00

c2p_planar.c

fbdev/c2p: Include <linux/export.h>

2025-06-16 09:06:58 +02:00

c2p.h

…

carminefb_regs.h

…

carminefb.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

carminefb.h

fbdev: carminefb: Fix spelling mistake of CARMINE_TOTAL_DIPLAY_MEM

2025-05-31 10:24:01 +02:00

cg3.c

fbdev: Constify struct sbus_mmap_map

2024-10-15 10:07:32 +02:00

cg6.c

fbdev: Constify struct sbus_mmap_map

2024-10-15 10:07:32 +02:00

cg14.c

fbdev: Constify struct sbus_mmap_map

2024-10-15 10:07:32 +02:00

chipsfb.c

fbdev: chipsfb: Use backlight power constants

2024-09-30 16:35:28 +02:00

cirrusfb.c

fbdev/cirrusfb: Initialize fb_ops to fbdev I/O-memory helpers

2023-10-19 12:54:52 +02:00

clps711x-fb.c

fbdev: clps711x-fb: Request memory region for MMIO

2026-04-22 16:46:40 +02:00

cobalt_lcdfb.c

fbdev: cobalt_lcdfb: Request memory region

2026-04-22 16:46:40 +02:00

controlfb.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

controlfb.h

…

cyber2000fb.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

cyber2000fb.h

fbdev/cyber2000fb: Unexport symbols

2025-06-16 09:07:03 +02:00

dnfb.c

fbdev/dnfb: Initialize fb_ops to fbdev I/O-memory helpers

2023-10-19 12:55:07 +02:00

edid.h

…

efifb.c

sysfb: Pass sysfb_primary_display to devices

2025-12-16 14:12:44 +01:00

ep93xx-fb.c

fbdev: Switch back to struct platform_driver::remove()

2024-10-08 21:47:18 +02:00

ffb.c

fbdev: ffb: fix corrupted video output on Sun FFB1

2026-02-14 11:09:47 +01:00

fm2fb.c

…

fsl-diu-fb.c

fbdev: fsl-diu-fb: add missing device_remove_file()

2025-03-26 22:39:21 +01:00

g364fb.c

fbdev/g364fb: fix build failure with mips

2023-09-02 08:18:40 -07:00

gbefb.c

fbdev: gbefb: fix to use physical address instead of dma address

2025-11-15 13:46:45 +01:00

goldfishfb.c

fbdev: goldfishfb: use devm_platform_ioremap_resource()

2026-03-09 13:06:48 +01:00

grvga.c

fbdev: Switch back to struct platform_driver::remove()

2024-10-08 21:47:18 +02:00

gxt4500.c

fbdev: gxt4500fb: Use dev_err instead of printk

2025-11-15 13:46:45 +01:00

hecubafb.c

fbdev: Switch back to struct platform_driver::remove()

2024-10-08 21:47:18 +02:00

hgafb.c

fbdev: hgafb: Request memory region before ioremap

2026-04-22 17:02:55 +02:00

hitfb.c

fbdev: Switch back to struct platform_driver::remove()

2024-10-08 21:47:18 +02:00

hpfb.c

fbdev: hpfb: Fix an error handling path in hpfb_dio_probe()

2024-08-30 18:42:38 +02:00

i740_reg.h

…

i740fb.c

fbdev: remove I2C_CLASS_DDC support

2024-01-18 21:10:41 +01:00

imsttfb.c

fbdev: imsttfb: convert comma to semicolon

2024-09-02 13:54:26 +02:00

imxfb.c

fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref

2025-07-27 19:56:51 +02:00

Kconfig

fbdev: update help text for CONFIG_FB_NVIDIA

2026-03-21 07:11:34 +01:00

leo.c

fbdev: Constify struct sbus_mmap_map

2024-10-15 10:07:32 +02:00

macfb.c

fbdev: macfb: Replace deprecated strcpy with strscpy

2026-03-09 13:06:48 +01:00

macmodes.c

fbdev: Include <linux/export.h>

2025-06-16 09:06:19 +02:00

macmodes.h

…

Makefile

fbdev: hyperv_fb: Remove hyperv_fb driver

2026-02-14 11:07:12 +01:00

maxinefb.c

…

metronomefb.c

fbdev: Switch back to struct platform_driver::remove()

2024-10-08 21:47:18 +02:00

n411.c

…

neofb.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

ocfb.c

fbdev: Switch back to struct platform_driver::remove()

2024-10-08 21:47:18 +02:00

offb.c

fbdev: offb: fix PCI device reference leak on probe failure

2026-04-22 15:45:38 +02:00

p9100.c

fbdev: Constify struct sbus_mmap_map

2024-10-15 10:07:32 +02:00

platinumfb.c

fbdev: Switch back to struct platform_driver::remove()

2024-10-08 21:47:18 +02:00

platinumfb.h

…

pm2fb.c

fbdev/pm2fb: Initialize fb_ops to fbdev I/O-memory helpers

2023-10-19 12:56:00 +02:00

pm3fb.c

fbdev/pm3fb: Initialize fb_ops to fbdev I/O-memory helpers

2023-10-19 12:56:04 +02:00

pmag-aa-fb.c

…

pmag-ba-fb.c

…

pmagb-b-fb.c

…

ps3fb.c

fbdev: Push pgprot_decrypted() into mmap implementations

2023-11-29 12:20:44 +01:00

pvr2fb.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

pxa3xx-gcu.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

pxa3xx-gcu.h

…

pxa3xx-regs.h

…

pxa168fb.c

fbdev: Switch back to struct platform_driver::remove()

2024-10-08 21:47:18 +02:00

pxa168fb.h

…

pxafb.c

fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing

2025-12-02 19:49:10 +01:00

pxafb.h

…

q40fb.c

…

s1d13xxxfb.c

fbdev: Switch back to struct platform_driver::remove()

2024-10-08 21:47:18 +02:00

s3c-fb.c

fbdev: Switch back to struct platform_driver::remove()

2024-10-08 21:47:18 +02:00

s3fb.c

fbdev: s3fb: Revert mclk stop in suspend

2025-09-30 23:21:34 +02:00

sa1100fb.c

fbdev: Push pgprot_decrypted() into mmap implementations

2023-11-29 12:20:44 +01:00

sa1100fb.h

…

sbuslib.c

fbdev: Include <linux/export.h>

2025-06-16 09:06:19 +02:00

sbuslib.h

fbdev: Constify struct sbus_mmap_map

2024-10-15 10:07:32 +02:00

sh7760fb.c

fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem()

2024-11-14 15:26:27 +01:00

sh_mobile_lcdcfb.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

sh_mobile_lcdcfb.h

…

simplefb.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

skeletonfb.c

…

sm501fb.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

sm712.h

…

sm712fb.c

fbdev/sm712fb: Use correct initializer macros for struct fb_ops

2023-11-29 12:20:10 +01:00

smscufx.c

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-21 20:03:00 -08:00

ssd1307fb.c

fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe()

2025-12-05 11:29:14 +01:00

sstfb.c

fbdev: sstfb: Make CONFIG_FB_DEVICE optional

2024-10-15 10:07:31 +02:00

stifb.c

fbdev: stifb: Fix crash in stifb_blank()

2024-01-23 09:13:24 +01:00

sunxvr500.c

fbdev/sunxvr500: Initialize fb_ops to fbdev I/O-memory helpers

2023-10-19 12:56:55 +02:00

sunxvr1000.c

BackMerge tag 'v6.5-rc7' into drm-next

2023-08-24 07:26:06 +10:00

sunxvr2500.c

BackMerge tag 'v6.5-rc7' into drm-next

2023-08-24 07:26:06 +10:00

tcx.c

fbdev: tcx.c fix mem_map to correct smem_start offset

2025-12-02 19:44:05 +01:00

tdfxfb.c

fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO

2026-04-10 16:54:35 +02:00

tgafb.c

vt: remove superfluous CONFIG_HW_CONSOLE

2024-01-27 19:03:51 -08:00

tridentfb.c

fbdev: tridentfb: replace printk() with dev_*() in probe

2025-12-02 20:08:35 +01:00

udlfb.c

fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free

2026-05-04 10:35:55 +02:00

uvesafb.c

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-21 20:03:00 -08:00

valkyriefb.c

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

valkyriefb.h

…

vesafb.c

sysfb: Pass sysfb_primary_display to devices

2025-12-16 14:12:44 +01:00

vfb.c

fbdev: Switch back to struct platform_driver::remove()

2024-10-08 21:47:18 +02:00

vga16fb.c

sysfb: Pass sysfb_primary_display to devices

2025-12-16 14:12:44 +01:00

vt8500lcdfb.c

fbdev: vt8500lcdfb: fix missing dma_free_coherent()

2026-02-14 11:09:46 +01:00

vt8500lcdfb.h

…

vt8623fb.c

fbcon: Increase maximum font width x height to 64 x 128

2024-03-16 08:29:48 +01:00

wm8505fb_regs.h

…

wm8505fb.c

fbdev: Switch back to struct platform_driver::remove()

2024-10-08 21:47:18 +02:00

wmt_ge_rops.c

fbdev: wmt_ge_rops: use devm_platform_ioremap_resource()

2026-03-09 13:06:48 +01:00

wmt_ge_rops.h

…

xen-fbfront.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

xilinxfb.c

fbdev: Switch back to struct platform_driver::remove()

2024-10-08 21:47:18 +02:00