mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-05-16 07:51:31 -04:00
Code Issues Packages Projects Releases Wiki Activity
Files
fcee7d82f27d6a8b1ddc5bbefda59b4e441e9bc0
linux/drivers/video/fbdev
History
Rajat Gupta 8de779dc40 fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free 
dlfb_ops_mmap() uses remap_pfn_range() to map vmalloc framebuffer pages
to userspace but sets no vm_ops on the VMA. This means the kernel cannot
track active mmaps. When dlfb_realloc_framebuffer() replaces the backing
buffer via FBIOPUT_VSCREENINFO, existing mmap PTEs are not invalidated.
On USB disconnect, dlfb_ops_destroy() calls vfree() on the old pages
while userspace PTEs still reference them, resulting in a use-after-free:
the process retains read/write access to freed kernel pages.

Add vm_operations_struct with open/close callbacks that maintain an
atomic mmap_count on struct dlfb_data. In dlfb_realloc_framebuffer(),
check mmap_count and return -EBUSY if the buffer is currently mapped,
preventing buffer replacement while userspace holds stale PTEs.

Tested with PoC using dummy_hcd + raw_gadget USB device emulation.

Signed-off-by: Rajat Gupta <rajgupt@qti.qualcomm.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: stable@vger.kernel.org
Signed-off-by: Helge Deller <deller@gmx.de>
2026-05-04 10:35:55 +02:00
..
aty
fbdev: atyfb: Fix spelling mistake "enfore" -> "enforce"
2026-04-22 15:55:48 +02:00
core
fbdev: defio: Remove duplicate include of linux/module.h
2026-04-28 14:18:51 +02:00
geode
x86/msr: Add explicit includes of <asm/msr.h>
2025-05-02 10:23:47 +02:00
i810
fbdev: i810: use appopriate log interface dev_info
2025-12-02 20:15:51 +01:00
kyro
fbdev: kyro: Use devm_ioremap_wc() for screen mem
2025-07-27 19:56:51 +02:00
matrox
fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break
2026-03-21 07:12:12 +01:00
mb862xx
fbdev: mb862xxfb: Use int type to store negative error codes
2025-09-30 23:21:34 +02:00
mmp
Convert more 'alloc_obj' cases to default GFP_KERNEL arguments
2026-02-21 20:03:00 -08:00
nvidia
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
omap
fbdev: omapfb: Add missing error check for clk_get()
2026-03-10 18:40:21 +01:00
omap2
fbdev: omap2: fix inconsistent lock returns in omapfb_mmap
2026-04-09 10:26:11 +02:00
riva
fbdev: rivafb: fix divide error in nv3_arb()
2026-02-14 11:07:12 +01:00
savage
fbdev: savage: fix probe-path EDID cleanup leaks
2026-04-22 15:45:38 +02:00
sis
fbdev/sisfb: Unexport symbols
2025-06-16 09:08:06 +02:00
via
fbdev: viafb: check ioremap return value in viafb_lcd_get_mobile_state
2026-03-10 17:32:35 +01:00
68328fb.c
fbdev/68328fb: Initialize fb_ops to fbdev I/O-memory helpers
2023-10-19 12:54:16 +02:00
acornfb.c
fbdev/acornfb: Fix name of fb_ops initializer macro
2023-11-29 12:20:08 +01:00
acornfb.h
…
amifb.c
fbdev: Switch back to struct platform_driver::remove()
2024-10-08 21:47:18 +02:00
arcfb.c
fbdev: Switch back to struct platform_driver::remove()
2024-10-08 21:47:18 +02:00
arkfb.c
Convert more 'alloc_obj' cases to default GFP_KERNEL arguments
2026-02-21 20:03:00 -08:00
asiliantfb.c
fbdev/asiliantfb: Use fbdev I/O helpers
2023-08-04 15:54:34 +02:00
atafb_iplan2p2.c
…
atafb_iplan2p4.c
…
atafb_iplan2p8.c
…
atafb_mfb.c
…
atafb_utils.h
…
atafb.c
fbdev/atafb: Initialize fb_ops to fbdev I/O-memory helpers
2023-10-19 12:54:38 +02:00
atafb.h
…
atmel_lcdfb.c
Backmerge v6.12-rc6 of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux into drm-next
2024-11-04 14:25:33 +10:00
au1100fb.c
fbdev: au1100fb: Fix build on MIPS64
2026-03-05 17:35:12 +01:00
au1200fb.c
fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe()
2026-02-14 11:09:47 +01:00
au1200fb.h
…
broadsheetfb.c
fbdev: Switch back to struct platform_driver::remove()
2024-10-08 21:47:18 +02:00
bt431.h
…
bt455.h
…
bw2.c
fbdev: Constify struct sbus_mmap_map
2024-10-15 10:07:32 +02:00
c2p_core.h
…
c2p_iplan2.c
fbdev/c2p: Include <linux/export.h>
2025-06-16 09:06:58 +02:00
c2p_planar.c
fbdev/c2p: Include <linux/export.h>
2025-06-16 09:06:58 +02:00
c2p.h
…
carminefb_regs.h
…
carminefb.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
carminefb.h
fbdev: carminefb: Fix spelling mistake of CARMINE_TOTAL_DIPLAY_MEM
2025-05-31 10:24:01 +02:00
cg3.c
fbdev: Constify struct sbus_mmap_map
2024-10-15 10:07:32 +02:00
cg6.c
fbdev: Constify struct sbus_mmap_map
2024-10-15 10:07:32 +02:00
cg14.c
fbdev: Constify struct sbus_mmap_map
2024-10-15 10:07:32 +02:00
chipsfb.c
fbdev: chipsfb: Use backlight power constants
2024-09-30 16:35:28 +02:00
cirrusfb.c
fbdev/cirrusfb: Initialize fb_ops to fbdev I/O-memory helpers
2023-10-19 12:54:52 +02:00
clps711x-fb.c
fbdev: clps711x-fb: Request memory region for MMIO
2026-04-22 16:46:40 +02:00
cobalt_lcdfb.c
fbdev: cobalt_lcdfb: Request memory region
2026-04-22 16:46:40 +02:00
controlfb.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
controlfb.h
…
cyber2000fb.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
cyber2000fb.h
fbdev/cyber2000fb: Unexport symbols
2025-06-16 09:07:03 +02:00
dnfb.c
fbdev/dnfb: Initialize fb_ops to fbdev I/O-memory helpers
2023-10-19 12:55:07 +02:00
edid.h
…
efifb.c
sysfb: Pass sysfb_primary_display to devices
2025-12-16 14:12:44 +01:00
ep93xx-fb.c
fbdev: Switch back to struct platform_driver::remove()
2024-10-08 21:47:18 +02:00
ffb.c
fbdev: ffb: fix corrupted video output on Sun FFB1
2026-02-14 11:09:47 +01:00
fm2fb.c
fbdev/fm2fb: Use fbdev I/O helpers
2023-08-04 15:54:35 +02:00
fsl-diu-fb.c
fbdev: fsl-diu-fb: add missing device_remove_file()
2025-03-26 22:39:21 +01:00
g364fb.c
fbdev/g364fb: fix build failure with mips
2023-09-02 08:18:40 -07:00
gbefb.c
fbdev: gbefb: fix to use physical address instead of dma address
2025-11-15 13:46:45 +01:00
goldfishfb.c
fbdev: goldfishfb: use devm_platform_ioremap_resource()
2026-03-09 13:06:48 +01:00
grvga.c
fbdev: Switch back to struct platform_driver::remove()
2024-10-08 21:47:18 +02:00
gxt4500.c
fbdev: gxt4500fb: Use dev_err instead of printk
2025-11-15 13:46:45 +01:00
hecubafb.c
fbdev: Switch back to struct platform_driver::remove()
2024-10-08 21:47:18 +02:00
hgafb.c
fbdev: hgafb: Request memory region before ioremap
2026-04-22 17:02:55 +02:00
hitfb.c
fbdev: Switch back to struct platform_driver::remove()
2024-10-08 21:47:18 +02:00
hpfb.c
fbdev: hpfb: Fix an error handling path in hpfb_dio_probe()
2024-08-30 18:42:38 +02:00
i740_reg.h
…
i740fb.c
fbdev: remove I2C_CLASS_DDC support
2024-01-18 21:10:41 +01:00
imsttfb.c
fbdev: imsttfb: convert comma to semicolon
2024-09-02 13:54:26 +02:00
imxfb.c
fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref
2025-07-27 19:56:51 +02:00
Kconfig
fbdev: update help text for CONFIG_FB_NVIDIA
2026-03-21 07:11:34 +01:00
leo.c
fbdev: Constify struct sbus_mmap_map
2024-10-15 10:07:32 +02:00
macfb.c
fbdev: macfb: Replace deprecated strcpy with strscpy
2026-03-09 13:06:48 +01:00
macmodes.c
fbdev: Include <linux/export.h>
2025-06-16 09:06:19 +02:00
macmodes.h
…
Makefile
fbdev: hyperv_fb: Remove hyperv_fb driver
2026-02-14 11:07:12 +01:00
maxinefb.c
fbdev/maxinefb: Use fbdev I/O helpers
2023-08-04 15:54:36 +02:00
metronomefb.c
fbdev: Switch back to struct platform_driver::remove()
2024-10-08 21:47:18 +02:00
n411.c
…
neofb.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
ocfb.c
fbdev: Switch back to struct platform_driver::remove()
2024-10-08 21:47:18 +02:00
offb.c
fbdev: offb: fix PCI device reference leak on probe failure
2026-04-22 15:45:38 +02:00
p9100.c
fbdev: Constify struct sbus_mmap_map
2024-10-15 10:07:32 +02:00
platinumfb.c
fbdev: Switch back to struct platform_driver::remove()
2024-10-08 21:47:18 +02:00
platinumfb.h
…
pm2fb.c
fbdev/pm2fb: Initialize fb_ops to fbdev I/O-memory helpers
2023-10-19 12:56:00 +02:00
pm3fb.c
fbdev/pm3fb: Initialize fb_ops to fbdev I/O-memory helpers
2023-10-19 12:56:04 +02:00
pmag-aa-fb.c
fbdev/pmag-aa-fb: Use fbdev I/O helpers
2023-08-04 15:54:37 +02:00
pmag-ba-fb.c
fbdev/pmag-ba-fb: Use fbdev I/O helpers
2023-08-04 15:54:37 +02:00
pmagb-b-fb.c
fbdev/pmagb-b-fb: Use fbdev I/O helpers
2023-08-04 15:54:37 +02:00
ps3fb.c
fbdev: Push pgprot_decrypted() into mmap implementations
2023-11-29 12:20:44 +01:00
pvr2fb.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
pxa3xx-gcu.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
pxa3xx-gcu.h
…
pxa3xx-regs.h
…
pxa168fb.c
fbdev: Switch back to struct platform_driver::remove()
2024-10-08 21:47:18 +02:00
pxa168fb.h
…
pxafb.c
fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing
2025-12-02 19:49:10 +01:00
pxafb.h
…
q40fb.c
fbdev/q40fb: Use fbdev I/O helpers
2023-08-04 15:54:38 +02:00
s1d13xxxfb.c
fbdev: Switch back to struct platform_driver::remove()
2024-10-08 21:47:18 +02:00
s3c-fb.c
fbdev: Switch back to struct platform_driver::remove()
2024-10-08 21:47:18 +02:00
s3fb.c
fbdev: s3fb: Revert mclk stop in suspend
2025-09-30 23:21:34 +02:00
sa1100fb.c
fbdev: Push pgprot_decrypted() into mmap implementations
2023-11-29 12:20:44 +01:00
sa1100fb.h
…
sbuslib.c
fbdev: Include <linux/export.h>
2025-06-16 09:06:19 +02:00
sbuslib.h
fbdev: Constify struct sbus_mmap_map
2024-10-15 10:07:32 +02:00
sh7760fb.c
fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem()
2024-11-14 15:26:27 +01:00
sh_mobile_lcdcfb.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
sh_mobile_lcdcfb.h
…
simplefb.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
skeletonfb.c
fbdev: Remove FBINFO_DEFAULT from framebuffer_alloc()'ed structs
2023-07-24 16:50:38 +02:00
sm501fb.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
sm712.h
…
sm712fb.c
fbdev/sm712fb: Use correct initializer macros for struct fb_ops
2023-11-29 12:20:10 +01:00
smscufx.c
Convert more 'alloc_obj' cases to default GFP_KERNEL arguments
2026-02-21 20:03:00 -08:00
ssd1307fb.c
fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe()
2025-12-05 11:29:14 +01:00
sstfb.c
fbdev: sstfb: Make CONFIG_FB_DEVICE optional
2024-10-15 10:07:31 +02:00
stifb.c
fbdev: stifb: Fix crash in stifb_blank()
2024-01-23 09:13:24 +01:00
sunxvr500.c
fbdev/sunxvr500: Initialize fb_ops to fbdev I/O-memory helpers
2023-10-19 12:56:55 +02:00
sunxvr1000.c
BackMerge tag 'v6.5-rc7' into drm-next
2023-08-24 07:26:06 +10:00
sunxvr2500.c
BackMerge tag 'v6.5-rc7' into drm-next
2023-08-24 07:26:06 +10:00
tcx.c
fbdev: tcx.c fix mem_map to correct smem_start offset
2025-12-02 19:44:05 +01:00
tdfxfb.c
fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
2026-04-10 16:54:35 +02:00
tgafb.c
vt: remove superfluous CONFIG_HW_CONSOLE
2024-01-27 19:03:51 -08:00
tridentfb.c
fbdev: tridentfb: replace printk() with dev_*() in probe
2025-12-02 20:08:35 +01:00
udlfb.c
fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free
2026-05-04 10:35:55 +02:00
uvesafb.c
Convert more 'alloc_obj' cases to default GFP_KERNEL arguments
2026-02-21 20:03:00 -08:00
valkyriefb.c
treewide: Replace kmalloc with kmalloc_obj for non-scalar types
2026-02-21 01:02:28 -08:00
valkyriefb.h
…
vesafb.c
sysfb: Pass sysfb_primary_display to devices
2025-12-16 14:12:44 +01:00
vfb.c
fbdev: Switch back to struct platform_driver::remove()
2024-10-08 21:47:18 +02:00
vga16fb.c
sysfb: Pass sysfb_primary_display to devices
2025-12-16 14:12:44 +01:00
vt8500lcdfb.c
fbdev: vt8500lcdfb: fix missing dma_free_coherent()
2026-02-14 11:09:46 +01:00
vt8500lcdfb.h
…
vt8623fb.c
fbcon: Increase maximum font width x height to 64 x 128
2024-03-16 08:29:48 +01:00
wm8505fb_regs.h
…
wm8505fb.c
fbdev: Switch back to struct platform_driver::remove()
2024-10-08 21:47:18 +02:00
wmt_ge_rops.c
fbdev: wmt_ge_rops: use devm_platform_ioremap_resource()
2026-03-09 13:06:48 +01:00
wmt_ge_rops.h
…
xen-fbfront.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
xilinxfb.c
fbdev: Switch back to struct platform_driver::remove()
2024-10-08 21:47:18 +02:00