github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 13:14:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
master
linux/drivers/video/fbdev
History
Weiming Shi a0a34a40ed fbdev: vfb: defer cleanup until the last reference 
FBIOGETCMAP takes a shallow snapshot of info->cmap and performs the
usercopy after dropping info->lock. vfb_remove() frees the colormap
immediately after unregistering the framebuffer, even when an open file
still holds a reference to fb_info. A concurrent driver unbind can
therefore free the colormap while the ioctl copies it to userspace.

KASAN reports:

  BUG: KASAN: slab-use-after-free in _copy_to_user
  Read of size 512 by task poc/125

   _copy_to_user (./include/linux/instrumented.h:129 ./include/linux/uaccess.h:201 lib/usercopy.c:24)
   fb_cmap_to_user (./include/linux/uaccess.h:230 drivers/video/fbdev/core/fbcmap.c:211)
   do_fb_ioctl (drivers/video/fbdev/core/fb_chrdev.c:114)

   Allocated by task 1:
   fb_alloc_cmap_gfp (./include/linux/slab.h:973 ./include/linux/slab.h:1290 drivers/video/fbdev/core/fbcmap.c:108)
   vfb_probe (drivers/video/fbdev/vfb.c:459)

   Freed by task 124:
   fb_dealloc_cmap (drivers/video/fbdev/core/fbcmap.c:151)
   vfb_remove (drivers/video/fbdev/vfb.c:489)

unregister_framebuffer() drops the registration reference, and fbdev calls
fb_destroy after the last put_fb_info(). Move the registered framebuffer's
cleanup into an fb_destroy callback so its colormap and screen buffer stay
alive until all file references have been released.

Fixes: 5e266e2e0e ("vfb: fix memory leaks in removal path")
Reported-by: co+c25629c98ba36ebe@bugs.sh
Cc: stable@kernel.org
Closes: https://lore.kernel.org/linux-fbdev/f2Kf9GYn1lKR5S1dbvGVtykMxK1RlgP5z8sW@bugs.sh/
Assisted-by: Codex:gpt-5
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Link: https://lore.kernel.org/linux-fbdev/f2Kf9GYn1lKR5S1dbvGVtykMxK1RlgP5z8sW@bugs.sh/
Signed-off-by: Helge Deller <deller@gmx.de>
2026-09-10 22:52:02 +02:00
..
aty fbdev: atyfb: Convert to managed PCI and ioremap API 2026-08-15 10:40:58 +02:00
core fbcon: Fix KASAN slab-out-of-bounds Read in fbcon_prepare_logo 2026-08-24 13:24:37 +02:00
geode fbdev: Consistently define pci_device_ids using named initializers 2026-06-07 18:25:41 +02:00
i810 fbdev: i810: use appopriate log interface dev_info 2025-12-02 20:15:51 +01:00
kyro fbdev: kyro: Validate overlay viewport coordinates 2026-08-10 08:13:25 +02:00
matrox fbdev: matrox: Convert to managed PCI and ioremap API 2026-08-15 10:40:58 +02:00
mb862xx fbdev: mb862xxfb: Silence possibly unused functions 2026-08-10 08:13:26 +02:00
mmp fbdev: mmp: Remove redundant dev_err() 2026-08-10 08:13:25 +02:00
nvidia fbdev: nvidia: Convert to managed PCI and ioremap API 2026-08-15 10:40:57 +02:00
omap fbdev: omapfb: Add missing error check for clk_get() 2026-03-10 18:40:21 +01:00
omap2 fbdev: omapfb: Fix __be32 sparse warning in panel_enabled() 2026-08-24 13:24:37 +02:00
riva fbdev: rivafb: Use strscpy() to copy device name 2026-06-09 16:00:11 +02:00
savage fbdev: savage: Convert to managed PCI and ioremap API 2026-08-15 10:40:57 +02:00
sis fbdev: sisfb: Replace strlen() strcpy() pair with strscpy() 2026-06-09 16:00:11 +02:00
via fbdev: viafb: refactor strcpy and viafb_name 2026-08-20 23:45:07 +02:00
68328fb.c fbdev/68328fb: Initialize fb_ops to fbdev I/O-memory helpers 2023-10-19 12:54:16 +02:00
acornfb.c fbdev/acornfb: Fix name of fb_ops initializer macro 2023-11-29 12:20:08 +01:00
acornfb.h
amifb.c fbdev: Switch back to struct platform_driver::remove() 2024-10-08 21:47:18 +02:00
arcfb.c fbdev: Switch back to struct platform_driver::remove() 2024-10-08 21:47:18 +02:00
arkfb.c fbdev: Consistently define pci_device_ids using named initializers 2026-06-07 18:25:41 +02:00
asiliantfb.c fbdev/asiliantfb: Use fbdev I/O helpers 2023-08-04 15:54:34 +02:00
atafb_iplan2p2.c
atafb_iplan2p4.c
atafb_iplan2p8.c
atafb_mfb.c
atafb_utils.h
atafb.c fbdev: atafb: Restrict SuperBlitter to supported formats 2026-09-10 22:36:31 +02:00
atafb.h
atmel_lcdfb.c fbdev: atmel_lcdfb: Use strscpy() to copy device name 2026-06-09 16:00:11 +02:00
au1100fb.c fbdev: au1100fb: drop unneeded semicolon 2026-08-10 08:13:26 +02:00
au1200fb.c fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() 2026-02-14 11:09:47 +01:00
au1200fb.h
broadsheetfb.c fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() 2026-06-07 18:25:42 +02:00
bt431.h
bt455.h
bw2.c fbdev: Constify struct sbus_mmap_map 2024-10-15 10:07:32 +02:00
c2p_core.h
c2p_iplan2.c fbdev/c2p: Include <linux/export.h> 2025-06-16 09:06:58 +02:00
c2p_planar.c fbdev/c2p: Include <linux/export.h> 2025-06-16 09:06:58 +02:00
c2p.h
carminefb_regs.h
carminefb.c fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() 2026-06-07 18:25:42 +02:00
carminefb.h fbdev: carminefb: Fix spelling mistake of CARMINE_TOTAL_DIPLAY_MEM 2025-05-31 10:24:01 +02:00
cg3.c fbdev: Constify struct sbus_mmap_map 2024-10-15 10:07:32 +02:00
cg6.c fbdev: Constify struct sbus_mmap_map 2024-10-15 10:07:32 +02:00
cg14.c fbdev: Constify struct sbus_mmap_map 2024-10-15 10:07:32 +02:00
chipsfb.c fbdev: chipsfb: add missing MODULE_DESCRIPTION() macro 2026-06-09 16:00:10 +02:00
cirrusfb.c fbdev: Consistently define pci_device_ids using named initializers 2026-06-07 18:25:41 +02:00
clps711x-fb.c fbdev: clps711x-fb: Remove unreachable unregister_framebuffer() call 2026-08-10 08:13:26 +02:00
cobalt_lcdfb.c fbdev: cobalt_lcdfb: Request memory region 2026-04-22 16:46:40 +02:00
controlfb.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
controlfb.h
cyber2000fb.c fbdev: cyber2000fb: Use strscpy() to copy device name 2026-06-09 16:00:11 +02:00
cyber2000fb.h fbdev/cyber2000fb: Unexport symbols 2025-06-16 09:07:03 +02:00
dnfb.c fbdev/dnfb: Initialize fb_ops to fbdev I/O-memory helpers 2023-10-19 12:55:07 +02:00
edid.h
efifb.c fbdev: efifb: fix memory leak in efifb_probe() 2026-06-07 18:25:42 +02:00
ep93xx-fb.c fbdev: Switch back to struct platform_driver::remove() 2024-10-08 21:47:18 +02:00
ffb.c fbdev: ffb: fix corrupted video output on Sun FFB1 2026-02-14 11:09:47 +01:00
fm2fb.c fbdev/fm2fb: Use fbdev I/O helpers 2023-08-04 15:54:35 +02:00
fsl-diu-fb.c fbdev: fsl-diu-fb: add missing device_remove_file() 2025-03-26 22:39:21 +01:00
g364fb.c fbdev/g364fb: fix build failure with mips 2023-09-02 08:18:40 -07:00
gbefb.c fbdev: gbefb: fix to use physical address instead of dma address 2025-11-15 13:46:45 +01:00
goldfishfb.c fbdev: goldfishfb: fail pan display on base-update timeout 2026-06-25 18:29:14 +02:00
grvga.c fbdev: grvga: Fix CLUT register address offset in comment 2026-06-09 16:00:10 +02:00
gxt4500.c fbdev: gxt4500fb: Use dev_err instead of printk 2025-11-15 13:46:45 +01:00
hecubafb.c fbdev: hecubafb: fix potential memory leak in hecubafb_probe() 2026-06-07 18:25:42 +02:00
hitfb.c fbdev: Switch back to struct platform_driver::remove() 2024-10-08 21:47:18 +02:00
hpfb.c fbdev: hpfb: Fix an error handling path in hpfb_dio_probe() 2024-08-30 18:42:38 +02:00
i740_reg.h
i740fb.c fbdev: i740fb: fix potential memory leak in i740fb_probe() 2026-06-07 18:25:42 +02:00
imsttfb.c fbdev: imsttfb: convert comma to semicolon 2024-09-02 13:54:26 +02:00
imxfb.c fbdev: imxfb: Use of_device_get_match_data() 2026-06-07 18:25:42 +02:00
Kconfig fbdev: mb862xx: replace dead select with dependency 2026-08-10 08:13:25 +02:00
leo.c fbdev: Constify struct sbus_mmap_map 2024-10-15 10:07:32 +02:00
macfb.c fbdev: macfb: Replace deprecated strcpy with strscpy 2026-03-09 13:06:48 +01:00
macmodes.c fbdev: Include <linux/export.h> 2025-06-16 09:06:19 +02:00
macmodes.h
Makefile fbdev: remove Hercules monochrome ISA graphics adapter driver 2026-05-20 20:23:32 +02:00
maxinefb.c fbdev: maxine: use MODULE_LICENSE() unconditionally 2026-08-20 23:45:07 +02:00
metronomefb.c fbdev: metronomefb: fix potential memory leak in metronomefb_probe() 2026-06-07 18:25:42 +02:00
n411.c
neofb.c fbdev: Consistently define pci_device_ids using named initializers 2026-06-07 18:25:41 +02:00
ocfb.c fbdev: Switch back to struct platform_driver::remove() 2024-10-08 21:47:18 +02:00
offb.c fbdev: offb: fix PCI device reference leak on probe failure 2026-04-22 15:45:38 +02:00
p9100.c fbdev: Constify struct sbus_mmap_map 2024-10-15 10:07:32 +02:00
platinumfb.c fbdev: platinumfb: add error checking for ioremap calls 2026-08-20 23:45:07 +02:00
platinumfb.h
pm2fb.c fbdev: pm2fb: unwind WC setup on probe failure 2026-06-25 14:05:05 +02:00
pm3fb.c fbdev: Consistently define pci_device_ids using named initializers 2026-06-07 18:25:41 +02:00
pmag-aa-fb.c fbdev/pmag-aa-fb: Use fbdev I/O helpers 2023-08-04 15:54:37 +02:00
pmag-ba-fb.c fbdev/pmag-ba-fb: Use fbdev I/O helpers 2023-08-04 15:54:37 +02:00
pmagb-b-fb.c fbdev/pmagb-b-fb: Use fbdev I/O helpers 2023-08-04 15:54:37 +02:00
ps3fb.c fbdev: Wrap user-invoked calls to fb_set_var() in helper 2026-06-09 16:00:10 +02:00
pvr2fb.c fbdev: pvr2fb: correct user pointer annotation and sentinel initializer 2026-08-10 08:13:25 +02:00
pxa3xx-gcu.c fbdev: pxa3xx-gcu: Remove redundant dev_err() 2026-08-10 08:13:25 +02:00
pxa3xx-gcu.h
pxa3xx-regs.h
pxa168fb.c fbdev: pxa168fb: Remove redundant dev_err() 2026-08-10 08:13:25 +02:00
pxa168fb.h
pxafb.c fbdev: pxafb: Remove redundant dev_err() 2026-08-10 08:13:25 +02:00
pxafb.h
q40fb.c fbdev/q40fb: Use fbdev I/O helpers 2023-08-04 15:54:38 +02:00
s1d13xxxfb.c fbdev: Switch back to struct platform_driver::remove() 2024-10-08 21:47:18 +02:00
s3c-fb.c fbdev: s3c-fb: Remove redundant dev_err() 2026-08-10 08:13:25 +02:00
s3fb.c fbdev: s3fb: Use strscpy() to copy strings into arrays 2026-06-09 16:06:07 +02:00
sa1100fb.c fbdev: sa1100fb: Remove redundant dev_err() 2026-08-10 08:13:25 +02:00
sa1100fb.h
sbuslib.c fbdev: Include <linux/export.h> 2025-06-16 09:06:19 +02:00
sbuslib.h fbdev: Constify struct sbus_mmap_map 2024-10-15 10:07:32 +02:00
sh_mobile_lcdcfb.c fbdev: Wrap user-invoked calls to fb_set_var() in helper 2026-06-09 16:00:10 +02:00
sh_mobile_lcdcfb.h
sh7760fb.c fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem() 2024-11-14 15:26:27 +01:00
simplefb.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
skeletonfb.c fbdev: Remove FBINFO_DEFAULT from framebuffer_alloc()'ed structs 2023-07-24 16:50:38 +02:00
sm501fb.c fbdev: sm501fb: Fix buffer errors in OF binding code 2026-06-09 16:00:17 +02:00
sm712.h fbdev: sm712: Fix operator precedence in big_swap macro 2026-06-09 16:00:10 +02:00
sm712fb.c fbdev/sm712fb: Use correct initializer macros for struct fb_ops 2023-11-29 12:20:10 +01:00
smscufx.c Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
ssd1307fb.c fbdev: ssd1307fb: fix NULL pointer dereference on missing match data 2026-09-10 21:57:59 +02:00
sstfb.c fbdev: sstfb: add missing MODULE_DEVICE_TABLE() 2026-08-10 08:13:25 +02:00
stifb.c fbdev: stifb: Fix crash in stifb_blank() 2024-01-23 09:13:24 +01:00
sunxvr500.c fbdev/sunxvr500: Initialize fb_ops to fbdev I/O-memory helpers 2023-10-19 12:56:55 +02:00
sunxvr1000.c Linux 6.5-rc7 2023-08-24 07:26:06 +10:00
sunxvr2500.c fbdev: sunxvr2500: replace printk with device-aware logging functions 2026-06-09 16:00:10 +02:00
tcx.c fbdev: tcx.c fix mem_map to correct smem_start offset 2025-12-02 19:44:05 +01:00
tdfxfb.c fbdev: tdfxfb: Program the initial video mode 2026-08-10 08:13:26 +02:00
tgafb.c vt: remove superfluous CONFIG_HW_CONSOLE 2024-01-27 19:03:51 -08:00
tridentfb.c fbdev: tridentfb: fix potential memory leak in trident_pci_probe() 2026-06-07 18:25:42 +02:00
udlfb.c fbdev: udlfb: validate vendor descriptor items 2026-08-10 08:13:25 +02:00
uvesafb.c fbdev: uvesafb: unregister connector callback on init failure 2026-08-10 08:13:25 +02:00
valkyriefb.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
valkyriefb.h
vesafb.c fbdev: vesafb: fix memory leak in vesafb_probe() 2026-06-07 18:25:42 +02:00
vfb.c fbdev: vfb: defer cleanup until the last reference 2026-09-10 22:52:02 +02:00
vga16fb.c fbdev: vga16fb: Drop unused assignment of platform_device_id driver data 2026-06-23 09:58:58 +02:00
vt8500lcdfb.c fbdev: vt8500lcdfb: fix missing dma_free_coherent() 2026-02-14 11:09:46 +01:00
vt8500lcdfb.h
vt8623fb.c fbdev: Consistently define pci_device_ids using named initializers 2026-06-07 18:25:41 +02:00
wm8505fb_regs.h
wm8505fb.c fbdev: Switch back to struct platform_driver::remove() 2024-10-08 21:47:18 +02:00
wmt_ge_rops.c fbdev: wmt_ge_rops: use devm_platform_ioremap_resource() 2026-03-09 13:06:48 +01:00
wmt_ge_rops.h
xen-fbfront.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
xilinxfb.c fbdev: Switch back to struct platform_driver::remove() 2024-10-08 21:47:18 +02:00