From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org
Cc: Thomas Zimmermann <tzimmermann@suse.de>,
Sui Jingfeng <suijingfeng@loongson.cn>,
Javier Martinez Canillas <javierm@redhat.com>,
Geert Uytterhoeven <geert+renesas@glider.be>,
Helge Deller <deller@gmx.de>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 6.1.y 1/5] fbdev: Don't re-validate info->state in fb_ops implementations
Date: Mon, 7 Sep 2026 21:05:41 -0400 [thread overview]
Message-ID: <20260908010545.1675830-1-sashal@kernel.org> (raw)
In-Reply-To: <2026090350-babble-bobbing-7765@gregkh>
From: Thomas Zimmermann <tzimmermann@suse.de>
[ Upstream commit 453bd91302f16ddb8a2f5eb3df9fda3206dbacef ]
The file-op entry points fb_read() and fb_write() verify that
info->state has been set to FBINFO_STATE_RUNNING. Remove the same
test from the implementations of struct fb_ops.{fb_read,fb_write}.
v2:
* also remove test from ivtvfb, braodsheetfb, hecubafb and
metronomefb (Geert)
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Tested-by: Sui Jingfeng <suijingfeng@loongson.cn>
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Acked-by: Helge Deller <deller@gmx.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20230428122452.4856-17-tzimmermann@suse.de
Stable-dep-of: 9ad709afdfa3 ("fbdev: ssd1307fb: defer I2C transfers from damage callbacks")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/ivtv/ivtvfb.c | 3 ---
drivers/video/fbdev/broadsheetfb.c | 3 ---
drivers/video/fbdev/core/fb_sys_fops.c | 6 ------
drivers/video/fbdev/hecubafb.c | 3 ---
drivers/video/fbdev/metronomefb.c | 3 ---
drivers/video/fbdev/sm712fb.c | 6 ------
6 files changed, 24 deletions(-)
diff --git a/drivers/media/pci/ivtv/ivtvfb.c b/drivers/media/pci/ivtv/ivtvfb.c
index a642becdc0d73..23e6cc5172d7f 100644
--- a/drivers/media/pci/ivtv/ivtvfb.c
+++ b/drivers/media/pci/ivtv/ivtvfb.c
@@ -378,9 +378,6 @@ static ssize_t ivtvfb_write(struct fb_info *info, const char __user *buf,
unsigned long dma_size;
u16 lead = 0, tail = 0;
- if (info->state != FBINFO_STATE_RUNNING)
- return -EPERM;
-
total_size = info->screen_size;
if (total_size == 0)
diff --git a/drivers/video/fbdev/broadsheetfb.c b/drivers/video/fbdev/broadsheetfb.c
index 49296ea9926c3..c694ab918978f 100644
--- a/drivers/video/fbdev/broadsheetfb.c
+++ b/drivers/video/fbdev/broadsheetfb.c
@@ -1013,9 +1013,6 @@ static ssize_t broadsheetfb_write(struct fb_info *info, const char __user *buf,
int err = 0;
unsigned long total_size;
- if (info->state != FBINFO_STATE_RUNNING)
- return -EPERM;
-
total_size = info->fix.smem_len;
if (p > total_size)
diff --git a/drivers/video/fbdev/core/fb_sys_fops.c b/drivers/video/fbdev/core/fb_sys_fops.c
index ff275d7f3eaf1..facf47a69483c 100644
--- a/drivers/video/fbdev/core/fb_sys_fops.c
+++ b/drivers/video/fbdev/core/fb_sys_fops.c
@@ -21,9 +21,6 @@ ssize_t fb_sys_read(struct fb_info *info, char __user *buf, size_t count,
int err = 0;
unsigned long total_size;
- if (info->state != FBINFO_STATE_RUNNING)
- return -EPERM;
-
total_size = info->screen_size;
if (total_size == 0)
@@ -61,9 +58,6 @@ ssize_t fb_sys_write(struct fb_info *info, const char __user *buf,
int err = 0;
unsigned long total_size;
- if (info->state != FBINFO_STATE_RUNNING)
- return -EPERM;
-
total_size = info->screen_size;
if (total_size == 0)
diff --git a/drivers/video/fbdev/hecubafb.c b/drivers/video/fbdev/hecubafb.c
index 962a155a5b3d0..f6be62ed42c5a 100644
--- a/drivers/video/fbdev/hecubafb.c
+++ b/drivers/video/fbdev/hecubafb.c
@@ -163,9 +163,6 @@ static ssize_t hecubafb_write(struct fb_info *info, const char __user *buf,
int err = 0;
unsigned long total_size;
- if (info->state != FBINFO_STATE_RUNNING)
- return -EPERM;
-
total_size = info->fix.smem_len;
if (p > total_size)
diff --git a/drivers/video/fbdev/metronomefb.c b/drivers/video/fbdev/metronomefb.c
index dcfbcb7523ad1..17307c00d46f0 100644
--- a/drivers/video/fbdev/metronomefb.c
+++ b/drivers/video/fbdev/metronomefb.c
@@ -523,9 +523,6 @@ static ssize_t metronomefb_write(struct fb_info *info, const char __user *buf,
int err = 0;
unsigned long total_size;
- if (info->state != FBINFO_STATE_RUNNING)
- return -EPERM;
-
total_size = info->fix.smem_len;
if (p > total_size)
diff --git a/drivers/video/fbdev/sm712fb.c b/drivers/video/fbdev/sm712fb.c
index 3baf33635e65f..b1bccb5f83e09 100644
--- a/drivers/video/fbdev/sm712fb.c
+++ b/drivers/video/fbdev/sm712fb.c
@@ -1031,9 +1031,6 @@ static ssize_t smtcfb_read(struct fb_info *info, char __user *buf,
if (!info || !info->screen_base)
return -ENODEV;
- if (info->state != FBINFO_STATE_RUNNING)
- return -EPERM;
-
total_size = info->screen_size;
if (total_size == 0)
@@ -1097,9 +1094,6 @@ static ssize_t smtcfb_write(struct fb_info *info, const char __user *buf,
if (!info || !info->screen_base)
return -ENODEV;
- if (info->state != FBINFO_STATE_RUNNING)
- return -EPERM;
-
total_size = info->screen_size;
if (total_size == 0)
--
2.53.0
next prev parent reply other threads:[~2026-09-08 1:05 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-03 13:41 FAILED: patch "[PATCH] fbdev: ssd1307fb: defer I2C transfers from damage callbacks" failed to apply to 6.1-stable tree gregkh
2026-09-08 1:05 ` Sasha Levin [this message]
2026-09-08 1:05 ` [PATCH 6.1.y 2/5] fbdev: Validate info->screen_{base, buffer} in fb_ops implementations Sasha Levin
2026-09-08 1:05 ` [PATCH 6.1.y 3/5] fbdev: Add initializer macros for struct fb_ops Sasha Levin
2026-09-08 1:05 ` [PATCH 6.1.y 4/5] fbdev/ssd1307fb: Generate deferred I/O ops Sasha Levin
2026-09-08 1:05 ` [PATCH 6.1.y 5/5] fbdev: ssd1307fb: defer I2C transfers from damage callbacks Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260908010545.1675830-1-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=deller@gmx.de \
--cc=geert+renesas@glider.be \
--cc=javierm@redhat.com \
--cc=stable@vger.kernel.org \
--cc=suijingfeng@loongson.cn \
--cc=tzimmermann@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.