From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org
Cc: Thomas Zimmermann <tzimmermann@suse.de>,
Sui Jingfeng <suijingfeng@loongson.cn>,
Javier Martinez Canillas <javierm@redhat.com>,
Helge Deller <deller@gmx.de>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.15.y 3/6] fbdev: Validate info->screen_{base, buffer} in fb_ops implementations
Date: Mon, 7 Sep 2026 21:18:12 -0400 [thread overview]
Message-ID: <20260908011815.1729727-3-sashal@kernel.org> (raw)
In-Reply-To: <20260908011815.1729727-1-sashal@kernel.org>
From: Thomas Zimmermann <tzimmermann@suse.de>
[ Upstream commit 3f8974f68f408f4983443b745a3cf95b06112469 ]
Push the test for info->screen_base from fb_read() and fb_write() into
the implementations of struct fb_ops.{fb_read,fb_write}. In cases where
the driver operates on info->screen_buffer, test this field instead.
While bothi fields, screen_base and screen_buffer, are stored in the
same location, they refer to different address spaces. For correctness,
we want to test each field in exactly the code that uses it.
v2:
* also test screen_base in pvr2fb (Geert)
* also test screen_buffer in ivtvfb, arcfb, broadsheetfb,
hecubafb, metronomefb and ssd1307fb (Geert)
* give a rational for the change (Geert)
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Tested-by: Sui Jingfeng <suijingfeng@loongson.cn>
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Acked-by: Helge Deller <deller@gmx.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20230428122452.4856-18-tzimmermann@suse.de
Stable-dep-of: 9ad709afdfa3 ("fbdev: ssd1307fb: defer I2C transfers from damage callbacks")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/ivtv/ivtvfb.c | 3 +++
drivers/video/fbdev/arcfb.c | 3 +++
drivers/video/fbdev/broadsheetfb.c | 3 +++
drivers/video/fbdev/cobalt_lcdfb.c | 6 ++++++
drivers/video/fbdev/core/fb_sys_fops.c | 6 ++++++
drivers/video/fbdev/core/fbmem.c | 10 ++++++++--
drivers/video/fbdev/hecubafb.c | 3 +++
drivers/video/fbdev/metronomefb.c | 3 +++
drivers/video/fbdev/pvr2fb.c | 3 +++
drivers/video/fbdev/sm712fb.c | 4 ++--
drivers/video/fbdev/ssd1307fb.c | 3 +++
11 files changed, 43 insertions(+), 4 deletions(-)
diff --git a/drivers/media/pci/ivtv/ivtvfb.c b/drivers/media/pci/ivtv/ivtvfb.c
index 96be1612d1f85..302a8a6bdeb0f 100644
--- a/drivers/media/pci/ivtv/ivtvfb.c
+++ b/drivers/media/pci/ivtv/ivtvfb.c
@@ -378,6 +378,9 @@ static ssize_t ivtvfb_write(struct fb_info *info, const char __user *buf,
unsigned long dma_size;
u16 lead = 0, tail = 0;
+ if (!info->screen_base)
+ return -ENODEV;
+
total_size = info->screen_size;
if (total_size == 0)
diff --git a/drivers/video/fbdev/arcfb.c b/drivers/video/fbdev/arcfb.c
index 024d0ee4f04f9..69a6cda61cebe 100644
--- a/drivers/video/fbdev/arcfb.c
+++ b/drivers/video/fbdev/arcfb.c
@@ -451,6 +451,9 @@ static ssize_t arcfb_write(struct fb_info *info, const char __user *buf,
struct arcfb_par *par;
unsigned int xres;
+ if (!info->screen_buffer)
+ return -ENODEV;
+
p = *ppos;
par = info->par;
xres = info->var.xres;
diff --git a/drivers/video/fbdev/broadsheetfb.c b/drivers/video/fbdev/broadsheetfb.c
index 31fc7f76af772..277d24bc5d3da 100644
--- a/drivers/video/fbdev/broadsheetfb.c
+++ b/drivers/video/fbdev/broadsheetfb.c
@@ -1014,6 +1014,9 @@ static ssize_t broadsheetfb_write(struct fb_info *info, const char __user *buf,
int err = 0;
unsigned long total_size;
+ if (!info->screen_buffer)
+ return -ENODEV;
+
total_size = info->fix.smem_len;
if (p > total_size)
diff --git a/drivers/video/fbdev/cobalt_lcdfb.c b/drivers/video/fbdev/cobalt_lcdfb.c
index 5f8b6324d2e8c..26dbd1c78195c 100644
--- a/drivers/video/fbdev/cobalt_lcdfb.c
+++ b/drivers/video/fbdev/cobalt_lcdfb.c
@@ -129,6 +129,9 @@ static ssize_t cobalt_lcdfb_read(struct fb_info *info, char __user *buf,
unsigned long pos;
int len, retval = 0;
+ if (!info->screen_base)
+ return -ENODEV;
+
pos = *ppos;
if (pos >= LCD_CHARS_MAX || count == 0)
return 0;
@@ -175,6 +178,9 @@ static ssize_t cobalt_lcdfb_write(struct fb_info *info, const char __user *buf,
unsigned long pos;
int len, retval = 0;
+ if (!info->screen_base)
+ return -ENODEV;
+
pos = *ppos;
if (pos >= LCD_CHARS_MAX || count == 0)
return 0;
diff --git a/drivers/video/fbdev/core/fb_sys_fops.c b/drivers/video/fbdev/core/fb_sys_fops.c
index facf47a69483c..432fa3fa7fa13 100644
--- a/drivers/video/fbdev/core/fb_sys_fops.c
+++ b/drivers/video/fbdev/core/fb_sys_fops.c
@@ -21,6 +21,9 @@ ssize_t fb_sys_read(struct fb_info *info, char __user *buf, size_t count,
int err = 0;
unsigned long total_size;
+ if (!info->screen_buffer)
+ return -ENODEV;
+
total_size = info->screen_size;
if (total_size == 0)
@@ -58,6 +61,9 @@ ssize_t fb_sys_write(struct fb_info *info, const char __user *buf,
int err = 0;
unsigned long total_size;
+ if (!info->screen_buffer)
+ return -ENODEV;
+
total_size = info->screen_size;
if (total_size == 0)
diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
index 78303cf740701..30edc0bee60cb 100644
--- a/drivers/video/fbdev/core/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
@@ -770,7 +770,7 @@ fb_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
int c, cnt = 0, err = 0;
unsigned long total_size;
- if (!info || ! info->screen_base)
+ if (!info)
return -ENODEV;
if (info->state != FBINFO_STATE_RUNNING)
@@ -779,6 +779,9 @@ fb_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
if (info->fbops->fb_read)
return info->fbops->fb_read(info, buf, count, ppos);
+ if (!info->screen_base)
+ return -ENODEV;
+
total_size = info->screen_size;
if (total_size == 0)
@@ -835,7 +838,7 @@ fb_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
int c, cnt = 0, err = 0;
unsigned long total_size;
- if (!info || !info->screen_base)
+ if (!info)
return -ENODEV;
if (info->state != FBINFO_STATE_RUNNING)
@@ -844,6 +847,9 @@ fb_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
if (info->fbops->fb_write)
return info->fbops->fb_write(info, buf, count, ppos);
+ if (!info->screen_base)
+ return -ENODEV;
+
total_size = info->screen_size;
if (total_size == 0)
diff --git a/drivers/video/fbdev/hecubafb.c b/drivers/video/fbdev/hecubafb.c
index f6be62ed42c5a..98e224a9641c7 100644
--- a/drivers/video/fbdev/hecubafb.c
+++ b/drivers/video/fbdev/hecubafb.c
@@ -163,6 +163,9 @@ static ssize_t hecubafb_write(struct fb_info *info, const char __user *buf,
int err = 0;
unsigned long total_size;
+ if (!info->screen_buffer)
+ return -ENODEV;
+
total_size = info->fix.smem_len;
if (p > total_size)
diff --git a/drivers/video/fbdev/metronomefb.c b/drivers/video/fbdev/metronomefb.c
index 23a3388880e79..417371de6b23e 100644
--- a/drivers/video/fbdev/metronomefb.c
+++ b/drivers/video/fbdev/metronomefb.c
@@ -524,6 +524,9 @@ static ssize_t metronomefb_write(struct fb_info *info, const char __user *buf,
int err = 0;
unsigned long total_size;
+ if (!info->screen_buffer)
+ return -ENODEV;
+
total_size = info->fix.smem_len;
if (p > total_size)
diff --git a/drivers/video/fbdev/pvr2fb.c b/drivers/video/fbdev/pvr2fb.c
index 3622254349120..0a27a980524c2 100644
--- a/drivers/video/fbdev/pvr2fb.c
+++ b/drivers/video/fbdev/pvr2fb.c
@@ -646,6 +646,9 @@ static ssize_t pvr2fb_write(struct fb_info *info, const char *buf,
struct page **pages;
int ret, i;
+ if (!info->screen_base)
+ return -ENODEV;
+
nr_pages = (count + PAGE_SIZE - 1) >> PAGE_SHIFT;
pages = kmalloc_array(nr_pages, sizeof(struct page *), GFP_KERNEL);
diff --git a/drivers/video/fbdev/sm712fb.c b/drivers/video/fbdev/sm712fb.c
index 41107d216b625..efaec92ed71fb 100644
--- a/drivers/video/fbdev/sm712fb.c
+++ b/drivers/video/fbdev/sm712fb.c
@@ -1027,7 +1027,7 @@ static ssize_t smtcfb_read(struct fb_info *info, char __user *buf,
int c, i, cnt = 0, err = 0;
unsigned long total_size;
- if (!info || !info->screen_base)
+ if (!info->screen_base)
return -ENODEV;
total_size = info->screen_size;
@@ -1090,7 +1090,7 @@ static ssize_t smtcfb_write(struct fb_info *info, const char __user *buf,
int c, i, cnt = 0, err = 0;
unsigned long total_size;
- if (!info || !info->screen_base)
+ if (!info->screen_base)
return -ENODEV;
total_size = info->screen_size;
diff --git a/drivers/video/fbdev/ssd1307fb.c b/drivers/video/fbdev/ssd1307fb.c
index 1604529a565d9..82f41770ca205 100644
--- a/drivers/video/fbdev/ssd1307fb.c
+++ b/drivers/video/fbdev/ssd1307fb.c
@@ -301,6 +301,9 @@ static ssize_t ssd1307fb_write(struct fb_info *info, const char __user *buf,
void *dst;
int ret;
+ if (!info->screen_buffer)
+ return -ENODEV;
+
total_size = info->fix.smem_len;
if (p > total_size)
--
2.53.0
next prev parent reply other threads:[~2026-09-08 1:18 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-03 13:41 FAILED: patch "[PATCH] fbdev: ssd1307fb: defer I2C transfers from damage callbacks" failed to apply to 5.15-stable tree gregkh
2026-09-08 1:18 ` [PATCH 5.15.y 1/6] fbdev: Put mmap for deferred I/O into drivers Sasha Levin
2026-09-08 1:18 ` [PATCH 5.15.y 2/6] fbdev: Don't re-validate info->state in fb_ops implementations Sasha Levin
2026-09-08 1:18 ` Sasha Levin [this message]
2026-09-08 1:18 ` [PATCH 5.15.y 4/6] fbdev: Add initializer macros for struct fb_ops Sasha Levin
2026-09-08 1:18 ` [PATCH 5.15.y 5/6] fbdev/ssd1307fb: Generate deferred I/O ops Sasha Levin
2026-09-08 1:18 ` [PATCH 5.15.y 6/6] fbdev: ssd1307fb: defer I2C transfers from damage callbacks Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260908011815.1729727-3-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=deller@gmx.de \
--cc=javierm@redhat.com \
--cc=stable@vger.kernel.org \
--cc=suijingfeng@loongson.cn \
--cc=tzimmermann@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.