* [PATCH] staging: fbtft: fix unaligned access and buffer size when startbyte is used
@ 2026-06-25 10:30 suryasaimadhu
2026-06-25 14:08 ` Andy Shevchenko
2026-06-26 6:48 ` David Laight
0 siblings, 2 replies; 3+ messages in thread
From: suryasaimadhu @ 2026-06-25 10:30 UTC (permalink / raw)
To: andy
Cc: gregkh, dri-devel, linux-fbdev, linux-staging, linux-kernel,
suryasaimadhu
When par->startbyte is non-zero, buf is advanced by one byte creating
an unaligned pointer for 16-bit types (u16, __be16). Dereferencing this
unaligned pointer can cause a kernel panic on strict-alignment
architectures.
Fix by using put_unaligned() instead of direct pointer dereference.
Also fix incorrect buffer size calculation in fbtft_write_buf_dc() call:
len * (sizeof(data_type) + offset) /* wrong: multiplies offset by len */
len * sizeof(data_type) + offset /* correct: one startbyte +
len items */
Signed-off-by: suryasaimadhu <suryasaimadhu369@gmail.com>
---
drivers/staging/fbtft/fbtft-bus.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/drivers/staging/fbtft/fbtft-bus.c b/drivers/staging/fbtft/fbtft-bus.c
index 2169f8d1d..cfcf4d7e7 100644
--- a/drivers/staging/fbtft/fbtft-bus.c
+++ b/drivers/staging/fbtft/fbtft-bus.c
@@ -4,6 +4,7 @@
#include <linux/gpio/consumer.h>
#include <linux/spi/spi.h>
#include "fbtft.h"
+#include <linux/unaligned.h>
/*****************************************************************************
*
@@ -40,7 +41,7 @@ void func(struct fbtft_par *par, int len, ...) \
offset = 1; \
} \
\
- *buf = modifier((data_type)va_arg(args, unsigned int)); \
+ put_unaligned(modifier((data_type)va_arg(args, unsigned int)), buf); \
ret = fbtft_write_buf_dc(par, par->buf, sizeof(data_type) + offset, \
0); \
if (ret < 0) \
@@ -52,11 +53,13 @@ void func(struct fbtft_par *par, int len, ...) \
\
if (len) { \
i = len; \
- while (i--) \
- *buf++ = modifier((data_type)va_arg(args, \
- unsigned int)); \
+ while (i--) { \
+ put_unaligned(modifier((data_type)va_arg(args, \
+ unsigned int)), buf); \
+ buf++; \
+ } \
fbtft_write_buf_dc(par, par->buf, \
- len * (sizeof(data_type) + offset), 1); \
+ len * sizeof(data_type) + offset, 1); \
} \
out: \
va_end(args); \
--
2.47.3
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] staging: fbtft: fix unaligned access and buffer size when startbyte is used
2026-06-25 10:30 [PATCH] staging: fbtft: fix unaligned access and buffer size when startbyte is used suryasaimadhu
@ 2026-06-25 14:08 ` Andy Shevchenko
2026-06-26 6:48 ` David Laight
1 sibling, 0 replies; 3+ messages in thread
From: Andy Shevchenko @ 2026-06-25 14:08 UTC (permalink / raw)
To: suryasaimadhu
Cc: andy, gregkh, dri-devel, linux-fbdev, linux-staging, linux-kernel
On Thu, Jun 25, 2026 at 06:30:41PM +0800, suryasaimadhu wrote:
> When par->startbyte is non-zero, buf is advanced by one byte creating
> an unaligned pointer for 16-bit types (u16, __be16). Dereferencing this
> unaligned pointer can cause a kernel panic on strict-alignment
> architectures.
>
> Fix by using put_unaligned() instead of direct pointer dereference.
>
> Also fix incorrect buffer size calculation in fbtft_write_buf_dc() call:
> len * (sizeof(data_type) + offset) /* wrong: multiplies offset by len */
> len * sizeof(data_type) + offset /* correct: one startbyte +
> len items */
Same comments as per your other patch contributions. Make it cleaner next time.
So it seem a v2 should be a mini-series with fixes for different
issues/drivers/et cetera.
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] staging: fbtft: fix unaligned access and buffer size when startbyte is used
2026-06-25 10:30 [PATCH] staging: fbtft: fix unaligned access and buffer size when startbyte is used suryasaimadhu
2026-06-25 14:08 ` Andy Shevchenko
@ 2026-06-26 6:48 ` David Laight
1 sibling, 0 replies; 3+ messages in thread
From: David Laight @ 2026-06-26 6:48 UTC (permalink / raw)
To: suryasaimadhu
Cc: andy, gregkh, dri-devel, linux-fbdev, linux-staging, linux-kernel
On Thu, 25 Jun 2026 18:30:41 +0800
suryasaimadhu <suryasaimadhu369@gmail.com> wrote:
> When par->startbyte is non-zero, buf is advanced by one byte creating
> an unaligned pointer for 16-bit types (u16, __be16). Dereferencing this
> unaligned pointer can cause a kernel panic on strict-alignment
> architectures.
>
> Fix by using put_unaligned() instead of direct pointer dereference.
>
> Also fix incorrect buffer size calculation in fbtft_write_buf_dc() call:
> len * (sizeof(data_type) + offset) /* wrong: multiplies offset by len */
> len * sizeof(data_type) + offset /* correct: one startbyte +
> len items */
That should probably be a separate patch.
>
> Signed-off-by: suryasaimadhu <suryasaimadhu369@gmail.com>
> ---
> drivers/staging/fbtft/fbtft-bus.c | 13 ++++++++-----
> 1 file changed, 8 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/staging/fbtft/fbtft-bus.c b/drivers/staging/fbtft/fbtft-bus.c
> index 2169f8d1d..cfcf4d7e7 100644
> --- a/drivers/staging/fbtft/fbtft-bus.c
> +++ b/drivers/staging/fbtft/fbtft-bus.c
> @@ -4,6 +4,7 @@
> #include <linux/gpio/consumer.h>
> #include <linux/spi/spi.h>
> #include "fbtft.h"
> +#include <linux/unaligned.h>
>
> /*****************************************************************************
> *
> @@ -40,7 +41,7 @@ void func(struct fbtft_par *par, int len, ...) \
I'd consider changing that to:
func(struct fbtft_par *par, int len, u8 cmd, ...)
and probably reducing len by one.
It makes it more obvious that the first parameter is mandatory and the ... is
associated data.
David
> offset = 1; \
> } \
> \
> - *buf = modifier((data_type)va_arg(args, unsigned int)); \
> + put_unaligned(modifier((data_type)va_arg(args, unsigned int)), buf); \
> ret = fbtft_write_buf_dc(par, par->buf, sizeof(data_type) + offset, \
> 0); \
> if (ret < 0) \
> @@ -52,11 +53,13 @@ void func(struct fbtft_par *par, int len, ...) \
> \
> if (len) { \
> i = len; \
> - while (i--) \
> - *buf++ = modifier((data_type)va_arg(args, \
> - unsigned int)); \
> + while (i--) { \
> + put_unaligned(modifier((data_type)va_arg(args, \
> + unsigned int)), buf); \
> + buf++; \
> + } \
> fbtft_write_buf_dc(par, par->buf, \
> - len * (sizeof(data_type) + offset), 1); \
> + len * sizeof(data_type) + offset, 1); \
> } \
> out: \
> va_end(args); \
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-06-26 6:48 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-25 10:30 [PATCH] staging: fbtft: fix unaligned access and buffer size when startbyte is used suryasaimadhu
2026-06-25 14:08 ` Andy Shevchenko
2026-06-26 6:48 ` David Laight
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox