* [PATCH] staging: sm750fb: Add suspend checks to copyarea and imageblit
From: Chhabilal Dangal @ 2026-05-14 12:01 UTC (permalink / raw)
To: Greg Kroah-Hartman, Sudip Mukherjee
Cc: linux-fbdev, linux-staging, devel, Chhabilal Dangal
lynxfb_ops_fillrect() already checks info->state before accessing
the hardware 2D engine, but lynxfb_ops_copyarea() and
lynxfb_ops_imageblit() do not.
The suspend path calls fb_set_suspend(), which sets the framebuffer
state to FBINFO_STATE_SUSPENDED. Add matching state checks in the
remaining accelerated callbacks for consistency with fillrect().
Assisted-by: Claude Opus 4.6 (Anthropic LLM)
Compile-tested only.
Signed-off-by: Chhabilal Dangal <yogeshdangal66@gmail.com>
---
drivers/staging/sm750fb/sm750.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
index 9f3e3d37e..025ac8fe3 100644
--- a/drivers/staging/sm750fb/sm750.c
+++ b/drivers/staging/sm750fb/sm750.c
@@ -204,6 +204,9 @@ static void lynxfb_ops_copyarea(struct fb_info *info,
struct sm750_dev *sm750_dev;
unsigned int base, pitch, bpp;
+ if (info->state != FBINFO_STATE_RUNNING)
+ return;
+
par = info->par;
sm750_dev = par->dev;
@@ -239,6 +242,9 @@ static void lynxfb_ops_imageblit(struct fb_info *info,
struct lynxfb_par *par;
struct sm750_dev *sm750_dev;
+ if (info->state != FBINFO_STATE_RUNNING)
+ return;
+
par = info->par;
sm750_dev = par->dev;
/*
--
2.54.0
^ permalink raw reply related
* Re: [PATCH] staging: sm750fb: Add suspend checks to copyarea and imageblit
From: Greg Kroah-Hartman @ 2026-05-14 11:44 UTC (permalink / raw)
To: Chhabilal Dangal; +Cc: Sudip Mukherjee, linux-fbdev, devel, linux-kernel
In-Reply-To: <20260514104924.60296-1-yogeshdangal66@gmail.com>
On Thu, May 14, 2026 at 04:34:24PM +0545, Chhabilal Dangal wrote:
> lynxfb_ops_fillrect() already checks info->state before accessing
> the hardware 2D engine, but lynxfb_ops_copyarea() and
> lynxfb_ops_imageblit() do not.
>
> The suspend path calls fb_set_suspend(), which sets the framebuffer
> state to FBINFO_STATE_SUSPENDED. Add matching state checks in the
> remaining accelerated callbacks for consistency with fillrect().
>
> This patch was developed with AI assistance and is compile-tested only.
Please read the documentation for how to properly document LLM
assistance.
also, you aren't sending this to the right lists :(
thanks,
greg k-h
^ permalink raw reply
* [PATCH] staging: sm750fb: Add suspend checks to copyarea and imageblit
From: Chhabilal Dangal @ 2026-05-14 10:49 UTC (permalink / raw)
To: Greg Kroah-Hartman, Sudip Mukherjee
Cc: linux-fbdev, devel, linux-kernel, Chhabilal Dangal
lynxfb_ops_fillrect() already checks info->state before accessing
the hardware 2D engine, but lynxfb_ops_copyarea() and
lynxfb_ops_imageblit() do not.
The suspend path calls fb_set_suspend(), which sets the framebuffer
state to FBINFO_STATE_SUSPENDED. Add matching state checks in the
remaining accelerated callbacks for consistency with fillrect().
This patch was developed with AI assistance and is compile-tested only.
Signed-off-by: Chhabilal Dangal <yogeshdangal66@gmail.com>
---
drivers/staging/sm750fb/sm750.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
index 9f3e3d37e..025ac8fe3 100644
--- a/drivers/staging/sm750fb/sm750.c
+++ b/drivers/staging/sm750fb/sm750.c
@@ -204,6 +204,9 @@ static void lynxfb_ops_copyarea(struct fb_info *info,
struct sm750_dev *sm750_dev;
unsigned int base, pitch, bpp;
+ if (info->state != FBINFO_STATE_RUNNING)
+ return;
+
par = info->par;
sm750_dev = par->dev;
@@ -239,6 +242,9 @@ static void lynxfb_ops_imageblit(struct fb_info *info,
struct lynxfb_par *par;
struct sm750_dev *sm750_dev;
+ if (info->state != FBINFO_STATE_RUNNING)
+ return;
+
par = info->par;
sm750_dev = par->dev;
/*
--
2.54.0
^ permalink raw reply related
* Re: [PATCH] staging: sm750fb: Add suspend checks to copyarea and imageblit
From: Greg Kroah-Hartman @ 2026-05-14 10:44 UTC (permalink / raw)
To: Chhabilal Dangal; +Cc: Sudip Mukherjee, linux-fbdev, devel, linux-kernel
In-Reply-To: <20260514103042.55313-1-yogeshdangal66@gmail.com>
On Thu, May 14, 2026 at 04:15:42PM +0545, Chhabilal Dangal wrote:
> lynxfb_ops_fillrect() already checks info->state before accessing
> the hardware 2D engine, but lynxfb_ops_copyarea() and
> lynxfb_ops_imageblit() do not.
>
> The suspend path calls fb_set_suspend(), which sets the framebuffer
> state to FBINFO_STATE_SUSPENDED. Add matching state checks in the
> remaining accelerated callbacks for consistency with fillrect().
>
> This patch was developed with AI assistance and is compile-tested only.
> ---
> drivers/staging/sm750fb/sm750.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
> index 9f3e3d37e..025ac8fe3 100644
> --- a/drivers/staging/sm750fb/sm750.c
> +++ b/drivers/staging/sm750fb/sm750.c
> @@ -204,6 +204,9 @@ static void lynxfb_ops_copyarea(struct fb_info *info,
> struct sm750_dev *sm750_dev;
> unsigned int base, pitch, bpp;
>
> + if (info->state != FBINFO_STATE_RUNNING)
> + return;
> +
> par = info->par;
> sm750_dev = par->dev;
>
> @@ -239,6 +242,9 @@ static void lynxfb_ops_imageblit(struct fb_info *info,
> struct lynxfb_par *par;
> struct sm750_dev *sm750_dev;
>
> + if (info->state != FBINFO_STATE_RUNNING)
> + return;
> +
> par = info->par;
> sm750_dev = par->dev;
> /*
> --
> 2.54.0
>
Hi,
This is the friendly patch-bot of Greg Kroah-Hartman. You have sent him
a patch that has triggered this response. He used to manually respond
to these common problems, but in order to save his sanity (he kept
writing the same thing over and over, yet to different people), I was
created. Hopefully you will not take offence and will fix the problem
in your patch and resubmit it so that it can be accepted into the Linux
kernel tree.
You are receiving this message because of the following common error(s)
as indicated below:
- Your patch does not have a Signed-off-by: line. Please read the
kernel file, Documentation/process/submitting-patches.rst and resend
it after adding that line. Note, the line needs to be in the body of
the email, before the patch, not at the bottom of the patch or in the
email signature.
- This looks like a new version of a previously submitted patch, but you
did not list below the --- line any changes from the previous version.
Please read the section entitled "The canonical patch format" in the
kernel file, Documentation/process/submitting-patches.rst for what
needs to be done here to properly describe this.
If you wish to discuss this problem further, or you have questions about
how to resolve this issue, please feel free to respond to this email and
Greg will reply once he has dug out from the pending patches received
from other developers.
thanks,
greg k-h's patch email bot
^ permalink raw reply
* [PATCH] staging: sm750fb: Add suspend checks to copyarea and imageblit
From: Chhabilal Dangal @ 2026-05-14 10:30 UTC (permalink / raw)
To: Greg Kroah-Hartman, Sudip Mukherjee
Cc: linux-fbdev, devel, linux-kernel, Chhabilal Dangal
lynxfb_ops_fillrect() already checks info->state before accessing
the hardware 2D engine, but lynxfb_ops_copyarea() and
lynxfb_ops_imageblit() do not.
The suspend path calls fb_set_suspend(), which sets the framebuffer
state to FBINFO_STATE_SUSPENDED. Add matching state checks in the
remaining accelerated callbacks for consistency with fillrect().
This patch was developed with AI assistance and is compile-tested only.
---
drivers/staging/sm750fb/sm750.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
index 9f3e3d37e..025ac8fe3 100644
--- a/drivers/staging/sm750fb/sm750.c
+++ b/drivers/staging/sm750fb/sm750.c
@@ -204,6 +204,9 @@ static void lynxfb_ops_copyarea(struct fb_info *info,
struct sm750_dev *sm750_dev;
unsigned int base, pitch, bpp;
+ if (info->state != FBINFO_STATE_RUNNING)
+ return;
+
par = info->par;
sm750_dev = par->dev;
@@ -239,6 +242,9 @@ static void lynxfb_ops_imageblit(struct fb_info *info,
struct lynxfb_par *par;
struct sm750_dev *sm750_dev;
+ if (info->state != FBINFO_STATE_RUNNING)
+ return;
+
par = info->par;
sm750_dev = par->dev;
/*
--
2.54.0
^ permalink raw reply related
* [PATCH] fbcon: Use correct type for vc_resize() return value
From: Jiacheng Yu @ 2026-05-14 9:19 UTC (permalink / raw)
To: deller, tzimmermann, simona
Cc: sravankumarlpu, dri-devel, linux-fbdev, linux-kernel,
liuyongqiang13
The return value of vc_resize() is int, but fbcon_set_disp() stores it
in an unsigned long variable. While the !ret check happens to work
correctly by coincidence (negative values become large positive values),
the types should match. Use int instead.
Eliminates the following W=3 warning:
drivers/video/fbdev/core/fbcon.c: In function 'fbcon_set_disp':
drivers/video/fbdev/core/fbcon.c:1494:14: warning: implicit conversion from 'int' to 'unsigned long' [-Wconversion]
Fixes: af0db3c1f898 ("fbdev: Fix vmalloc out-of-bounds write in fast_imageblit")
Signed-off-by: Jiacheng Yu <yujiacheng3@huawei.com>
---
drivers/video/fbdev/core/fbcon.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index b0e3e765360d..641687a734d5 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -1440,8 +1440,7 @@ static void fbcon_set_disp(struct fb_info *info, struct fb_var_screeninfo *var,
struct vc_data **default_mode, *vc;
struct vc_data *svc;
struct fbcon_par *par = info->fbcon_par;
- int rows, cols;
- unsigned long ret = 0;
+ int rows, cols, ret;
p = &fb_display[unit];
--
2.34.1
^ permalink raw reply related
* Re: [PATCH] staging: sm750fb: add missing FBINFO_STATE_RUNNING checks in copyarea and imageblit
From: Dan Carpenter @ 2026-05-14 8:36 UTC (permalink / raw)
To: Chhabilal Dangal
Cc: Sudip Mukherjee, Teddy Wang, Greg Kroah-Hartman, linux-fbdev,
linux-staging, linux-kernel
In-Reply-To: <20260514080318.39332-1-yogeshdangal66@gmail.com>
On Thu, May 14, 2026 at 01:48:18PM +0545, Chhabilal Dangal wrote:
> lynxfb_ops_fillrect() correctly checks info->state before accessing the hardware 2D accelerator, returning early if the framebuffer is not in FBINFO_STATE_RUNNING state. However, lynxfb_ops_copyarea() and lynxfb_ops_imageblit() omit this guard despite using the same hardware accelerator through identical code paths.
>
> Without this check, the 2D engine could be accessed while the device is suspended (state set to FBINFO_STATE_SUSPENDED via fb_set_suspend()), potentially causing bus errors or system hangs.
>
> Add the missing state checks to both functions, matching the existing pattern in lynxfb_ops_fillrect().
>
> Signed-off-by: Chhabilal Dangal <yogeshdangal66@gmail.com>
> ---
1) Run your patches though checkpatch.
2) Add a fixes tag.
3) Put a note in the commit message that you are using AI and have not
tested your patch.
Smatch says that the state is always FBINFO_STATE_RUNNING so this patch
is unnecessary but I haven't looked at the code. Please check again and
resend if Smatch is wrong.
regards,
dan carpenter
^ permalink raw reply
* [PATCH 14/14] fbdev: sm501fb: fix potential memory leak in sm501fb_probe()
From: Abdun Nihaal @ 2026-05-14 8:24 UTC (permalink / raw)
To: Helge Deller, Javier Martinez Canillas, Thomas Zimmermann,
Benjamin Herrenschmidt, Andrew Morton, Sebastian Siewior,
Florian Tobias Schandinat, Ondrej Zary, Antonino Daplas,
Paul Mundt, Krzysztof Helt, Tomi Valkeinen, Michal Januszewski,
Heiko Schocher, Peter Jones
Cc: linux-fbdev, dri-devel, linux-kernel, stable, Abdun Nihaal
In-Reply-To: <20260514-fbdev-v1-0-b3a2474fa720@cse.iitm.ac.in>
The memory allocated for info->edid_data in sm501fb_probe() when
CONFIG_OF is defined is not freed in the subsequent error paths.
Fix that by freeing it in the error path if CONFIG_OF is defined.
Fixes: 4295f9bf74a8 ("video, sm501: add OF binding to support SM501")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
---
drivers/video/fbdev/sm501fb.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/video/fbdev/sm501fb.c b/drivers/video/fbdev/sm501fb.c
index fee4b9f84592..1ee7842517b8 100644
--- a/drivers/video/fbdev/sm501fb.c
+++ b/drivers/video/fbdev/sm501fb.c
@@ -2048,6 +2048,9 @@ static int sm501fb_probe(struct platform_device *pdev)
framebuffer_release(info->fb[HEAD_CRT]);
err_alloc:
+#if defined(CONFIG_OF)
+ kfree(info->edid_data);
+#endif
kfree(info);
return ret;
--
2.43.0
^ permalink raw reply related
* [PATCH 13/14] fbdev: vesafb: fix memory leak in vesafb_probe()
From: Abdun Nihaal @ 2026-05-14 8:24 UTC (permalink / raw)
To: Helge Deller, Javier Martinez Canillas, Thomas Zimmermann,
Benjamin Herrenschmidt, Andrew Morton, Sebastian Siewior,
Florian Tobias Schandinat, Ondrej Zary, Antonino Daplas,
Paul Mundt, Krzysztof Helt, Tomi Valkeinen, Michal Januszewski,
Heiko Schocher, Peter Jones
Cc: linux-fbdev, dri-devel, linux-kernel, stable, Abdun Nihaal
In-Reply-To: <20260514-fbdev-v1-0-b3a2474fa720@cse.iitm.ac.in>
Since commit 73ce73c30ba9 ("fbdev: Transfer video= option strings to
caller; clarify ownership") the string returned from fb_get_options()
is expected to be freed by the caller. But the string is not freed in
vesafb_probe(). Fix that by freeing the option string after setup.
Fixes: 73ce73c30ba9 ("fbdev: Transfer video= option strings to caller; clarify ownership")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
---
drivers/video/fbdev/vesafb.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/video/fbdev/vesafb.c b/drivers/video/fbdev/vesafb.c
index f84f4db244bf..f1902056bd73 100644
--- a/drivers/video/fbdev/vesafb.c
+++ b/drivers/video/fbdev/vesafb.c
@@ -269,6 +269,7 @@ static int vesafb_probe(struct platform_device *dev)
/* ignore error return of fb_get_options */
fb_get_options("vesafb", &option);
vesafb_setup(option);
+ kfree(option);
if (si->orig_video_isVGA != VIDEO_TYPE_VLFB)
return -ENODEV;
--
2.43.0
^ permalink raw reply related
* [PATCH 12/14] fbdev: efifb: fix memory leak in efifb_probe()
From: Abdun Nihaal @ 2026-05-14 8:24 UTC (permalink / raw)
To: Helge Deller, Javier Martinez Canillas, Thomas Zimmermann,
Benjamin Herrenschmidt, Andrew Morton, Sebastian Siewior,
Florian Tobias Schandinat, Ondrej Zary, Antonino Daplas,
Paul Mundt, Krzysztof Helt, Tomi Valkeinen, Michal Januszewski,
Heiko Schocher, Peter Jones
Cc: linux-fbdev, dri-devel, linux-kernel, stable, Abdun Nihaal
In-Reply-To: <20260514-fbdev-v1-0-b3a2474fa720@cse.iitm.ac.in>
Since commit 73ce73c30ba9 ("fbdev: Transfer video= option strings to
caller; clarify ownership") the string returned from fb_get_options()
is expected to be freed by the caller, but the string is not freed in
efifb_probe(). Fix that by freeing the option string after setup.
Fixes: 73ce73c30ba9 ("fbdev: Transfer video= option strings to caller; clarify ownership")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
---
drivers/video/fbdev/efifb.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/video/fbdev/efifb.c b/drivers/video/fbdev/efifb.c
index 47ebc0107209..ad8dec7807c3 100644
--- a/drivers/video/fbdev/efifb.c
+++ b/drivers/video/fbdev/efifb.c
@@ -377,6 +377,7 @@ static int efifb_probe(struct platform_device *dev)
if (fb_get_options("efifb", &option))
return -ENODEV;
efifb_setup(si, option);
+ kfree(option);
/* We don't get linelength from UGA Draw Protocol, only from
* EFI Graphics Protocol. So if it's not in DMI, and it's not
--
2.43.0
^ permalink raw reply related
* [PATCH 11/14] fbdev: uvesafb: fix potential memory leak in uvesafb_probe()
From: Abdun Nihaal @ 2026-05-14 8:24 UTC (permalink / raw)
To: Helge Deller, Javier Martinez Canillas, Thomas Zimmermann,
Benjamin Herrenschmidt, Andrew Morton, Sebastian Siewior,
Florian Tobias Schandinat, Ondrej Zary, Antonino Daplas,
Paul Mundt, Krzysztof Helt, Tomi Valkeinen, Michal Januszewski,
Heiko Schocher, Peter Jones
Cc: linux-fbdev, dri-devel, linux-kernel, stable, Abdun Nihaal
In-Reply-To: <20260514-fbdev-v1-0-b3a2474fa720@cse.iitm.ac.in>
Due to an incorrect goto label, memory allocated for modedb and modelist
in uvesafb_vbe_init() is not freed in some error paths. Fix this by
updating the goto label.
Fixes: 8bdb3a2d7df4 ("uvesafb: the driver core")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
---
drivers/video/fbdev/uvesafb.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/video/fbdev/uvesafb.c b/drivers/video/fbdev/uvesafb.c
index 88667fccc27b..9d82326c744f 100644
--- a/drivers/video/fbdev/uvesafb.c
+++ b/drivers/video/fbdev/uvesafb.c
@@ -1694,14 +1694,14 @@ static int uvesafb_probe(struct platform_device *dev)
i = uvesafb_vbe_init_mode(info);
if (i < 0) {
err = -EINVAL;
- goto out;
+ goto out_mode;
} else {
mode = &par->vbe_modes[i];
}
if (fb_alloc_cmap(&info->cmap, 256, 0) < 0) {
err = -ENXIO;
- goto out;
+ goto out_mode;
}
uvesafb_init_info(info, mode);
--
2.43.0
^ permalink raw reply related
* [PATCH 10/14] fbdev: tridentfb: fix potential memory leak in trident_pci_probe()
From: Abdun Nihaal @ 2026-05-14 8:24 UTC (permalink / raw)
To: Helge Deller, Javier Martinez Canillas, Thomas Zimmermann,
Benjamin Herrenschmidt, Andrew Morton, Sebastian Siewior,
Florian Tobias Schandinat, Ondrej Zary, Antonino Daplas,
Paul Mundt, Krzysztof Helt, Tomi Valkeinen, Michal Januszewski,
Heiko Schocher, Peter Jones
Cc: linux-fbdev, dri-devel, linux-kernel, stable, Abdun Nihaal
In-Reply-To: <20260514-fbdev-v1-0-b3a2474fa720@cse.iitm.ac.in>
In trident_pci_probe(), the memory allocated for modelist using
fb_videomode_to_modelist() is not freed in subsequent error paths.
Fix that by calling fb_destroy_modelist().
Fixes: 6a5e3bd0c8bc ("tridentfb: Add DDC support")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
---
drivers/video/fbdev/tridentfb.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/video/fbdev/tridentfb.c b/drivers/video/fbdev/tridentfb.c
index a8fdbae83a80..9f055ba776c8 100644
--- a/drivers/video/fbdev/tridentfb.c
+++ b/drivers/video/fbdev/tridentfb.c
@@ -1706,6 +1706,7 @@ static int trident_pci_probe(struct pci_dev *dev,
return 0;
out_unmap2:
+ fb_destroy_modelist(&info->modelist);
if (default_par->ddc_registered)
i2c_del_adapter(&default_par->ddc_adapter);
kfree(info->pixmap.addr);
--
2.43.0
^ permalink raw reply related
* [PATCH 09/14] fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()
From: Abdun Nihaal @ 2026-05-14 8:24 UTC (permalink / raw)
To: Helge Deller, Javier Martinez Canillas, Thomas Zimmermann,
Benjamin Herrenschmidt, Andrew Morton, Sebastian Siewior,
Florian Tobias Schandinat, Ondrej Zary, Antonino Daplas,
Paul Mundt, Krzysztof Helt, Tomi Valkeinen, Michal Januszewski,
Heiko Schocher, Peter Jones
Cc: linux-fbdev, dri-devel, linux-kernel, stable, Abdun Nihaal
In-Reply-To: <20260514-fbdev-v1-0-b3a2474fa720@cse.iitm.ac.in>
In tdfxfb_probe(), the memory allocated for modelist using
fb_videomode_to_modelist() when CONFIG_FB_3DFX_I2C is defined, is not
freed in the subsequent error paths.
Fix that by calling fb_destroy_modelist().
Fixes: 215059d2421f ("tdfxfb: make use of DDC information about connected monitor")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
---
drivers/video/fbdev/tdfxfb.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/video/fbdev/tdfxfb.c b/drivers/video/fbdev/tdfxfb.c
index a6b63c09b48f..cc6a074f3165 100644
--- a/drivers/video/fbdev/tdfxfb.c
+++ b/drivers/video/fbdev/tdfxfb.c
@@ -1552,6 +1552,7 @@ static int tdfxfb_probe(struct pci_dev *pdev, const struct pci_device_id *id)
out_err_iobase:
#ifdef CONFIG_FB_3DFX_I2C
+ fb_destroy_modelist(&info->modelist);
tdfxfb_delete_i2c_busses(default_par);
#endif
arch_phys_wc_del(default_par->wc_cookie);
--
2.43.0
^ permalink raw reply related
* [PATCH 08/14] fbdev: s3fb: fix potential memory leak in s3_pci_probe()
From: Abdun Nihaal @ 2026-05-14 8:24 UTC (permalink / raw)
To: Helge Deller, Javier Martinez Canillas, Thomas Zimmermann,
Benjamin Herrenschmidt, Andrew Morton, Sebastian Siewior,
Florian Tobias Schandinat, Ondrej Zary, Antonino Daplas,
Paul Mundt, Krzysztof Helt, Tomi Valkeinen, Michal Januszewski,
Heiko Schocher, Peter Jones
Cc: linux-fbdev, dri-devel, linux-kernel, stable, Abdun Nihaal
In-Reply-To: <20260514-fbdev-v1-0-b3a2474fa720@cse.iitm.ac.in>
In s3_pci_probe(), the memory allocated for modelist using
fb_videomode_to_modelist() is not freed in subsequent error paths.
Fix that by calling fb_destroy_modelist()
Fixes: 86c0f043a737 ("s3fb: add DDC support")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
---
drivers/video/fbdev/s3fb.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/video/fbdev/s3fb.c b/drivers/video/fbdev/s3fb.c
index 831e9e6861b1..dc1f9b627185 100644
--- a/drivers/video/fbdev/s3fb.c
+++ b/drivers/video/fbdev/s3fb.c
@@ -1446,6 +1446,7 @@ static int s3_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
err_alloc_cmap:
err_find_mode:
#ifdef CONFIG_FB_S3_DDC
+ fb_destroy_modelist(&info->modelist);
if (par->ddc_registered)
i2c_del_adapter(&par->ddc_adapter);
if (par->mmio)
--
2.43.0
^ permalink raw reply related
* [PATCH 07/14] fbdev: nvidia: fix potential memory leak in nvidiafb_probe()
From: Abdun Nihaal @ 2026-05-14 8:24 UTC (permalink / raw)
To: Helge Deller, Javier Martinez Canillas, Thomas Zimmermann,
Benjamin Herrenschmidt, Andrew Morton, Sebastian Siewior,
Florian Tobias Schandinat, Ondrej Zary, Antonino Daplas,
Paul Mundt, Krzysztof Helt, Tomi Valkeinen, Michal Januszewski,
Heiko Schocher, Peter Jones
Cc: linux-fbdev, dri-devel, linux-kernel, stable, Abdun Nihaal
In-Reply-To: <20260514-fbdev-v1-0-b3a2474fa720@cse.iitm.ac.in>
In nvidiafb_probe(), the memory allocated for modelist in
nvidia_set_fbinfo() is not freed in the subsequent error paths.
Fix that by calling fb_destroy_modelist().
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
---
drivers/video/fbdev/nvidia/nvidia.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/video/fbdev/nvidia/nvidia.c b/drivers/video/fbdev/nvidia/nvidia.c
index da2d486022e8..7d20c4087aeb 100644
--- a/drivers/video/fbdev/nvidia/nvidia.c
+++ b/drivers/video/fbdev/nvidia/nvidia.c
@@ -1424,6 +1424,7 @@ static int nvidiafb_probe(struct pci_dev *pd, const struct pci_device_id *ent)
err_out_iounmap_fb:
iounmap(info->screen_base);
+ fb_destroy_modelist(&info->modelist);
err_out_free_base1:
fb_destroy_modedb(info->monspecs.modedb);
nvidia_delete_i2c_busses(par);
--
2.43.0
^ permalink raw reply related
* [PATCH 06/14] fbdev: i740fb: fix potential memory leak in i740fb_probe()
From: Abdun Nihaal @ 2026-05-14 8:24 UTC (permalink / raw)
To: Helge Deller, Javier Martinez Canillas, Thomas Zimmermann,
Benjamin Herrenschmidt, Andrew Morton, Sebastian Siewior,
Florian Tobias Schandinat, Ondrej Zary, Antonino Daplas,
Paul Mundt, Krzysztof Helt, Tomi Valkeinen, Michal Januszewski,
Heiko Schocher, Peter Jones
Cc: linux-fbdev, dri-devel, linux-kernel, stable, Abdun Nihaal
In-Reply-To: <20260514-fbdev-v1-0-b3a2474fa720@cse.iitm.ac.in>
In i740fb_probe(), the memory allocated in fb_videomode_to_modelist()
for modelist is not freed in the error paths. Fix that by calling
fb_destroy_modelist().
Fixes: 5350c65f4f15 ("Resurrect Intel740 driver: i740fb")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
---
drivers/video/fbdev/i740fb.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/video/fbdev/i740fb.c b/drivers/video/fbdev/i740fb.c
index 9b74dae71472..c14a19382769 100644
--- a/drivers/video/fbdev/i740fb.c
+++ b/drivers/video/fbdev/i740fb.c
@@ -1152,6 +1152,7 @@ static int i740fb_probe(struct pci_dev *dev, const struct pci_device_id *ent)
fb_dealloc_cmap(&info->cmap);
err_alloc_cmap:
err_find_mode:
+ fb_destroy_modelist(&info->modelist);
if (par->ddc_registered)
i2c_del_adapter(&par->ddc_adapter);
pci_iounmap(dev, par->regs);
--
2.43.0
^ permalink raw reply related
* [PATCH 05/14] fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()
From: Abdun Nihaal @ 2026-05-14 8:24 UTC (permalink / raw)
To: Helge Deller, Javier Martinez Canillas, Thomas Zimmermann,
Benjamin Herrenschmidt, Andrew Morton, Sebastian Siewior,
Florian Tobias Schandinat, Ondrej Zary, Antonino Daplas,
Paul Mundt, Krzysztof Helt, Tomi Valkeinen, Michal Januszewski,
Heiko Schocher, Peter Jones
Cc: linux-fbdev, dri-devel, linux-kernel, stable, Abdun Nihaal
In-Reply-To: <20260514-fbdev-v1-0-b3a2474fa720@cse.iitm.ac.in>
The memory allocated for modelist in fb_videomode_to_modelist() is not
freed in the subsequent error path.
Fix that by calling fb_destroy_modelist()
Fixes: 2ece5f43b041 ("fbdev: add the carmine FB driver")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
---
drivers/video/fbdev/carminefb.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/video/fbdev/carminefb.c b/drivers/video/fbdev/carminefb.c
index 5f13f1cc79d3..fca50b7961eb 100644
--- a/drivers/video/fbdev/carminefb.c
+++ b/drivers/video/fbdev/carminefb.c
@@ -589,6 +589,7 @@ static int alloc_carmine_fb(void __iomem *regs, void __iomem *smem_base,
return 0;
err_dealloc_cmap:
+ fb_destroy_modelist(&info->modelist);
fb_dealloc_cmap(&info->cmap);
err_free_fb:
framebuffer_release(info);
--
2.43.0
^ permalink raw reply related
* [PATCH 04/14] fbdev: radeon: fix potential memory leak in radeonfb_pci_register()
From: Abdun Nihaal @ 2026-05-14 8:24 UTC (permalink / raw)
To: Helge Deller, Javier Martinez Canillas, Thomas Zimmermann,
Benjamin Herrenschmidt, Andrew Morton, Sebastian Siewior,
Florian Tobias Schandinat, Ondrej Zary, Antonino Daplas,
Paul Mundt, Krzysztof Helt, Tomi Valkeinen, Michal Januszewski,
Heiko Schocher, Peter Jones
Cc: linux-fbdev, dri-devel, linux-kernel, stable, Abdun Nihaal
In-Reply-To: <20260514-fbdev-v1-0-b3a2474fa720@cse.iitm.ac.in>
The function radeonfb_pci_register() allocates memory for modelist
(by calling radeon_check_modes() which calls fb_add_videomode()).
The memory is appended to info->modelist, but is not freed in subsequent
error paths. Fix this by calling fb_destroy_modelist().
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
---
drivers/video/fbdev/aty/radeon_base.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/video/fbdev/aty/radeon_base.c b/drivers/video/fbdev/aty/radeon_base.c
index adb03489bedf..b6b058cee751 100644
--- a/drivers/video/fbdev/aty/radeon_base.c
+++ b/drivers/video/fbdev/aty/radeon_base.c
@@ -2476,6 +2476,7 @@ static int radeonfb_pci_register(struct pci_dev *pdev,
return 0;
err_unmap_fb:
iounmap(rinfo->fb_base);
+ fb_destroy_modelist(&info->modelist);
err_unmap_rom:
kfree(rinfo->mon1_EDID);
kfree(rinfo->mon2_EDID);
--
2.43.0
^ permalink raw reply related
* [PATCH 03/14] fbdev: metronomefb: fix potential memory leak in metronomefb_probe()
From: Abdun Nihaal @ 2026-05-14 8:24 UTC (permalink / raw)
To: Helge Deller, Javier Martinez Canillas, Thomas Zimmermann,
Benjamin Herrenschmidt, Andrew Morton, Sebastian Siewior,
Florian Tobias Schandinat, Ondrej Zary, Antonino Daplas,
Paul Mundt, Krzysztof Helt, Tomi Valkeinen, Michal Januszewski,
Heiko Schocher, Peter Jones
Cc: linux-fbdev, dri-devel, linux-kernel, stable, Abdun Nihaal
In-Reply-To: <20260514-fbdev-v1-0-b3a2474fa720@cse.iitm.ac.in>
The memory allocated for pagerefs in fb_deferred_io_init() is not freed
on the error path. Fix it by calling fb_deferred_io_cleanup().
Fixes: 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
---
drivers/video/fbdev/metronomefb.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/video/fbdev/metronomefb.c b/drivers/video/fbdev/metronomefb.c
index 6f0942c6e5f1..83c614963a0a 100644
--- a/drivers/video/fbdev/metronomefb.c
+++ b/drivers/video/fbdev/metronomefb.c
@@ -645,12 +645,14 @@ static int metronomefb_probe(struct platform_device *dev)
info->flags = FBINFO_VIRTFB;
info->fbdefio = &metronomefb_defio;
- fb_deferred_io_init(info);
+ retval = fb_deferred_io_init(info);
+ if (retval)
+ goto err_free_irq;
retval = fb_alloc_cmap(&info->cmap, 8, 0);
if (retval < 0) {
dev_err(&dev->dev, "Failed to allocate colormap\n");
- goto err_free_irq;
+ goto err_fbdefio;
}
/* set cmap */
@@ -673,6 +675,8 @@ static int metronomefb_probe(struct platform_device *dev)
err_cmap:
fb_dealloc_cmap(&info->cmap);
+err_fbdefio:
+ fb_deferred_io_cleanup(info);
err_free_irq:
board->cleanup(par);
err_csum_table:
--
2.43.0
^ permalink raw reply related
* [PATCH 02/14] fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe()
From: Abdun Nihaal @ 2026-05-14 8:24 UTC (permalink / raw)
To: Helge Deller, Javier Martinez Canillas, Thomas Zimmermann,
Benjamin Herrenschmidt, Andrew Morton, Sebastian Siewior,
Florian Tobias Schandinat, Ondrej Zary, Antonino Daplas,
Paul Mundt, Krzysztof Helt, Tomi Valkeinen, Michal Januszewski,
Heiko Schocher, Peter Jones
Cc: linux-fbdev, dri-devel, linux-kernel, stable, Abdun Nihaal
In-Reply-To: <20260514-fbdev-v1-0-b3a2474fa720@cse.iitm.ac.in>
The memory allocated for pagerefs in fb_deferred_io_init() is not freed
on the error path. Fix it by calling fb_deferred_io_cleanup().
Fixes: 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
---
drivers/video/fbdev/broadsheetfb.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/video/fbdev/broadsheetfb.c b/drivers/video/fbdev/broadsheetfb.c
index c8ba098a8c42..582f1ee4c9b6 100644
--- a/drivers/video/fbdev/broadsheetfb.c
+++ b/drivers/video/fbdev/broadsheetfb.c
@@ -1072,12 +1072,14 @@ static int broadsheetfb_probe(struct platform_device *dev)
info->flags = FBINFO_VIRTFB;
info->fbdefio = &broadsheetfb_defio;
- fb_deferred_io_init(info);
+ retval = fb_deferred_io_init(info);
+ if (retval)
+ goto err_vfree;
retval = fb_alloc_cmap(&info->cmap, 16, 0);
if (retval < 0) {
dev_err(&dev->dev, "Failed to allocate colormap\n");
- goto err_vfree;
+ goto err_fbdefio;
}
/* set cmap */
@@ -1121,6 +1123,8 @@ static int broadsheetfb_probe(struct platform_device *dev)
board->cleanup(par);
err_cmap:
fb_dealloc_cmap(&info->cmap);
+err_fbdefio:
+ fb_deferred_io_cleanup(info);
err_vfree:
vfree(videomemory);
err_fb_rel:
--
2.43.0
^ permalink raw reply related
* [PATCH 01/14] fbdev: hecubafb: fix potential memory leak in hecubafb_probe()
From: Abdun Nihaal @ 2026-05-14 8:24 UTC (permalink / raw)
To: Helge Deller, Javier Martinez Canillas, Thomas Zimmermann,
Benjamin Herrenschmidt, Andrew Morton, Sebastian Siewior,
Florian Tobias Schandinat, Ondrej Zary, Antonino Daplas,
Paul Mundt, Krzysztof Helt, Tomi Valkeinen, Michal Januszewski,
Heiko Schocher, Peter Jones
Cc: linux-fbdev, dri-devel, linux-kernel, stable, Abdun Nihaal
In-Reply-To: <20260514-fbdev-v1-0-b3a2474fa720@cse.iitm.ac.in>
The memory allocated for pagerefs in fb_deferred_io_init() is not freed
on the error path. Fix it by calling fb_deferred_io_cleanup().
Fixes: 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
---
drivers/video/fbdev/hecubafb.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/video/fbdev/hecubafb.c b/drivers/video/fbdev/hecubafb.c
index 3547d58a29cf..dd2af980f3d8 100644
--- a/drivers/video/fbdev/hecubafb.c
+++ b/drivers/video/fbdev/hecubafb.c
@@ -192,7 +192,9 @@ static int hecubafb_probe(struct platform_device *dev)
info->flags = FBINFO_VIRTFB;
info->fbdefio = &hecubafb_defio;
- fb_deferred_io_init(info);
+ retval = fb_deferred_io_init(info);
+ if (retval)
+ goto err_fbdefio;
retval = register_framebuffer(info);
if (retval < 0)
@@ -209,6 +211,8 @@ static int hecubafb_probe(struct platform_device *dev)
return 0;
err_fbreg:
+ fb_deferred_io_cleanup(info);
+err_fbdefio:
framebuffer_release(info);
err_fballoc:
vfree(videomemory);
--
2.43.0
^ permalink raw reply related
* [PATCH 00/14] fbdev: fix various memory leaks
From: Abdun Nihaal @ 2026-05-14 8:24 UTC (permalink / raw)
To: Helge Deller, Javier Martinez Canillas, Thomas Zimmermann,
Benjamin Herrenschmidt, Andrew Morton, Sebastian Siewior,
Florian Tobias Schandinat, Ondrej Zary, Antonino Daplas,
Paul Mundt, Krzysztof Helt, Tomi Valkeinen, Michal Januszewski,
Heiko Schocher, Peter Jones
Cc: linux-fbdev, dri-devel, linux-kernel, stable, Abdun Nihaal
This patchset fixes some memory leak issues present in fbdev drivers.
Since commit 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct")
fb_deferred_io_init() allocated memory for pagerefs and returned an
error code, but the existing drivers which call fb_deferred_io_init()
were not updated to do cleanup. The first three commits address this.
- fbdev: hecubafb: fix potential memory leak in hecubafb_probe()
- fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe()
- fbdev: metronomefb: fix potential memory leak in metronomefb_probe()
Probe functions that call fb_add_videomode() or fb_videomode_to_modelist()
sometimes did not call fb_destry_modelist() to free the allocated
memory. The following patches address this issue.
- fbdev: radeon: fix potential memory leak in radeonfb_pci_register()
- fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()
- fbdev: i740fb: fix potential memory leak in i740fb_probe()
- fbdev: nvidia: fix potential memory leak in nvidiafb_probe()
- fbdev: s3fb: fix potential memory leak in s3_pci_probe()
- fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()
- fbdev: tridentfb: fix potential memory leak in trident_pci_probe()
- fbdev: uvesafb: fix potential memory leak in uvesafb_probe()
Since commit 73ce73c30ba9 ("fbdev: Transfer video= option strings to caller; clarify ownership")
the fb_get_options() function transfers ownership of the memory
allocated for options, and so the caller is expected to free it. The
following two patches address this issue.
- fbdev: efifb: fix memory leak in efifb_probe()
- fbdev: vesafb: fix memory leak in vesafb_probe()
The following commit fixes a simple memory leak.
- fbdev: sm501fb: fix potential memory leak in sm501fb_probe()
All the patches were only compile tested.
The issues were found using static analysis.
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
---
Abdun Nihaal (14):
fbdev: hecubafb: fix potential memory leak in hecubafb_probe()
fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe()
fbdev: metronomefb: fix potential memory leak in metronomefb_probe()
fbdev: radeon: fix potential memory leak in radeonfb_pci_register()
fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()
fbdev: i740fb: fix potential memory leak in i740fb_probe()
fbdev: nvidia: fix potential memory leak in nvidiafb_probe()
fbdev: s3fb: fix potential memory leak in s3_pci_probe()
fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()
fbdev: tridentfb: fix potential memory leak in trident_pci_probe()
fbdev: uvesafb: fix potential memory leak in uvesafb_probe()
fbdev: efifb: fix memory leak in efifb_probe()
fbdev: vesafb: fix memory leak in vesafb_probe()
fbdev: sm501fb: fix potential memory leak in sm501fb_probe()
drivers/video/fbdev/aty/radeon_base.c | 1 +
drivers/video/fbdev/broadsheetfb.c | 8 ++++++--
drivers/video/fbdev/carminefb.c | 1 +
drivers/video/fbdev/efifb.c | 1 +
drivers/video/fbdev/hecubafb.c | 6 +++++-
drivers/video/fbdev/i740fb.c | 1 +
drivers/video/fbdev/metronomefb.c | 8 ++++++--
drivers/video/fbdev/nvidia/nvidia.c | 1 +
drivers/video/fbdev/s3fb.c | 1 +
drivers/video/fbdev/sm501fb.c | 3 +++
drivers/video/fbdev/tdfxfb.c | 1 +
drivers/video/fbdev/tridentfb.c | 1 +
drivers/video/fbdev/uvesafb.c | 4 ++--
drivers/video/fbdev/vesafb.c | 1 +
14 files changed, 31 insertions(+), 7 deletions(-)
---
base-commit: ba2e787b4814ebf9ab5f6a84181678b67eb3677b
change-id: 20260513-fbdev-99a53dc0754f
Best regards,
--
Abdun Nihaal <nihaal@cse.iitm.ac.in>
^ permalink raw reply
* [PATCH] staging: sm750fb: add missing FBINFO_STATE_RUNNING checks in copyarea and imageblit
From: Chhabilal Dangal @ 2026-05-14 8:03 UTC (permalink / raw)
To: Sudip Mukherjee, Teddy Wang, Greg Kroah-Hartman
Cc: linux-fbdev, linux-staging, linux-kernel, Chhabilal Dangal
lynxfb_ops_fillrect() correctly checks info->state before accessing the hardware 2D accelerator, returning early if the framebuffer is not in FBINFO_STATE_RUNNING state. However, lynxfb_ops_copyarea() and lynxfb_ops_imageblit() omit this guard despite using the same hardware accelerator through identical code paths.
Without this check, the 2D engine could be accessed while the device is suspended (state set to FBINFO_STATE_SUSPENDED via fb_set_suspend()), potentially causing bus errors or system hangs.
Add the missing state checks to both functions, matching the existing pattern in lynxfb_ops_fillrect().
Signed-off-by: Chhabilal Dangal <yogeshdangal66@gmail.com>
---
drivers/staging/sm750fb/sm750.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
index 9f3e3d37e..025ac8fe3 100644
--- a/drivers/staging/sm750fb/sm750.c
+++ b/drivers/staging/sm750fb/sm750.c
@@ -204,6 +204,9 @@ static void lynxfb_ops_copyarea(struct fb_info *info,
struct sm750_dev *sm750_dev;
unsigned int base, pitch, bpp;
+ if (info->state != FBINFO_STATE_RUNNING)
+ return;
+
par = info->par;
sm750_dev = par->dev;
@@ -239,6 +242,9 @@ static void lynxfb_ops_imageblit(struct fb_info *info,
struct lynxfb_par *par;
struct sm750_dev *sm750_dev;
+ if (info->state != FBINFO_STATE_RUNNING)
+ return;
+
par = info->par;
sm750_dev = par->dev;
/*
--
2.54.0
^ permalink raw reply related
* Re: [PATCH] fbdev: make sh_mobile_lcdc independent of FB_DEVICE
From: kernel test robot @ 2026-05-13 7:41 UTC (permalink / raw)
To: Melih Emik, Helge Deller, linux-fbdev, dri-devel
Cc: oe-kbuild-all, Thomas Zimmermann, Wei Liu, Prasanna Kumar T S M,
Zsolt Kajtar, Mukesh Rathor, linux-kernel
In-Reply-To: <20260509213041.BqkXfeyP@66089470-6549-4c3e-ae4b-211f3f79ee1e>
Hi Melih,
kernel test robot noticed the following build errors:
[auto build test ERROR on drm-misc/drm-misc-next]
[also build test ERROR on drm-tip/drm-tip linus/master v7.1-rc3 next-20260508]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Melih-Emik/fbdev-make-sh_mobile_lcdc-independent-of-FB_DEVICE/20260512-235223
base: https://gitlab.freedesktop.org/drm/misc/kernel.git drm-misc-next
patch link: https://lore.kernel.org/r/20260509213041.BqkXfeyP%4066089470-6549-4c3e-ae4b-211f3f79ee1e
patch subject: [PATCH] fbdev: make sh_mobile_lcdc independent of FB_DEVICE
config: powerpc64-randconfig-r111-20260513 (https://download.01.org/0day-ci/archive/20260513/202605131530.ZsNIZEco-lkp@intel.com/config)
compiler: powerpc64-linux-gcc (GCC) 8.5.0
sparse: v0.6.5-rc1
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260513/202605131530.ZsNIZEco-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202605131530.ZsNIZEco-lkp@intel.com/
All errors (new ones prefixed by >>):
In file included from include/linux/device.h:15,
from include/linux/backlight.h:12,
from drivers/video/fbdev/sh_mobile_lcdcfb.c:12:
drivers/video/fbdev/sh_mobile_lcdcfb.c: In function 'sh_mobile_lcdc_release':
>> drivers/video/fbdev/sh_mobile_lcdcfb.c:1787:14: error: 'struct fb_info' has no member named 'dev'
dev_dbg(info->dev, "%s(): %d users\n", __func__, ch->use_count);
^~
include/linux/dev_printk.h:139:23: note: in definition of macro 'dev_no_printk'
_dev_printk(level, dev, fmt, ##__VA_ARGS__); \
^~~
drivers/video/fbdev/sh_mobile_lcdcfb.c:1787:2: note: in expansion of macro 'dev_dbg'
dev_dbg(info->dev, "%s(): %d users\n", __func__, ch->use_count);
^~~~~~~
drivers/video/fbdev/sh_mobile_lcdcfb.c: In function 'sh_mobile_lcdc_open':
drivers/video/fbdev/sh_mobile_lcdcfb.c:1810:14: error: 'struct fb_info' has no member named 'dev'
dev_dbg(info->dev, "%s(): %d users\n", __func__, ch->use_count);
^~
include/linux/dev_printk.h:139:23: note: in definition of macro 'dev_no_printk'
_dev_printk(level, dev, fmt, ##__VA_ARGS__); \
^~~
drivers/video/fbdev/sh_mobile_lcdcfb.c:1810:2: note: in expansion of macro 'dev_dbg'
dev_dbg(info->dev, "%s(): %d users\n", __func__, ch->use_count);
^~~~~~~
drivers/video/fbdev/sh_mobile_lcdcfb.c: In function 'sh_mobile_lcdc_set_par':
drivers/video/fbdev/sh_mobile_lcdcfb.c:1894:15: error: 'struct fb_info' has no member named 'dev'
dev_err(info->dev, "%s: unable to restart LCDC\n", __func__);
^~
include/linux/dev_printk.h:110:11: note: in definition of macro 'dev_printk_index_wrap'
_p_func(dev, fmt, ##__VA_ARGS__); \
^~~
drivers/video/fbdev/sh_mobile_lcdcfb.c:1894:3: note: in expansion of macro 'dev_err'
dev_err(info->dev, "%s: unable to restart LCDC\n", __func__);
^~~~~~~
vim +1787 drivers/video/fbdev/sh_mobile_lcdcfb.c
dd210503b77ae0 drivers/video/sh_mobile_lcdcfb.c Guennadi Liakhovetski 2010-09-14 1777
dd210503b77ae0 drivers/video/sh_mobile_lcdcfb.c Guennadi Liakhovetski 2010-09-14 1778 /*
dd210503b77ae0 drivers/video/sh_mobile_lcdcfb.c Guennadi Liakhovetski 2010-09-14 1779 * Locking: both .fb_release() and .fb_open() are called with info->lock held if
dd210503b77ae0 drivers/video/sh_mobile_lcdcfb.c Guennadi Liakhovetski 2010-09-14 1780 * user == 1, or with console sem held, if user == 0.
dd210503b77ae0 drivers/video/sh_mobile_lcdcfb.c Guennadi Liakhovetski 2010-09-14 1781 */
d7ad3342186330 drivers/video/sh_mobile_lcdcfb.c Laurent Pinchart 2011-11-22 1782 static int sh_mobile_lcdc_release(struct fb_info *info, int user)
dd210503b77ae0 drivers/video/sh_mobile_lcdcfb.c Guennadi Liakhovetski 2010-09-14 1783 {
dd210503b77ae0 drivers/video/sh_mobile_lcdcfb.c Guennadi Liakhovetski 2010-09-14 1784 struct sh_mobile_lcdc_chan *ch = info->par;
dd210503b77ae0 drivers/video/sh_mobile_lcdcfb.c Guennadi Liakhovetski 2010-09-14 1785
dd210503b77ae0 drivers/video/sh_mobile_lcdcfb.c Guennadi Liakhovetski 2010-09-14 1786 mutex_lock(&ch->open_lock);
dd210503b77ae0 drivers/video/sh_mobile_lcdcfb.c Guennadi Liakhovetski 2010-09-14 @1787 dev_dbg(info->dev, "%s(): %d users\n", __func__, ch->use_count);
dd210503b77ae0 drivers/video/sh_mobile_lcdcfb.c Guennadi Liakhovetski 2010-09-14 1788
dd210503b77ae0 drivers/video/sh_mobile_lcdcfb.c Guennadi Liakhovetski 2010-09-14 1789 ch->use_count--;
dd210503b77ae0 drivers/video/sh_mobile_lcdcfb.c Guennadi Liakhovetski 2010-09-14 1790
dd210503b77ae0 drivers/video/sh_mobile_lcdcfb.c Guennadi Liakhovetski 2010-09-14 1791 /* Nothing to reconfigure, when called from fbcon */
dd210503b77ae0 drivers/video/sh_mobile_lcdcfb.c Guennadi Liakhovetski 2010-09-14 1792 if (user) {
ac751efa6a0d70 drivers/video/sh_mobile_lcdcfb.c Torben Hohn 2011-01-25 1793 console_lock();
dd210503b77ae0 drivers/video/sh_mobile_lcdcfb.c Guennadi Liakhovetski 2010-09-14 1794 sh_mobile_fb_reconfig(info);
ac751efa6a0d70 drivers/video/sh_mobile_lcdcfb.c Torben Hohn 2011-01-25 1795 console_unlock();
dd210503b77ae0 drivers/video/sh_mobile_lcdcfb.c Guennadi Liakhovetski 2010-09-14 1796 }
dd210503b77ae0 drivers/video/sh_mobile_lcdcfb.c Guennadi Liakhovetski 2010-09-14 1797
dd210503b77ae0 drivers/video/sh_mobile_lcdcfb.c Guennadi Liakhovetski 2010-09-14 1798 mutex_unlock(&ch->open_lock);
dd210503b77ae0 drivers/video/sh_mobile_lcdcfb.c Guennadi Liakhovetski 2010-09-14 1799
dd210503b77ae0 drivers/video/sh_mobile_lcdcfb.c Guennadi Liakhovetski 2010-09-14 1800 return 0;
dd210503b77ae0 drivers/video/sh_mobile_lcdcfb.c Guennadi Liakhovetski 2010-09-14 1801 }
dd210503b77ae0 drivers/video/sh_mobile_lcdcfb.c Guennadi Liakhovetski 2010-09-14 1802
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
* [PATCH 6.18 250/270] fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info
From: Greg Kroah-Hartman @ 2026-05-12 17:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Zimmermann, Helge Deller,
linux-fbdev, dri-devel, Sasha Levin
In-Reply-To: <20260512173938.452574370@linuxfoundation.org>
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <tzimmermann@suse.de>
[ Upstream commit 9ded47ad003f09a94b6a710b5c47f4aa5ceb7429 ]
Hold state of deferred I/O in struct fb_deferred_io_state. Allocate an
instance as part of initializing deferred I/O and remove it only after
the final mapping has been closed. If the fb_info and the contained
deferred I/O meanwhile goes away, clear struct fb_deferred_io_state.info
to invalidate the mapping. Any access will then result in a SIGBUS
signal.
Fixes a long-standing problem, where a device hot-unplug happens while
user space still has an active mapping of the graphics memory. The hot-
unplug frees the instance of struct fb_info. Accessing the memory will
operate on undefined state.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: 60b59beafba8 ("fbdev: mm: Deferred IO support")
Cc: Helge Deller <deller@gmx.de>
Cc: linux-fbdev@vger.kernel.org
Cc: dri-devel@lists.freedesktop.org
Cc: stable@vger.kernel.org # v2.6.22+
Signed-off-by: Helge Deller <deller@gmx.de>
[ replaced kzalloc_obj(*fbdefio_state) with kzalloc(sizeof(*fbdefio_state), GFP_KERNEL) ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/core/fb_defio.c | 178 ++++++++++++++++++++++++++++--------
include/linux/fb.h | 4
2 files changed, 145 insertions(+), 37 deletions(-)
--- a/drivers/video/fbdev/core/fb_defio.c
+++ b/drivers/video/fbdev/core/fb_defio.c
@@ -24,6 +24,75 @@
#include <linux/rmap.h>
#include <linux/pagemap.h>
+/*
+ * struct fb_deferred_io_state
+ */
+
+struct fb_deferred_io_state {
+ struct kref ref;
+
+ struct mutex lock; /* mutex that protects the pageref list */
+ /* fields protected by lock */
+ struct fb_info *info;
+};
+
+static struct fb_deferred_io_state *fb_deferred_io_state_alloc(void)
+{
+ struct fb_deferred_io_state *fbdefio_state;
+
+ fbdefio_state = kzalloc(sizeof(*fbdefio_state), GFP_KERNEL);
+ if (!fbdefio_state)
+ return NULL;
+
+ kref_init(&fbdefio_state->ref);
+ mutex_init(&fbdefio_state->lock);
+
+ return fbdefio_state;
+}
+
+static void fb_deferred_io_state_release(struct fb_deferred_io_state *fbdefio_state)
+{
+ mutex_destroy(&fbdefio_state->lock);
+
+ kfree(fbdefio_state);
+}
+
+static void fb_deferred_io_state_get(struct fb_deferred_io_state *fbdefio_state)
+{
+ kref_get(&fbdefio_state->ref);
+}
+
+static void __fb_deferred_io_state_release(struct kref *ref)
+{
+ struct fb_deferred_io_state *fbdefio_state =
+ container_of(ref, struct fb_deferred_io_state, ref);
+
+ fb_deferred_io_state_release(fbdefio_state);
+}
+
+static void fb_deferred_io_state_put(struct fb_deferred_io_state *fbdefio_state)
+{
+ kref_put(&fbdefio_state->ref, __fb_deferred_io_state_release);
+}
+
+/*
+ * struct vm_operations_struct
+ */
+
+static void fb_deferred_io_vm_open(struct vm_area_struct *vma)
+{
+ struct fb_deferred_io_state *fbdefio_state = vma->vm_private_data;
+
+ fb_deferred_io_state_get(fbdefio_state);
+}
+
+static void fb_deferred_io_vm_close(struct vm_area_struct *vma)
+{
+ struct fb_deferred_io_state *fbdefio_state = vma->vm_private_data;
+
+ fb_deferred_io_state_put(fbdefio_state);
+}
+
static struct page *fb_deferred_io_get_page(struct fb_info *info, unsigned long offs)
{
struct fb_deferred_io *fbdefio = info->fbdefio;
@@ -121,25 +190,46 @@ static void fb_deferred_io_pageref_put(s
/* this is to find and return the vmalloc-ed fb pages */
static vm_fault_t fb_deferred_io_fault(struct vm_fault *vmf)
{
+ struct fb_info *info;
unsigned long offset;
struct page *page;
- struct fb_info *info = vmf->vma->vm_private_data;
+ vm_fault_t ret;
+ struct fb_deferred_io_state *fbdefio_state = vmf->vma->vm_private_data;
+
+ mutex_lock(&fbdefio_state->lock);
+
+ info = fbdefio_state->info;
+ if (!info) {
+ ret = VM_FAULT_SIGBUS; /* our device is gone */
+ goto err_mutex_unlock;
+ }
offset = vmf->pgoff << PAGE_SHIFT;
- if (offset >= info->fix.smem_len)
- return VM_FAULT_SIGBUS;
+ if (offset >= info->fix.smem_len) {
+ ret = VM_FAULT_SIGBUS;
+ goto err_mutex_unlock;
+ }
page = fb_deferred_io_get_page(info, offset);
- if (!page)
- return VM_FAULT_SIGBUS;
+ if (!page) {
+ ret = VM_FAULT_SIGBUS;
+ goto err_mutex_unlock;
+ }
if (!vmf->vma->vm_file)
fb_err(info, "no mapping available\n");
BUG_ON(!info->fbdefio->mapping);
+ mutex_unlock(&fbdefio_state->lock);
+
vmf->page = page;
+
return 0;
+
+err_mutex_unlock:
+ mutex_unlock(&fbdefio_state->lock);
+ return ret;
}
int fb_deferred_io_fsync(struct file *file, loff_t start, loff_t end, int datasync)
@@ -166,15 +256,24 @@ EXPORT_SYMBOL_GPL(fb_deferred_io_fsync);
* Adds a page to the dirty list. Call this from struct
* vm_operations_struct.page_mkwrite.
*/
-static vm_fault_t fb_deferred_io_track_page(struct fb_info *info, unsigned long offset,
- struct page *page)
+static vm_fault_t fb_deferred_io_track_page(struct fb_deferred_io_state *fbdefio_state,
+ unsigned long offset, struct page *page)
{
- struct fb_deferred_io *fbdefio = info->fbdefio;
+ struct fb_info *info;
+ struct fb_deferred_io *fbdefio;
struct fb_deferred_io_pageref *pageref;
vm_fault_t ret;
/* protect against the workqueue changing the page list */
- mutex_lock(&fbdefio->lock);
+ mutex_lock(&fbdefio_state->lock);
+
+ info = fbdefio_state->info;
+ if (!info) {
+ ret = VM_FAULT_SIGBUS; /* our device is gone */
+ goto err_mutex_unlock;
+ }
+
+ fbdefio = info->fbdefio;
pageref = fb_deferred_io_pageref_get(info, offset, page);
if (WARN_ON_ONCE(!pageref)) {
@@ -192,50 +291,38 @@ static vm_fault_t fb_deferred_io_track_p
*/
lock_page(pageref->page);
- mutex_unlock(&fbdefio->lock);
+ mutex_unlock(&fbdefio_state->lock);
/* come back after delay to process the deferred IO */
schedule_delayed_work(&info->deferred_work, fbdefio->delay);
return VM_FAULT_LOCKED;
err_mutex_unlock:
- mutex_unlock(&fbdefio->lock);
+ mutex_unlock(&fbdefio_state->lock);
return ret;
}
-/*
- * fb_deferred_io_page_mkwrite - Mark a page as written for deferred I/O
- * @fb_info: The fbdev info structure
- * @vmf: The VM fault
- *
- * This is a callback we get when userspace first tries to
- * write to the page. We schedule a workqueue. That workqueue
- * will eventually mkclean the touched pages and execute the
- * deferred framebuffer IO. Then if userspace touches a page
- * again, we repeat the same scheme.
- *
- * Returns:
- * VM_FAULT_LOCKED on success, or a VM_FAULT error otherwise.
- */
-static vm_fault_t fb_deferred_io_page_mkwrite(struct fb_info *info, struct vm_fault *vmf)
+static vm_fault_t fb_deferred_io_page_mkwrite(struct fb_deferred_io_state *fbdefio_state,
+ struct vm_fault *vmf)
{
unsigned long offset = vmf->pgoff << PAGE_SHIFT;
struct page *page = vmf->page;
file_update_time(vmf->vma->vm_file);
- return fb_deferred_io_track_page(info, offset, page);
+ return fb_deferred_io_track_page(fbdefio_state, offset, page);
}
-/* vm_ops->page_mkwrite handler */
static vm_fault_t fb_deferred_io_mkwrite(struct vm_fault *vmf)
{
- struct fb_info *info = vmf->vma->vm_private_data;
+ struct fb_deferred_io_state *fbdefio_state = vmf->vma->vm_private_data;
- return fb_deferred_io_page_mkwrite(info, vmf);
+ return fb_deferred_io_page_mkwrite(fbdefio_state, vmf);
}
static const struct vm_operations_struct fb_deferred_io_vm_ops = {
+ .open = fb_deferred_io_vm_open,
+ .close = fb_deferred_io_vm_close,
.fault = fb_deferred_io_fault,
.page_mkwrite = fb_deferred_io_mkwrite,
};
@@ -252,7 +339,10 @@ int fb_deferred_io_mmap(struct fb_info *
vm_flags_set(vma, VM_DONTEXPAND | VM_DONTDUMP);
if (!(info->flags & FBINFO_VIRTFB))
vm_flags_set(vma, VM_IO);
- vma->vm_private_data = info;
+ vma->vm_private_data = info->fbdefio_state;
+
+ fb_deferred_io_state_get(info->fbdefio_state); /* released in vma->vm_ops->close() */
+
return 0;
}
EXPORT_SYMBOL_GPL(fb_deferred_io_mmap);
@@ -263,9 +353,10 @@ static void fb_deferred_io_work(struct w
struct fb_info *info = container_of(work, struct fb_info, deferred_work.work);
struct fb_deferred_io_pageref *pageref, *next;
struct fb_deferred_io *fbdefio = info->fbdefio;
+ struct fb_deferred_io_state *fbdefio_state = info->fbdefio_state;
/* here we wrprotect the page's mappings, then do all deferred IO. */
- mutex_lock(&fbdefio->lock);
+ mutex_lock(&fbdefio_state->lock);
#ifdef CONFIG_MMU
list_for_each_entry(pageref, &fbdefio->pagereflist, list) {
struct page *page = pageref->page;
@@ -283,12 +374,13 @@ static void fb_deferred_io_work(struct w
list_for_each_entry_safe(pageref, next, &fbdefio->pagereflist, list)
fb_deferred_io_pageref_put(pageref, info);
- mutex_unlock(&fbdefio->lock);
+ mutex_unlock(&fbdefio_state->lock);
}
int fb_deferred_io_init(struct fb_info *info)
{
struct fb_deferred_io *fbdefio = info->fbdefio;
+ struct fb_deferred_io_state *fbdefio_state;
struct fb_deferred_io_pageref *pagerefs;
unsigned long npagerefs;
int ret;
@@ -298,7 +390,11 @@ int fb_deferred_io_init(struct fb_info *
if (WARN_ON(!info->fix.smem_len))
return -EINVAL;
- mutex_init(&fbdefio->lock);
+ fbdefio_state = fb_deferred_io_state_alloc();
+ if (!fbdefio_state)
+ return -ENOMEM;
+ fbdefio_state->info = info;
+
INIT_DELAYED_WORK(&info->deferred_work, fb_deferred_io_work);
INIT_LIST_HEAD(&fbdefio->pagereflist);
if (fbdefio->delay == 0) /* set a default of 1 s */
@@ -315,10 +411,12 @@ int fb_deferred_io_init(struct fb_info *
info->npagerefs = npagerefs;
info->pagerefs = pagerefs;
+ info->fbdefio_state = fbdefio_state;
+
return 0;
err:
- mutex_destroy(&fbdefio->lock);
+ fb_deferred_io_state_release(fbdefio_state);
return ret;
}
EXPORT_SYMBOL_GPL(fb_deferred_io_init);
@@ -352,11 +450,19 @@ EXPORT_SYMBOL_GPL(fb_deferred_io_release
void fb_deferred_io_cleanup(struct fb_info *info)
{
struct fb_deferred_io *fbdefio = info->fbdefio;
+ struct fb_deferred_io_state *fbdefio_state = info->fbdefio_state;
fb_deferred_io_lastclose(info);
+ info->fbdefio_state = NULL;
+
+ mutex_lock(&fbdefio_state->lock);
+ fbdefio_state->info = NULL;
+ mutex_unlock(&fbdefio_state->lock);
+
+ fb_deferred_io_state_put(fbdefio_state);
+
kvfree(info->pagerefs);
- mutex_destroy(&fbdefio->lock);
fbdefio->mapping = NULL;
}
EXPORT_SYMBOL_GPL(fb_deferred_io_cleanup);
--- a/include/linux/fb.h
+++ b/include/linux/fb.h
@@ -217,13 +217,14 @@ struct fb_deferred_io {
unsigned long delay;
bool sort_pagereflist; /* sort pagelist by offset */
int open_count; /* number of opened files; protected by fb_info lock */
- struct mutex lock; /* mutex that protects the pageref list */
struct list_head pagereflist; /* list of pagerefs for touched pages */
struct address_space *mapping; /* page cache object for fb device */
/* callback */
struct page *(*get_page)(struct fb_info *info, unsigned long offset);
void (*deferred_io)(struct fb_info *info, struct list_head *pagelist);
};
+
+struct fb_deferred_io_state;
#endif
/*
@@ -490,6 +491,7 @@ struct fb_info {
unsigned long npagerefs;
struct fb_deferred_io_pageref *pagerefs;
struct fb_deferred_io *fbdefio;
+ struct fb_deferred_io_state *fbdefio_state;
#endif
const struct fb_ops *fbops;
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox