* [PATCH 3/7] fbdev: pxa168fb: Remove redundant dev_err()
From: Pan Chuang @ 2026-07-22 7:57 UTC (permalink / raw)
To: Helge Deller, Pan Chuang, AlbertoArostegui,
open list:FRAMEBUFFER LAYER, open list:FRAMEBUFFER LAYER,
open list
In-Reply-To: <20260722075803.570532-1-panchuang@vivo.com>
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
devm_request_*_irq()"), devm_request_irq() automatically logs
detailed error messages on failure. Remove the now-redundant
driver-specific dev_err() call.
Signed-off-by: Pan Chuang <panchuang@vivo.com>
---
drivers/video/fbdev/pxa168fb.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/video/fbdev/pxa168fb.c b/drivers/video/fbdev/pxa168fb.c
index 6784888d93c9..ce8a823d7128 100644
--- a/drivers/video/fbdev/pxa168fb.c
+++ b/drivers/video/fbdev/pxa168fb.c
@@ -725,7 +725,6 @@ static int pxa168fb_probe(struct platform_device *pdev)
ret = devm_request_irq(&pdev->dev, irq, pxa168fb_handle_irq,
IRQF_SHARED, info->fix.id, fbi);
if (ret < 0) {
- dev_err(&pdev->dev, "unable to request IRQ\n");
ret = -ENXIO;
goto failed_free_cmap;
}
--
2.34.1
^ permalink raw reply related
* [PATCH 2/7] fbdev: omapfb/dsi-cm: Remove redundant dev_err()
From: Pan Chuang @ 2026-07-22 7:57 UTC (permalink / raw)
To: Helge Deller, Pan Chuang, Uwe Kleine-König (The Capable Hub),
Danilo Krummrich, Takashi Sakamoto, Bjorn Helgaas,
open list:OMAP DISPLAY SUBSYSTEM and FRAMEBUFFER SUPPORT...,
open list:OMAP DISPLAY SUBSYSTEM and FRAMEBUFFER SUPPORT...,
open list:FRAMEBUFFER LAYER, open list
In-Reply-To: <20260722075803.570532-1-panchuang@vivo.com>
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
devm_request_*_irq()"), devm_request_irq() automatically logs
detailed error messages on failure. Remove the now-redundant
driver-specific dev_err() call.
Signed-off-by: Pan Chuang <panchuang@vivo.com>
---
drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c b/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c
index 5e7963b4aa93..7c3463ee02ef 100644
--- a/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c
+++ b/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c
@@ -1185,10 +1185,8 @@ static int dsicm_probe(struct platform_device *pdev)
IRQF_TRIGGER_RISING,
"taal vsync", ddata);
- if (r) {
- dev_err(dev, "IRQ request failed\n");
+ if (r)
return r;
- }
INIT_DEFERRABLE_WORK(&ddata->te_timeout_work,
dsicm_te_timeout_work_callback);
--
2.34.1
^ permalink raw reply related
* [PATCH 1/7] fbdev: mmp: Remove redundant dev_err()
From: Pan Chuang @ 2026-07-22 7:57 UTC (permalink / raw)
To: Helge Deller, Kees Cook, Pan Chuang, open list:FRAMEBUFFER LAYER,
open list:FRAMEBUFFER LAYER, open list
In-Reply-To: <20260722075803.570532-1-panchuang@vivo.com>
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
devm_request_*_irq()"), devm_request_irq() automatically logs
detailed error messages on failure. Remove the now-redundant
driver-specific dev_err() call.
Signed-off-by: Pan Chuang <panchuang@vivo.com>
---
drivers/video/fbdev/mmp/hw/mmp_ctrl.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/video/fbdev/mmp/hw/mmp_ctrl.c b/drivers/video/fbdev/mmp/hw/mmp_ctrl.c
index 75bbdc0b4aa6..2c457da67a9f 100644
--- a/drivers/video/fbdev/mmp/hw/mmp_ctrl.c
+++ b/drivers/video/fbdev/mmp/hw/mmp_ctrl.c
@@ -505,8 +505,6 @@ static int mmphw_probe(struct platform_device *pdev)
ret = devm_request_irq(ctrl->dev, ctrl->irq, ctrl_handle_irq,
IRQF_SHARED, "lcd_controller", ctrl);
if (ret < 0) {
- dev_err(ctrl->dev, "%s unable to request IRQ %d\n",
- __func__, ctrl->irq);
ret = -ENXIO;
goto failed;
}
--
2.34.1
^ permalink raw reply related
* [PATCH 0/7] video: fbdev: Remove redundant dev_err()
From: Pan Chuang @ 2026-07-22 7:57 UTC (permalink / raw)
To: Helge Deller, Jingoo Han, Kees Cook, Pan Chuang, Bjorn Helgaas,
Takashi Sakamoto, Danilo Krummrich,
Uwe Kleine-König (The Capable Hub), AlbertoArostegui,
Thorsten Blum, Chelsy Ratnawat, open list:FRAMEBUFFER LAYER,
open list:FRAMEBUFFER LAYER, open list,
open list:OMAP DISPLAY SUBSYSTEM and FRAMEBUFFER SUPPORT...
devm_request_irq() automatically logs detailed error messages on
failure via the devm_request_result() helper, which prints device
name, IRQ number, handler functions, and error code.
Remove the now-redundant driver-specific dev_err() calls in fbdev
drivers, as the core now provides more detailed diagnostic
information on failure
Pan Chuang (7):
fbdev: mmp: Remove redundant dev_err()
fbdev: omapfb/dsi-cm: Remove redundant dev_err()
fbdev: pxa168fb: Remove redundant dev_err()
fbdev: pxa3xx-gcu: Remove redundant dev_err()
fbdev: pxafb: Remove redundant dev_err()
fbdev: s3c-fb: Remove redundant dev_err()
fbdev: sa1100fb: Remove redundant dev_err()
drivers/video/fbdev/mmp/hw/mmp_ctrl.c | 2 --
drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c | 4 +---
drivers/video/fbdev/pxa168fb.c | 1 -
drivers/video/fbdev/pxa3xx-gcu.c | 4 +---
drivers/video/fbdev/pxafb.c | 1 -
drivers/video/fbdev/s3c-fb.c | 4 +---
drivers/video/fbdev/sa1100fb.c | 4 +---
7 files changed, 4 insertions(+), 16 deletions(-)
--
2.34.1
^ permalink raw reply
* [PATCH] backlight: qcom-wled: Remove redundant dev_err()
From: Pan Chuang @ 2026-07-22 6:57 UTC (permalink / raw)
To: Lee Jones, Daniel Thompson, Jingoo Han, Helge Deller,
open list:ARM/QUALCOMM MAILING LIST,
open list:BACKLIGHT CLASS/SUBSYSTEM, open list:FRAMEBUFFER LAYER,
open list
Cc: Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
devm_request_*_irq()"), devm_request_threaded_irq() automatically logs
detailed error messages on failure. Remove the now-redundant
driver-specific dev_err() calls.
Signed-off-by: Pan Chuang <panchuang@vivo.com>
---
drivers/video/backlight/qcom-wled.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/video/backlight/qcom-wled.c b/drivers/video/backlight/qcom-wled.c
index 8054e4787725..650dd95f06ef 100644
--- a/drivers/video/backlight/qcom-wled.c
+++ b/drivers/video/backlight/qcom-wled.c
@@ -1639,8 +1639,6 @@ static int wled_configure_ovp_irq(struct wled *wled,
wled_ovp_irq_handler, IRQF_ONESHOT,
"wled_ovp_irq", wled);
if (rc < 0) {
- dev_err(wled->dev, "Unable to request ovp_irq (err:%d)\n",
- rc);
wled->ovp_irq = 0;
return 0;
}
--
2.34.1
^ permalink raw reply related
* [PATCH V2] fbdev: Fix out-of-bounds access when rotating console after font resize
From: Zizhi Wo @ 2026-07-22 6:22 UTC (permalink / raw)
To: simona, deller, tzimmermann, sam, ville.syrjala
Cc: linux-kernel, linux-fbdev, dri-devel, yangerkun, chengzhihao1,
wozizhi
From: Zizhi Wo <wozizhi@huawei.com>
[BUG]
Recently, we encountered a KASAN warning as follows:
BUG: KASAN: slab-out-of-bounds in ccw_putcs+0x8bd/0xa80
Read of size 1 at addr ff11000110067100 by task bash/1209
CPU: 10 UID: 0 PID: 1209 Comm: bash Not tainted 7.2.0-rc3 #69 PREEMPT(full)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014
Call Trace:
<TASK>
...
kasan_report+0xf0/0x120
? ccw_putcs+0x8bd/0xa80
ccw_putcs+0x8bd/0xa80
? __pfx_ccw_putcs+0x10/0x10
fbcon_putcs+0x338/0x410
? __pfx_ccw_putcs+0x10/0x10
do_update_region+0x21d/0x450
invert_screen+0x29d/0x5e0
? __kmalloc_noprof+0x493/0x640
? vc_do_resize+0x17c/0xe50
clear_selection+0x4c/0x60
vc_do_resize+0xaee/0xe50
fbcon_modechanged+0x2bd/0x640
rotate_all_store+0x298/0x380
...
reproduce:
1) issue two ioctls: first a KDFONTOP ioctl with op.op = KD_FONT_OP_SET,
op.width = 1 and op.height = 1, then a TIOCL_SETSEL ioctl
2) echo 2 > /sys/devices/virtual/graphics/fbcon/rotate_all
3) issue two ioctls: first a KDFONTOP ioctl with op.op = KD_FONT_OP_SET,
op.width = 8 and op.height = 1, then a TIOCL_SETSEL ioctl
4) echo 3 > /sys/devices/virtual/graphics/fbcon/rotate_all
[CAUSE]
The root cause is that fbcon_modechanged() first sets the current rotate's
corresponding ops. Subsequently, during vc_resize(), it may trigger
clear_selection(), and in fbcon_putcs->ccw_putcs[rotate=3], this can result
in an out-of-bounds access to "src". This happens because par->rotated.buf
is reallocated in fbcon_rotate_font():
1) When rotate=2, its size is (width + 7) / 8 * height
2) When rotate=3, its size is (height + 7) / 8 * width
And the call to fbcon_rotate_font() occurs after clear_selection(). In
other words, the fontbuffer is allocated using the size calculated from the
previous rotation 2, but before reallocating it with the new size,
con_putcs is already using the new rotation 3:
rotate_all_store
fbcon_rotate_all
fbcon_set_all_vcs
fbcon_modechanged
set_blitting_type
...
par->bitops = &ccw_fbcon_bitops
vc_resize
...
clear_selection
highlight
...
do_update_region
fbcon_putcs
...
image.dy = vyres - ((xx + count) * vc->vc_font.width) [1] // overflow!
ccw_putcs_aligned
// old buf size is still being used during the read!
src = par->rotated.buf + (scr_readw(s--) & charmask) * cellsize
fb_pad_aligned_buffer----[src KASAN!!!] [2]
info->fbops->fb_imageblit(info, image)
sys_imageblit
fb_imageblit
fb_address_forward
// offset: image->dy * bits_per_line + image->dx * bpp
unsigned int bits = (unsigned int)adr->bits + offset
adr->address += (bits & ~(BITS_PER_LONG - 1u)) / BITS_PER_BYTE [3]
fb_bitmap_imageblit
...
fb_read_offset // page fault! [4]
update_screen
redraw_screen
...
ccw_cursor
soft_cursor
memcpy(src, image->data, dsize)----[src KASAN again!!!] [5]
fbcon_switch
fbcon_rotate_font
font_data_rotate
dst = kmalloc_array(charcount, d_cellsize, GFP_KERNEL)
// the new size is allocated only here!
par->rotated.buf = buf [6]
[FIX]
A fairly obvious approach is to follow fbcon_switch(): in
fbcon_modechanged(), call rotate_font() before vc_resize() so that a
correctly sized buffer is allocated in time, as done in [6]. This fix is
necessary, but it is not sufficient on its own.
In [1] it causes an image.dy overflow (ccw_putcs: vyres = 768,
image.dy = 4294967040), because vc_cols has not been updated in time at
this point (it is likewise only updated after clear_selection()). This
allows (xx + count) * width to exceed vyres, causing image.dy to overflow.
Subsequently, address in [3] is incremented by an even larger amount, which
triggers a page fault at [4].
Therefore, a second fix is required in combination with the first: move
clear_selection() earlier, before set_blitting_type() in
fbcon_set_all_vcs(), to prevent the out-of-bounds access. fbcon_rotate()
has a similar problem, so add the same clear there. Since vc_is_sel() is
not exported, the fbdev side is currently forced to call clear_selection()
unconditionally, causing the global selection to be cleared prematurely.
And this will not cause any other significant impact.
Signed-off-by: Zizhi Wo <wozizhi@huawei.com>
---
v2:
Fixed the issue by calling clear_selection() earlier, and updated the
related description in the commit message.
v1: https://lore.kernel.org/all/20250905024340.337521-1-wozizhi@huaweicloud.com/
---
drivers/video/fbdev/core/fbcon.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index 9f5c4c101581..3361479d139d 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -2639,13 +2639,20 @@ static void fbcon_modechanged(struct fb_info *info)
vc = vc_cons[par->currcon].d;
if (vc->vc_mode != KD_TEXT ||
fbcon_info_from_console(par->currcon) != info)
return;
+ clear_selection();
+
p = &fb_display[vc->vc_num];
set_blitting_type(vc, info);
+ if (par->bitops->rotate_font && par->bitops->rotate_font(info, vc)) {
+ par->rotate = FB_ROTATE_UR;
+ set_blitting_type(vc, info);
+ }
+
if (con_is_visible(vc)) {
var_to_display(p, &info->var, info);
cols = FBCON_SWAP(par->rotate, info->var.xres, info->var.yres);
rows = FBCON_SWAP(par->rotate, info->var.yres, info->var.xres);
cols /= vc->vc_font.width;
@@ -2673,10 +2680,12 @@ static void fbcon_set_all_vcs(struct fb_info *info)
int i, rows, cols, fg = -1;
if (!par || par->currcon < 0)
return;
+ clear_selection();
+
for (i = first_fb_vc; i <= last_fb_vc; i++) {
vc = vc_cons[i].d;
if (!vc || vc->vc_mode != KD_TEXT ||
fbcon_info_from_console(i) != info)
continue;
--
2.52.0
^ permalink raw reply related
* Re: [PATCH v3 3/3] drm/ssd130x: Add SSD135X_FAMILY and SSD1351 support
From: Amit Barzilai @ 2026-07-22 3:57 UTC (permalink / raw)
To: Andy Shevchenko
Cc: airlied, andy, azuddinadam, chintanlike, conor+dt, deller,
devicetree, dri-devel, gregkh, javierm, krzk+dt, linux-fbdev,
linux-kernel, linux-staging, maarten.lankhorst, mripard, robh,
simona, tzimmermann
In-Reply-To: <alil0p_s9-dM9j_t@ashevche-desk.local>
Andy Shevchenko <andriy.shevchenko@intel.com> wrote:
>> { "ssd1327", SSD1327_ID },
>> /* ssd133x family */
>> { "ssd1331", SSD1331_ID },
>> + /* ssd135x family */
>> + { "ssd1351", SSD1351_ID },
>> { /* sentinel */ }
>
> To avoid conflicts it's better to convert this ID table to use C99 initialisers
> (so Uwe will be happy).
No problem, adding a designated patch to v4.
--
Thanks,
Amit
^ permalink raw reply
* Re: [PATCH v5 08/14] mfd: lm3533: Convert to use OF bindings
From: Jonathan Cameron @ 2026-07-22 1:30 UTC (permalink / raw)
To: Svyatoslav Ryhel
Cc: Johan Hovold, Lee Jones, Daniel Thompson, Jingoo Han,
Pavel Machek, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
David Lechner, Nuno Sá, Andy Shevchenko, Helge Deller,
dri-devel, linux-leds, devicetree, linux-kernel, linux-iio,
linux-fbdev
In-Reply-To: <CAPVz0n2trouADTziWXnpt=-hwKdsZWGQib+-nVCLaSLibTbATg@mail.gmail.com>
On Tue, 14 Jul 2026 16:57:01 +0300
Svyatoslav Ryhel <clamor95@gmail.com> wrote:
> пт, 3 лип. 2026 р. о 14:03 Johan Hovold <johan@kernel.org> пише:
> >
> > On Wed, Jun 17, 2026 at 11:00:25AM +0300, Svyatoslav Ryhel wrote:
> > > Since there are no users of this driver via platform data, remove the
> > > platform data support and switch to using Device Tree bindings.
> > >
> > > Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
> > > Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org> #for backlight
> > > indio_dev->name = dev_name(&pdev->dev);
> > > - iio_device_set_parent(indio_dev, pdev->dev.parent);
> >
> > Why are you reparenting the iio device here?
> >
>
> Because every cell has its own binding now and using phandle to parent
> when device has its own node is not a good practice.
It is however a good point. So should at very least the ABI break should
be called out in the patch description with a brief mention of what the
path change actually is.
>
> > That's an ABI break.
> >
>
> This driver does not have any active users in the kernel and no
> activity for more then 2 years.
...
> > > + u32 count = 0, reg, nchilds;
> >
> > Don't mix multiple declarations with initialisation like this.
> >
>
> Checkpatch does not complain on style issue, hence this is not prohibited.
Prohibition vs taste. I fully agree with John on this one! Those mixes are
messy and hard to read.
Checkpatch is a helpful tool but there are both rules and preferred style things
it does not catch.
Jonathan
>
> > > int ret;
> > >
^ permalink raw reply
* Re: [PATCH v5 06/14] mfd: lm3533-core: Remove redundant pdata helpers
From: Jonathan Cameron @ 2026-07-22 1:25 UTC (permalink / raw)
To: Svyatoslav Ryhel
Cc: Lee Jones, Daniel Thompson, Jingoo Han, Pavel Machek, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, David Lechner, Nuno Sá,
Andy Shevchenko, Helge Deller, Johan Hovold, dri-devel,
linux-leds, devicetree, linux-kernel, linux-iio, linux-fbdev
In-Reply-To: <20260617080031.99156-7-clamor95@gmail.com>
On Wed, 17 Jun 2026 11:00:23 +0300
Svyatoslav Ryhel <clamor95@gmail.com> wrote:
> The lm3533_set_boost_freq() and lm3533_set_boost_ovp() functions are used
> only in lm3533_device_setup(), which in turn is only called by
> lm3533_device_init(). Incorporate their code directly into
> lm3533_device_init() to simplify driver readability.
>
> Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
> static int lm3533_device_init(struct lm3533 *lm3533)
> {
> struct lm3533_platform_data *pdata = dev_get_platdata(lm3533->dev);
> @@ -437,9 +396,21 @@ static int lm3533_device_init(struct lm3533 *lm3533)
>
> lm3533_enable(lm3533);
>
> - ret = lm3533_device_setup(lm3533, pdata);
> - if (ret)
> + ret = regmap_update_bits(lm3533->regmap, LM3533_REG_BOOST_PWM,
> + LM3533_BOOST_FREQ_MASK,
> + pdata->boost_freq << LM3533_BOOST_FREQ_SHIFT);
As you are touching this maybe get rid of the shifts and have one source
of info on where the field lies in the register.
FIELD_PREP(LM3533_BOOST_FREQ_MASK, pdata->boost_freq));
> + if (ret) {
> + dev_err(lm3533->dev, "failed to set boost frequency\n");
> goto err_disable;
> + }
> +
> + ret = regmap_update_bits(lm3533->regmap, LM3533_REG_BOOST_PWM,
> + LM3533_BOOST_OVP_MASK,
> + pdata->boost_ovp << LM3533_BOOST_OVP_SHIFT);
> + if (ret) {
> + dev_err(lm3533->dev, "failed to set boost ovp\n");
> + goto err_disable;
> + }
>
> lm3533_device_als_init(lm3533);
> lm3533_device_bl_init(lm3533);
^ permalink raw reply
* [syzbot] Monthly fbdev report (Jul 2026)
From: syzbot @ 2026-07-21 20:32 UTC (permalink / raw)
To: deller, dri-devel, linux-fbdev, linux-kernel, syzkaller-bugs
Hello fbdev maintainers/developers,
This is a 31-day syzbot report for the fbdev subsystem.
All related reports/information can be found at:
https://syzkaller.appspot.com/upstream/s/fbdev
During the period, 0 new issues were detected and 1 were fixed.
In total, 3 issues are still open and 30 have already been fixed.
Some of the still happening issues:
Ref Crashes Repro Title
<1> 6706 Yes KASAN: vmalloc-out-of-bounds Write in imageblit (6)
https://syzkaller.appspot.com/bug?extid=5a40432dfe8f86ee657a
<2> 1601 Yes KASAN: slab-out-of-bounds Read in fbcon_prepare_logo
https://syzkaller.appspot.com/bug?extid=0c815b25cdb3678e7083
<3> 285 No KASAN: vmalloc-out-of-bounds Write in fillrect
https://syzkaller.appspot.com/bug?extid=7a63ce155648954e749b
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
To disable reminders for individual bugs, reply with the following command:
#syz set <Ref> no-reminders
To change bug's subsystems, reply with:
#syz set <Ref> subsystems: new-subsystem
You may send multiple commands in a single email message.
^ permalink raw reply
* [PATCH v2 3/3] module: Bring includes in linux/kmod.h up to date
From: Petr Pavlu @ 2026-07-21 13:11 UTC (permalink / raw)
To: Tony Luck, Borislav Petkov, Thomas Gleixner, Ingo Molnar,
Dave Hansen, x86, H. Peter Anvin, Philipp Reisner, Lars Ellenberg,
Christoph Böhmwalder, Jens Axboe, Johan Hovold, Alex Elder,
Greg Kroah-Hartman, Rafael J. Wysocki, Michal Januszewski,
Helge Deller, Alexander Viro, Christian Brauner, Jan Kara,
Trond Myklebust, Anna Schumaker, Chuck Lever, Jeff Layton,
NeilBrown, Olga Kornievskaia, Dai Ngo, Tom Talpey, Mark Fasheh,
Joel Becker, Joseph Qi, Tejun Heo, Johannes Weiner,
Michal Koutný, Luis Chamberlain, Petr Pavlu, Daniel Gomez,
Sami Tolvanen, Aaron Tomlin, Pavel Machek, Len Brown,
Andrew Morton, Danilo Krummrich, Nikolay Aleksandrov,
Ido Schimmel, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, David Howells, Jarkko Sakkinen,
Paul Moore, James Morris, Serge E. Hallyn, Kentaro Takeda,
Tetsuo Handa
Cc: linux-edac, linux-kernel, drbd-dev, linux-block, greybus-dev,
linuxppc-dev, linux-acpi, linux-fbdev, dri-devel, linux-fsdevel,
linux-nfs, ocfs2-devel, cgroups, linux-modules, linux-pm,
driver-core, bridge, netdev, keyrings, linux-security-module
In-Reply-To: <20260721131207.803760-1-petr.pavlu@suse.com>
Including linux/kmod.h alone results in 1.5 MB of preprocessed output, even
though it provides only a few functions and macros.
The header currently depends on:
* __printf() -> linux/compiler_attributes.h,
* ENOSYS -> linux/errno.h,
* bool -> linux/types.h.
Include only these files, reducing the preprocessed output to 10 kB.
Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
Reviewed-by: Aaron Tomlin <atomlin@atomlin.com>
---
include/linux/kmod.h | 12 ++----------
1 file changed, 2 insertions(+), 10 deletions(-)
diff --git a/include/linux/kmod.h b/include/linux/kmod.h
index 9a07c3215389..b9474a62a568 100644
--- a/include/linux/kmod.h
+++ b/include/linux/kmod.h
@@ -2,17 +2,9 @@
#ifndef __LINUX_KMOD_H__
#define __LINUX_KMOD_H__
-/*
- * include/linux/kmod.h
- */
-
-#include <linux/umh.h>
-#include <linux/gfp.h>
-#include <linux/stddef.h>
+#include <linux/compiler_attributes.h>
#include <linux/errno.h>
-#include <linux/compiler.h>
-#include <linux/workqueue.h>
-#include <linux/sysctl.h>
+#include <linux/types.h>
#ifdef CONFIG_MODULES
/* modprobe exit status on success, -ve on error. Return value
--
2.54.0
^ permalink raw reply related
* [PATCH v2 2/3] time/jiffies: Include linux/sysctl.h for proc_int_u2k_conv_uop(), ...
From: Petr Pavlu @ 2026-07-21 13:11 UTC (permalink / raw)
To: Tony Luck, Borislav Petkov, Thomas Gleixner, Ingo Molnar,
Dave Hansen, x86, H. Peter Anvin, Philipp Reisner, Lars Ellenberg,
Christoph Böhmwalder, Jens Axboe, Johan Hovold, Alex Elder,
Greg Kroah-Hartman, Rafael J. Wysocki, Michal Januszewski,
Helge Deller, Alexander Viro, Christian Brauner, Jan Kara,
Trond Myklebust, Anna Schumaker, Chuck Lever, Jeff Layton,
NeilBrown, Olga Kornievskaia, Dai Ngo, Tom Talpey, Mark Fasheh,
Joel Becker, Joseph Qi, Tejun Heo, Johannes Weiner,
Michal Koutný, Luis Chamberlain, Petr Pavlu, Daniel Gomez,
Sami Tolvanen, Aaron Tomlin, Pavel Machek, Len Brown,
Andrew Morton, Danilo Krummrich, Nikolay Aleksandrov,
Ido Schimmel, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, David Howells, Jarkko Sakkinen,
Paul Moore, James Morris, Serge E. Hallyn, Kentaro Takeda,
Tetsuo Handa
Cc: linux-edac, linux-kernel, drbd-dev, linux-block, greybus-dev,
linuxppc-dev, linux-acpi, linux-fbdev, dri-devel, linux-fsdevel,
linux-nfs, ocfs2-devel, cgroups, linux-modules, linux-pm,
driver-core, bridge, netdev, keyrings, linux-security-module
In-Reply-To: <20260721131207.803760-1-petr.pavlu@suse.com>
The kernel/time/jiffies.c file uses proc_int_u2k_conv_uop(),
proc_int_k2u_conv_kop(), proc_int_conv(), proc_dointvec_conv() and
proc_doulongvec_minmax_conv(), which are declared in linux/sysctl.h. It
currently relies on this header being included indirectly through
linux/module.h -> linux/kmod.h. Add the missing include in preparation for
removing the linux/sysctl.h include from linux/kmod.h.
Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
---
kernel/time/jiffies.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/kernel/time/jiffies.c b/kernel/time/jiffies.c
index d51428867a33..17cdb5ef8893 100644
--- a/kernel/time/jiffies.c
+++ b/kernel/time/jiffies.c
@@ -8,6 +8,7 @@
#include <linux/jiffies.h>
#include <linux/module.h>
#include <linux/init.h>
+#include <linux/sysctl.h>
#include "timekeeping.h"
#include "tick-internal.h"
--
2.54.0
^ permalink raw reply related
* [PATCH v2 1/3] umh, treewide: Explicitly include linux/umh.h where needed
From: Petr Pavlu @ 2026-07-21 13:11 UTC (permalink / raw)
To: Tony Luck, Borislav Petkov, Thomas Gleixner, Ingo Molnar,
Dave Hansen, x86, H. Peter Anvin, Philipp Reisner, Lars Ellenberg,
Christoph Böhmwalder, Jens Axboe, Johan Hovold, Alex Elder,
Greg Kroah-Hartman, Rafael J. Wysocki, Michal Januszewski,
Helge Deller, Alexander Viro, Christian Brauner, Jan Kara,
Trond Myklebust, Anna Schumaker, Chuck Lever, Jeff Layton,
NeilBrown, Olga Kornievskaia, Dai Ngo, Tom Talpey, Mark Fasheh,
Joel Becker, Joseph Qi, Tejun Heo, Johannes Weiner,
Michal Koutný, Luis Chamberlain, Petr Pavlu, Daniel Gomez,
Sami Tolvanen, Aaron Tomlin, Pavel Machek, Len Brown,
Andrew Morton, Danilo Krummrich, Nikolay Aleksandrov,
Ido Schimmel, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, David Howells, Jarkko Sakkinen,
Paul Moore, James Morris, Serge E. Hallyn, Kentaro Takeda,
Tetsuo Handa
Cc: linux-edac, linux-kernel, drbd-dev, linux-block, greybus-dev,
linuxppc-dev, linux-acpi, linux-fbdev, dri-devel, linux-fsdevel,
linux-nfs, ocfs2-devel, cgroups, linux-modules, linux-pm,
driver-core, bridge, netdev, keyrings, linux-security-module
In-Reply-To: <20260721131207.803760-1-petr.pavlu@suse.com>
The usermode helper declarations were previously provided by linux/kmod.h
but commit c1f3fa2a4fde ("kmod: split off umh headers into its own file")
moved them to linux/umh.h in 2017. Add explicit includes of linux/umh.h to
files that use usermode helpers and remove linux/kmod.h where it is no
longer needed.
Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
---
arch/x86/kernel/cpu/mce/dev-mcelog.c | 2 +-
drivers/block/drbd/drbd_nl.c | 1 +
drivers/greybus/svc_watchdog.c | 1 +
drivers/macintosh/windfarm_core.c | 1 +
drivers/pnp/pnpbios/core.c | 2 +-
drivers/video/fbdev/uvesafb.c | 1 +
fs/coredump.c | 2 +-
fs/nfs/cache_lib.c | 2 +-
fs/nfsd/nfs4layouts.c | 2 +-
fs/nfsd/nfs4recover.c | 1 +
fs/ocfs2/stackglue.c | 1 +
kernel/cgroup/cgroup-v1.c | 2 +-
kernel/module/kmod.c | 1 +
kernel/power/process.c | 2 +-
kernel/reboot.c | 2 +-
kernel/umh.c | 2 +-
lib/kobject_uevent.c | 2 +-
net/bridge/br_stp_if.c | 2 +-
security/keys/request_key.c | 2 +-
security/tomoyo/common.h | 2 +-
20 files changed, 20 insertions(+), 13 deletions(-)
diff --git a/arch/x86/kernel/cpu/mce/dev-mcelog.c b/arch/x86/kernel/cpu/mce/dev-mcelog.c
index 053555206d81..af4e76babe7a 100644
--- a/arch/x86/kernel/cpu/mce/dev-mcelog.c
+++ b/arch/x86/kernel/cpu/mce/dev-mcelog.c
@@ -11,7 +11,7 @@
#include <linux/miscdevice.h>
#include <linux/slab.h>
-#include <linux/kmod.h>
+#include <linux/umh.h>
#include <linux/poll.h>
#include "internal.h"
diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
index f9ffcd67607b..de90cf4a0789 100644
--- a/drivers/block/drbd/drbd_nl.c
+++ b/drivers/block/drbd/drbd_nl.c
@@ -14,6 +14,7 @@
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/module.h>
+#include <linux/umh.h>
#include <linux/drbd.h>
#include <linux/in.h>
#include <linux/fs.h>
diff --git a/drivers/greybus/svc_watchdog.c b/drivers/greybus/svc_watchdog.c
index 16e6de5e9eff..b318eb34bcca 100644
--- a/drivers/greybus/svc_watchdog.c
+++ b/drivers/greybus/svc_watchdog.c
@@ -7,6 +7,7 @@
#include <linux/delay.h>
#include <linux/suspend.h>
+#include <linux/umh.h>
#include <linux/workqueue.h>
#include <linux/greybus.h>
diff --git a/drivers/macintosh/windfarm_core.c b/drivers/macintosh/windfarm_core.c
index 5307b1e34261..e66de11c69a3 100644
--- a/drivers/macintosh/windfarm_core.c
+++ b/drivers/macintosh/windfarm_core.c
@@ -34,6 +34,7 @@
#include <linux/platform_device.h>
#include <linux/mutex.h>
#include <linux/freezer.h>
+#include <linux/umh.h>
#include "windfarm.h"
diff --git a/drivers/pnp/pnpbios/core.c b/drivers/pnp/pnpbios/core.c
index f7e86ae9f72f..46af1f549337 100644
--- a/drivers/pnp/pnpbios/core.c
+++ b/drivers/pnp/pnpbios/core.c
@@ -47,7 +47,7 @@
#include <linux/delay.h>
#include <linux/acpi.h>
#include <linux/freezer.h>
-#include <linux/kmod.h>
+#include <linux/umh.h>
#include <linux/kthread.h>
#include <asm/page.h>
diff --git a/drivers/video/fbdev/uvesafb.c b/drivers/video/fbdev/uvesafb.c
index 9d82326c744f..6c503e6914d6 100644
--- a/drivers/video/fbdev/uvesafb.c
+++ b/drivers/video/fbdev/uvesafb.c
@@ -23,6 +23,7 @@
#include <linux/io.h>
#include <linux/mutex.h>
#include <linux/slab.h>
+#include <linux/umh.h>
#include <video/edid.h>
#include <video/uvesafb.h>
#ifdef CONFIG_X86
diff --git a/fs/coredump.c b/fs/coredump.c
index e68a76ff92a3..4908b44f6fdc 100644
--- a/fs/coredump.c
+++ b/fs/coredump.c
@@ -32,7 +32,7 @@
#include <linux/tsacct_kern.h>
#include <linux/cn_proc.h>
#include <linux/audit.h>
-#include <linux/kmod.h>
+#include <linux/umh.h>
#include <linux/fsnotify.h>
#include <linux/fs_struct.h>
#include <linux/pipe_fs_i.h>
diff --git a/fs/nfs/cache_lib.c b/fs/nfs/cache_lib.c
index 9738a1ae92ca..ca4e81d4e315 100644
--- a/fs/nfs/cache_lib.c
+++ b/fs/nfs/cache_lib.c
@@ -6,7 +6,7 @@
*
* Copyright (c) 2009 Trond Myklebust <Trond.Myklebust@netapp.com>
*/
-#include <linux/kmod.h>
+#include <linux/umh.h>
#include <linux/module.h>
#include <linux/moduleparam.h>
#include <linux/mount.h>
diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c
index f34320e4c2f4..008f0f088c3a 100644
--- a/fs/nfsd/nfs4layouts.c
+++ b/fs/nfsd/nfs4layouts.c
@@ -3,7 +3,7 @@
* Copyright (c) 2014 Christoph Hellwig.
*/
#include <linux/exportfs_block.h>
-#include <linux/kmod.h>
+#include <linux/umh.h>
#include <linux/file.h>
#include <linux/jhash.h>
#include <linux/sched.h>
diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index 6ea25a52d2f4..20b98e43f668 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -41,6 +41,7 @@
#include <linux/fs.h>
#include <linux/hex.h>
#include <linux/module.h>
+#include <linux/umh.h>
#include <net/net_namespace.h>
#include <linux/sunrpc/rpc_pipe_fs.h>
#include <linux/sunrpc/clnt.h>
diff --git a/fs/ocfs2/stackglue.c b/fs/ocfs2/stackglue.c
index 741d6191d871..0ccaab29426d 100644
--- a/fs/ocfs2/stackglue.c
+++ b/fs/ocfs2/stackglue.c
@@ -18,6 +18,7 @@
#include <linux/kobject.h>
#include <linux/sysfs.h>
#include <linux/sysctl.h>
+#include <linux/umh.h>
#include "ocfs2_fs.h"
diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c
index a4337c9b5287..cbcde5c28b18 100644
--- a/kernel/cgroup/cgroup-v1.c
+++ b/kernel/cgroup/cgroup-v1.c
@@ -2,7 +2,7 @@
#include "cgroup-internal.h"
#include <linux/ctype.h>
-#include <linux/kmod.h>
+#include <linux/umh.h>
#include <linux/sort.h>
#include <linux/delay.h>
#include <linux/mm.h>
diff --git a/kernel/module/kmod.c b/kernel/module/kmod.c
index a25dccdf7aa7..dcaad5d65275 100644
--- a/kernel/module/kmod.c
+++ b/kernel/module/kmod.c
@@ -28,6 +28,7 @@
#include <linux/ptrace.h>
#include <linux/async.h>
#include <linux/uaccess.h>
+#include <linux/umh.h>
#include <trace/events/module.h>
#include "internal.h"
diff --git a/kernel/power/process.c b/kernel/power/process.c
index dc0dfc349f22..295904ec9a82 100644
--- a/kernel/power/process.c
+++ b/kernel/power/process.c
@@ -16,7 +16,7 @@
#include <linux/freezer.h>
#include <linux/delay.h>
#include <linux/workqueue.h>
-#include <linux/kmod.h>
+#include <linux/umh.h>
#include <trace/events/power.h>
#include <linux/cpuset.h>
diff --git a/kernel/reboot.c b/kernel/reboot.c
index 695c33e75efd..3d4a262973e7 100644
--- a/kernel/reboot.c
+++ b/kernel/reboot.c
@@ -11,13 +11,13 @@
#include <linux/ctype.h>
#include <linux/export.h>
#include <linux/kexec.h>
-#include <linux/kmod.h>
#include <linux/kmsg_dump.h>
#include <linux/reboot.h>
#include <linux/suspend.h>
#include <linux/syscalls.h>
#include <linux/syscore_ops.h>
#include <linux/uaccess.h>
+#include <linux/umh.h>
/*
* this indicates whether you can reboot with ctrl-alt-del: the default is yes
diff --git a/kernel/umh.c b/kernel/umh.c
index 48117c569e1a..72b2d9a878aa 100644
--- a/kernel/umh.c
+++ b/kernel/umh.c
@@ -8,7 +8,7 @@
#include <linux/binfmts.h>
#include <linux/syscalls.h>
#include <linux/unistd.h>
-#include <linux/kmod.h>
+#include <linux/umh.h>
#include <linux/slab.h>
#include <linux/completion.h>
#include <linux/cred.h>
diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
index ddbc4d7482d2..a67129e452a3 100644
--- a/lib/kobject_uevent.c
+++ b/lib/kobject_uevent.c
@@ -17,7 +17,7 @@
#include <linux/string.h>
#include <linux/kobject.h>
#include <linux/export.h>
-#include <linux/kmod.h>
+#include <linux/umh.h>
#include <linux/slab.h>
#include <linux/socket.h>
#include <linux/skbuff.h>
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index a7e5422eb5d1..89bc161a4b47 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -8,7 +8,7 @@
*/
#include <linux/kernel.h>
-#include <linux/kmod.h>
+#include <linux/umh.h>
#include <linux/etherdevice.h>
#include <linux/rtnetlink.h>
#include <net/switchdev.h>
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index fa2bb9f2f538..e6ba2d054399 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -9,7 +9,7 @@
#include <linux/export.h>
#include <linux/sched.h>
-#include <linux/kmod.h>
+#include <linux/umh.h>
#include <linux/err.h>
#include <linux/keyctl.h>
#include <linux/slab.h>
diff --git a/security/tomoyo/common.h b/security/tomoyo/common.h
index d098cf8aae61..d26034000913 100644
--- a/security/tomoyo/common.h
+++ b/security/tomoyo/common.h
@@ -16,7 +16,7 @@
#include <linux/string.h>
#include <linux/mm.h>
#include <linux/file.h>
-#include <linux/kmod.h>
+#include <linux/umh.h>
#include <linux/fs.h>
#include <linux/sched.h>
#include <linux/namei.h>
--
2.54.0
^ permalink raw reply related
* [PATCH v2 0/3] Bring includes in linux/kmod.h up to date
From: Petr Pavlu @ 2026-07-21 13:11 UTC (permalink / raw)
To: Tony Luck, Borislav Petkov, Thomas Gleixner, Ingo Molnar,
Dave Hansen, x86, H. Peter Anvin, Philipp Reisner, Lars Ellenberg,
Christoph Böhmwalder, Jens Axboe, Johan Hovold, Alex Elder,
Greg Kroah-Hartman, Rafael J. Wysocki, Michal Januszewski,
Helge Deller, Alexander Viro, Christian Brauner, Jan Kara,
Trond Myklebust, Anna Schumaker, Chuck Lever, Jeff Layton,
NeilBrown, Olga Kornievskaia, Dai Ngo, Tom Talpey, Mark Fasheh,
Joel Becker, Joseph Qi, Tejun Heo, Johannes Weiner,
Michal Koutný, Luis Chamberlain, Petr Pavlu, Daniel Gomez,
Sami Tolvanen, Aaron Tomlin, Pavel Machek, Len Brown,
Andrew Morton, Danilo Krummrich, Nikolay Aleksandrov,
Ido Schimmel, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, David Howells, Jarkko Sakkinen,
Paul Moore, James Morris, Serge E. Hallyn, Kentaro Takeda,
Tetsuo Handa
Cc: linux-edac, linux-kernel, drbd-dev, linux-block, greybus-dev,
linuxppc-dev, linux-acpi, linux-fbdev, dri-devel, linux-fsdevel,
linux-nfs, ocfs2-devel, cgroups, linux-modules, linux-pm,
driver-core, bridge, netdev, keyrings, linux-security-module
The usermode helper declarations were previously provided by linux/kmod.h
but commit c1f3fa2a4fde ("kmod: split off umh headers into its own file")
moved them to linux/umh.h in 2017. Add explicit includes of linux/umh.h to
files that use usermode helpers and remove linux/kmod.h where it is no
longer needed.
Also add a missing include of linux/sysctl.h to kernel/time/jiffies.c.
Finally, clean up linux/kmod.h so that it includes only the headers that it
actually requires, importantly removing the compat linux/umh.h include.
This cleanup is motivated by trying to reduce the preprocessed size of
linux/module.h, which includes linux/kmod.h. The linux/module.h header is
included by every *.mod.c file to provide `struct module` and other related
definitions, so it should avoid pulling in unnecessary dependencies. Note
that this series doesn't immediately improve the situation, since most of
the files included by linux/kmod.h are, for now, also included by
linux/module.h through other paths.
Apologies for the wide distribution. Acked-bys are appreciated.
Changes in v2:
- Remove the linux/kmod.h include from kernel/cgroup/cgroup-v1.c.
- Add a missing include of linux/sysctl.h to kernel/time/jiffies.c.
- Link to v1: https://lore.kernel.org/linux-modules/20260708154510.6794-1-petr.pavlu@suse.com/
Petr Pavlu (3):
umh, treewide: Explicitly include linux/umh.h where needed
time/jiffies: Include linux/sysctl.h for proc_int_u2k_conv_uop(), ...
module: Bring includes in linux/kmod.h up to date
arch/x86/kernel/cpu/mce/dev-mcelog.c | 2 +-
drivers/block/drbd/drbd_nl.c | 1 +
drivers/greybus/svc_watchdog.c | 1 +
drivers/macintosh/windfarm_core.c | 1 +
drivers/pnp/pnpbios/core.c | 2 +-
drivers/video/fbdev/uvesafb.c | 1 +
fs/coredump.c | 2 +-
fs/nfs/cache_lib.c | 2 +-
fs/nfsd/nfs4layouts.c | 2 +-
fs/nfsd/nfs4recover.c | 1 +
fs/ocfs2/stackglue.c | 1 +
include/linux/kmod.h | 12 ++----------
kernel/cgroup/cgroup-v1.c | 2 +-
kernel/module/kmod.c | 1 +
kernel/power/process.c | 2 +-
kernel/reboot.c | 2 +-
kernel/time/jiffies.c | 1 +
kernel/umh.c | 2 +-
lib/kobject_uevent.c | 2 +-
net/bridge/br_stp_if.c | 2 +-
security/keys/request_key.c | 2 +-
security/tomoyo/common.h | 2 +-
22 files changed, 23 insertions(+), 23 deletions(-)
--
2.54.0
^ permalink raw reply
* [PATCH] fbdev: core: Fix pointer desynchronization in fb_io_read()
From: Mingyu Wang @ 2026-07-21 8:19 UTC (permalink / raw)
To: simona, deller
Cc: tzimmermann, sam, javierm, linux-fbdev, dri-devel, linux-kernel,
Mingyu Wang, stable
In fb_io_read(), if copy_to_user() performs a partial copy (e.g., due to
a faulty user buffer), the loop adjusts the chunk size 'c' and updates
the remaining 'count'. However, the hardware 'src' pointer has already
been eagerly advanced by the original chunk size.
If the loop is allowed to continue, the read will resume from an
incorrect, over-advanced offset. Since the remaining 'count' was only
decremented by the successful bytes, this desynchronization causes the
next iterations to execute more hardware reads than originally bounded,
eventually leading to out-of-bounds I/O reads.
Fix this by breaking out of the loop immediately upon a partial
copy_to_user(). A partial copy indicates a faulty user buffer, making
subsequent read attempts futile. Breaking out ensures we return the
number of successfully read bytes without risking out-of-bounds hardware
accesses in subsequent mismatched iterations.
Fixes: 6121cd9ef911 ("fbdev: Move I/O read and write code into helper functions")
Cc: stable@vger.kernel.org
Signed-off-by: Mingyu Wang <25181214217@stu.xidian.edu.cn>
---
drivers/video/fbdev/core/fb_io_fops.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/video/fbdev/core/fb_io_fops.c b/drivers/video/fbdev/core/fb_io_fops.c
index 6ab60fcd0050..0798e88799eb 100644
--- a/drivers/video/fbdev/core/fb_io_fops.c
+++ b/drivers/video/fbdev/core/fb_io_fops.c
@@ -61,6 +61,14 @@ ssize_t fb_io_read(struct fb_info *info, char __user *buf, size_t count, loff_t
buf += c;
cnt += c;
count -= c;
+
+ /*
+ * If there was a partial copy, the user buffer is faulty.
+ * Break out to avoid over-advancing the src pointer and
+ * reading out of bounds in the next iteration.
+ */
+ if (trailing)
+ break;
}
kfree(buffer);
--
2.34.1
^ permalink raw reply related
* [PATCH v2] fbdev: core: Clamp total_size to smem_len in read/write functions
From: Mingyu Wang @ 2026-07-21 7:15 UTC (permalink / raw)
To: simona, deller; +Cc: linux-fbdev, dri-devel, linux-kernel, Mingyu Wang
Some legacy fbdev drivers may incorrectly set info->screen_size to a
value larger than the actual mapped framebuffer size (info->fix.smem_len)
during mode switches. This could allow out-of-bounds I/O and system
memory accesses in fb_io_read(), fb_io_write(), fb_sys_read(), and
fb_sys_write().
Prevent this by clamping total_size to smem_len when smem_len is non-zero.
Virtual framebuffers (smem_len == 0) are unaffected.
This is a hardening measure; no specific crash is fixed by this patch.
Signed-off-by: Mingyu Wang <25181214217@stu.xidian.edu.cn>
---
v2:
- Apply the clamp to fb_sys_read() and fb_sys_write() as well to prevent
similar OOB accesses in system memory framebuffers (Reported by Sashiko).
- Update commit message to clearly state this is a hardening measure.
---
drivers/video/fbdev/core/fb_io_fops.c | 16 ++++++++++++++++
drivers/video/fbdev/core/fb_sys_fops.c | 16 ++++++++++++++++
2 files changed, 32 insertions(+)
diff --git a/drivers/video/fbdev/core/fb_io_fops.c b/drivers/video/fbdev/core/fb_io_fops.c
index 6ab60fcd0050..335f16d2cc23 100644
--- a/drivers/video/fbdev/core/fb_io_fops.c
+++ b/drivers/video/fbdev/core/fb_io_fops.c
@@ -24,6 +24,14 @@ ssize_t fb_io_read(struct fb_info *info, char __user *buf, size_t count, loff_t
if (total_size == 0)
total_size = info->fix.smem_len;
+ /*
+ * Security Hardening: Defend against buggy legacy drivers that may
+ * calculate a malformed screen_size. Clamp total_size to the actual
+ * hardware mapped memory limit (smem_len) to prevent OOB access.
+ */
+ if (info->fix.smem_len && total_size > info->fix.smem_len)
+ total_size = info->fix.smem_len;
+
if (p >= total_size)
return 0;
@@ -88,6 +96,14 @@ ssize_t fb_io_write(struct fb_info *info, const char __user *buf, size_t count,
if (total_size == 0)
total_size = info->fix.smem_len;
+ /*
+ * Security Hardening: Defend against buggy legacy drivers that may
+ * calculate a malformed screen_size. Clamp total_size to the actual
+ * hardware mapped memory limit (smem_len) to prevent OOB access.
+ */
+ if (info->fix.smem_len && total_size > info->fix.smem_len)
+ total_size = info->fix.smem_len;
+
if (p > total_size)
return -EFBIG;
diff --git a/drivers/video/fbdev/core/fb_sys_fops.c b/drivers/video/fbdev/core/fb_sys_fops.c
index be96b3b3942e..e97cf02f7c70 100644
--- a/drivers/video/fbdev/core/fb_sys_fops.c
+++ b/drivers/video/fbdev/core/fb_sys_fops.c
@@ -35,6 +35,14 @@ ssize_t fb_sys_read(struct fb_info *info, char __user *buf, size_t count,
if (total_size == 0)
total_size = info->fix.smem_len;
+ /*
+ * Security Hardening: Defend against buggy legacy drivers that may
+ * calculate a malformed screen_size. Clamp total_size to the actual
+ * hardware mapped memory limit (smem_len) to prevent OOB access.
+ */
+ if (info->fix.smem_len && total_size > info->fix.smem_len)
+ total_size = info->fix.smem_len;
+
if (p >= total_size)
return 0;
@@ -80,6 +88,14 @@ ssize_t fb_sys_write(struct fb_info *info, const char __user *buf,
if (total_size == 0)
total_size = info->fix.smem_len;
+ /*
+ * Security Hardening: Defend against buggy legacy drivers that may
+ * calculate a malformed screen_size. Clamp total_size to the actual
+ * hardware mapped memory limit (smem_len) to prevent OOB access.
+ */
+ if (info->fix.smem_len && total_size > info->fix.smem_len)
+ total_size = info->fix.smem_len;
+
if (p > total_size)
return -EFBIG;
--
2.34.1
^ permalink raw reply related
* Re: [PATCH 2/7] staging: fbtft: Remove redundant dev_err_probe()
From: Andy Shevchenko @ 2026-07-20 18:18 UTC (permalink / raw)
To: Pan Chuang
Cc: Andy Shevchenko, Greg Kroah-Hartman,
open list:FBTFT Framebuffer drivers,
open list:FBTFT Framebuffer drivers, open list:STAGING SUBSYSTEM,
open list
In-Reply-To: <20260720134324.239391-3-panchuang@vivo.com>
On Mon, Jul 20, 2026 at 4:44 PM Pan Chuang <panchuang@vivo.com> wrote:
>
> Since commit
> 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"),
> devm_request_irq() automatically logs detailed error messages on
> failure. Remove the now-redundant driver-specific dev_err_probe() calls.
Reviewed-by: Andy Shevchenko <andy@kernel.org>
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* Re: [PATCH] backlight: ktd2801: fix unmet dependency on GPIOLIB
From: Duje Mihanović @ 2026-07-20 14:54 UTC (permalink / raw)
To: lee, danielt, jingoohan1, deller, Julian Braha
Cc: rdunlap, dri-devel, linux-fbdev, linux-kernel, arnd, Julian Braha
In-Reply-To: <20260719024902.151710-1-julianbraha@gmail.com>
On Sunday, 19 July 2026 04:49:02 Central European Summer Time Julian Braha
wrote:
> LEDS_EXPRESSWIRE depends on GPIOLIB, so its selector, BACKLIGHT_KTD2801
> also needs to ensure GPIOLIB is enabled. Otherwise:
>
> WARNING: unmet direct dependencies detected for LEDS_EXPRESSWIRE
> Depends on [n]: NEW_LEDS [=n] && GPIOLIB [=n]
> Selected by [y]:
> - BACKLIGHT_KTD2801 [=y] && HAS_IOMEM [=y] && BACKLIGHT_CLASS_DEVICE [=y]
>
> This unmet dependency was found by kconfirm, a static analysis tool for
> Kconfig.
>
> Fixes: d95963e309bc ("backlight: ktd2801: Depend on GPIOLIB")
> Signed-off-by: Julian Braha <julianbraha@gmail.com>
Acked-by: Duje Mihanović <duje@dujemihanovic.xyz>
Regards,
--
Duje
^ permalink raw reply
* [PATCH] staging: sm750fb: Align prototype parameter names to implementation
From: Mohit Mishra @ 2026-07-20 14:26 UTC (permalink / raw)
To: Sudip Mukherjee, Teddy Wang, Greg Kroah-Hartman
Cc: linux-fbdev, linux-staging, linux-kernel, Mohit Mishra
The declarations for sm750_hw_copyarea and sm750_hw_imageblit in sm750_accel.h
use legacy CamelCase parameters, which do not match the snake_case names
in the actual implementation in sm750_accel.c. The de_copyarea and
de_imageblit function pointers in struct lynx_accel (sm750.h) also use
outdated parameter names.
Rename these prototype parameters to match their implementation names.
Signed-off-by: Mohit Mishra <mishraloopmohit@gmail.com>
---
drivers/staging/sm750fb/sm750.h | 10 +++++-----
drivers/staging/sm750fb/sm750_accel.h | 12 ++++++------
2 files changed, 11 insertions(+), 11 deletions(-)
diff --git a/drivers/staging/sm750fb/sm750.h b/drivers/staging/sm750fb/sm750.h
index 0324778768cb..cd34d7f82c64 100644
--- a/drivers/staging/sm750fb/sm750.h
+++ b/drivers/staging/sm750fb/sm750.h
@@ -57,17 +57,17 @@ struct lynx_accel {
u32 color, u32 rop);
int (*de_copyarea)(struct lynx_accel *accel,
- u32 s_base, u32 s_pitch,
+ u32 source_base, u32 source_pitch,
u32 sx, u32 sy,
- u32 d_base, u32 d_pitch,
+ u32 dest_base, u32 dest_pitch,
u32 bpp, u32 dx, u32 dy,
u32 width, u32 height,
u32 rop2);
- int (*de_imageblit)(struct lynx_accel *accel, const char *p_srcbuf,
- u32 src_delta, u32 start_bit, u32 d_base, u32 d_pitch,
+ int (*de_imageblit)(struct lynx_accel *accel, const char *src_buf,
+ u32 src_delta, u32 start_bit, u32 dest_base, u32 dest_pitch,
u32 byte_per_pixel, u32 dx, u32 dy, u32 width,
- u32 height, u32 f_color, u32 b_color, u32 rop2);
+ u32 height, u32 fg_color, u32 bg_color, u32 rop2);
};
diff --git a/drivers/staging/sm750fb/sm750_accel.h b/drivers/staging/sm750fb/sm750_accel.h
index d15a40cacb84..25e5703b6774 100644
--- a/drivers/staging/sm750fb/sm750_accel.h
+++ b/drivers/staging/sm750fb/sm750_accel.h
@@ -210,9 +210,9 @@ int sm750_hw_fillrect(struct lynx_accel *accel,
* @rop2: ROP value
*/
int sm750_hw_copyarea(struct lynx_accel *accel,
- unsigned int sBase, unsigned int sPitch,
+ unsigned int source_base, unsigned int source_pitch,
unsigned int sx, unsigned int sy,
- unsigned int dBase, unsigned int dPitch,
+ unsigned int dest_base, unsigned int dest_pitch,
unsigned int bpp, unsigned int dx, unsigned int dy,
unsigned int width, unsigned int height,
unsigned int rop2);
@@ -235,9 +235,9 @@ int sm750_hw_copyarea(struct lynx_accel *accel,
* @bColor: Background color (corresponding to a 0 in the monochrome data
* @rop2: ROP value
*/
-int sm750_hw_imageblit(struct lynx_accel *accel, const char *pSrcbuf,
- u32 srcDelta, u32 startBit, u32 dBase, u32 dPitch,
- u32 bytePerPixel, u32 dx, u32 dy, u32 width,
- u32 height, u32 fColor, u32 bColor, u32 rop2);
+int sm750_hw_imageblit(struct lynx_accel *accel, const char *src_buf,
+ u32 src_delta, u32 start_bit, u32 dest_base, u32 dest_pitch,
+ u32 byte_per_pixel, u32 dx, u32 dy, u32 width,
+ u32 height, u32 fg_color, u32 bg_color, u32 rop2);
#endif
--
2.43.0
^ permalink raw reply related
* [PATCH] fbdev: core: Clamp total_size to smem_len in fb_io_read/write
From: Mingyu Wang @ 2026-07-20 13:55 UTC (permalink / raw)
To: simona, deller; +Cc: linux-fbdev, dri-devel, linux-kernel, Mingyu Wang
Some legacy fbdev drivers may incorrectly set info->screen_size to a
value larger than the actual mapped framebuffer size (info->fix.smem_len)
during mode switches. This could allow out-of-bounds I/O accesses in
fb_io_read() and fb_io_write().
Prevent this by clamping total_size to smem_len when smem_len is non-zero.
Virtual framebuffers (smem_len == 0) are unaffected.
This is a hardening measure; no specific crash is fixed by this patch.
Signed-off-by: Mingyu Wang <25181214217@stu.xidian.edu.cn>
---
drivers/video/fbdev/core/fb_io_fops.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/drivers/video/fbdev/core/fb_io_fops.c b/drivers/video/fbdev/core/fb_io_fops.c
index 6ab60fcd0050..335f16d2cc23 100644
--- a/drivers/video/fbdev/core/fb_io_fops.c
+++ b/drivers/video/fbdev/core/fb_io_fops.c
@@ -24,6 +24,14 @@ ssize_t fb_io_read(struct fb_info *info, char __user *buf, size_t count, loff_t
if (total_size == 0)
total_size = info->fix.smem_len;
+ /*
+ * Security Hardening: Defend against buggy legacy drivers that may
+ * calculate a malformed screen_size. Clamp total_size to the actual
+ * hardware mapped memory limit (smem_len) to prevent OOB access.
+ */
+ if (info->fix.smem_len && total_size > info->fix.smem_len)
+ total_size = info->fix.smem_len;
+
if (p >= total_size)
return 0;
@@ -88,6 +96,14 @@ ssize_t fb_io_write(struct fb_info *info, const char __user *buf, size_t count,
if (total_size == 0)
total_size = info->fix.smem_len;
+ /*
+ * Security Hardening: Defend against buggy legacy drivers that may
+ * calculate a malformed screen_size. Clamp total_size to the actual
+ * hardware mapped memory limit (smem_len) to prevent OOB access.
+ */
+ if (info->fix.smem_len && total_size > info->fix.smem_len)
+ total_size = info->fix.smem_len;
+
if (p > total_size)
return -EFBIG;
--
2.34.1
^ permalink raw reply related
* [PATCH 2/7] staging: fbtft: Remove redundant dev_err_probe()
From: Pan Chuang @ 2026-07-20 13:43 UTC (permalink / raw)
To: Andy Shevchenko, Greg Kroah-Hartman, Pan Chuang,
open list:FBTFT Framebuffer drivers,
open list:FBTFT Framebuffer drivers, open list:STAGING SUBSYSTEM,
open list
In-Reply-To: <20260720134324.239391-1-panchuang@vivo.com>
Since commit
55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"),
devm_request_irq() automatically logs detailed error messages on
failure. Remove the now-redundant driver-specific dev_err_probe() calls.
Signed-off-by: Pan Chuang <panchuang@vivo.com>
---
drivers/staging/fbtft/fb_st7789v.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/fbtft/fb_st7789v.c b/drivers/staging/fbtft/fb_st7789v.c
index 861a154144e6..ec46ad3f6a91 100644
--- a/drivers/staging/fbtft/fb_st7789v.c
+++ b/drivers/staging/fbtft/fb_st7789v.c
@@ -119,7 +119,7 @@ static int init_tearing_effect_line(struct fbtft_par *par)
rc = devm_request_irq(dev, irq_te, panel_te_handler,
IRQF_TRIGGER_RISING, "TE_GPIO", par);
if (rc)
- return dev_err_probe(dev, rc, "TE IRQ request failed.\n");
+ return rc;
disable_irq_nosync(irq_te);
--
2.34.1
^ permalink raw reply related
* [PATCH 0/7] staging: Remove redundant error messages on IRQ request failure
From: Pan Chuang @ 2026-07-20 13:43 UTC (permalink / raw)
To: Greg Kroah-Hartman, Andy Shevchenko, Vaibhav Hiremath,
Johan Hovold, Alex Elder, Nuno Sá, Michael Hennerich,
Jonathan Cameron, David Lechner, Hans de Goede,
Mauro Carvalho Chehab, Sakari Ailus, Parthiban Veerasooran,
Christian Gromm, Marc Dietrich, Ovidiu Panait, Dan Carpenter,
Gustavo Piaz da Silva, Pan Chuang, Chelsy Ratnawat,
Gabriel Rondon, Artem Lytkin, Zeeshan Ahmad, Rajveer Chaudhari,
Ethan Tidmore, Batu Ada Tutkun, open list:STAGING SUBSYSTEM,
open list, open list:FBTFT Framebuffer drivers,
open list:FBTFT Framebuffer drivers,
moderated list:GREYBUS SUBSYSTEM,
open list:ANALOG DEVICES INC IIO DRIVERS,
open list:STAGING - INDUSTRIAL IO,
open list:STAGING - ATOMISP DRIVER,
moderated list:STAGING - NVIDIA COMPLIANT EMBEDDED CONTROLLER...,
open list:STAGING - NVIDIA COMPLIANT EMBEDDED CONTROLLER...
devm_request_threaded_irq() and devm_request_any_context_irq()
automatically log detailed error messages on failure via
the devm_request_result() helper, which prints device
name, IRQ number, handler functions, and error code.
Since devm_request_irq() is a static inline wrapper around
devm_request_threaded_irq(), it also benefits from this
automatic logging.
Remove the now-redundant dev_err() and dev_err_probe() calls
in staging drivers that follow these devm_request_*_irq()
functions, as the core now provides more detailed diagnostic
information on failure.
Pan Chuang (7):
staging: axis-fifo: Remove redundant dev_err()
staging: fbtft: Remove redundant dev_err_probe()
staging: greybus: arche-platform: Remove redundant dev_err()
staging: iio: adt7316: Remove redundant dev_err()
media: atomisp: Remove redundant dev_err()
staging: most: dim2: Remove redundant dev_err()
staging: nvec: Remove redundant dev_err_probe()
drivers/staging/axis-fifo/axis-fifo.c | 5 +----
drivers/staging/fbtft/fb_st7789v.c | 2 +-
drivers/staging/greybus/arche-platform.c | 4 +---
drivers/staging/iio/addac/adt7316.c | 5 +----
drivers/staging/media/atomisp/pci/atomisp_v4l2.c | 4 +---
drivers/staging/most/dim2/dim2.c | 8 ++------
drivers/staging/nvec/nvec.c | 2 +-
7 files changed, 8 insertions(+), 22 deletions(-)
--
2.34.1
^ permalink raw reply
* Re: [PATCH] fonts: fixup font.h kernel-doc warnings
From: Thomas Zimmermann @ 2026-07-20 12:54 UTC (permalink / raw)
To: Randy Dunlap, dri-devel; +Cc: Helge Deller, linux-fbdev
In-Reply-To: <20260718191326.1907423-1-rdunlap@infradead.org>
Am 18.07.26 um 21:13 schrieb Randy Dunlap:
> Use the typedef keyword when describing a typedef.
> Add the missing function return value for font_glyph_size().
>
> Warning: include/linux/font.h:84 cannot understand function prototype:
> 'typedef const unsigned char font_data_t;'
> Warning: include/linux/font.h:53 No description found for return value
> of 'font_glyph_size'
>
> Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Thanks a lot for the bug fix.
> ---
> Cc: Helge Deller <deller@gmx.de>
> Cc: Thomas Zimmermann <tzimmermann@suse.de>
> Cc: linux-fbdev@vger.kernel.org
>
> include/linux/font.h | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> --- linux-next-20260717.orig/include/linux/font.h
> +++ linux-next-20260717/include/linux/font.h
> @@ -49,6 +49,8 @@ static inline unsigned int font_glyph_pi
> * scanlines, which is usually the glyph's height in scanlines. Fonts
> * coming from user space can sometimes have a different vertical pitch
> * with empty scanlines between two adjacent glyphs.
> + *
> + * Returns: the number of bytes per glyph
> */
> static inline unsigned int font_glyph_size(unsigned int width, unsigned int vpitch)
> {
> @@ -60,7 +62,7 @@ static inline unsigned int font_glyph_si
> */
>
> /**
> - * font_data_t - Raw font data
> + * typedef font_data_t - Raw font data
> *
> * Values of type font_data_t store a pointer to raw font data. The format
> * is monochrome. Each bit sets a pixel of a stored glyph. Font data does
--
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com
GF: Jochen Jaser, Andrew McDonald, (HRB 36809, AG Nürnberg)
^ permalink raw reply
* Re: [PATCH v2 0/7] vga_switcheroo, drm: Push fbcon handling into DRM clients
From: Thomas Zimmermann @ 2026-07-20 11:58 UTC (permalink / raw)
To: Helge Deller; +Cc: dri-devel, linux-fbdev
In-Reply-To: <88fa0f85-0960-464a-a602-f797785f0c2e@gmx.de>
Hi
Am 18.07.26 um 21:08 schrieb Helge Deller:
> Hi Thomas,
>
> On 7/9/26 11:15, Thomas Zimmermann wrote:
>> Vga_switcheroo currently invokes fb_switch_outputs() to inform fbcon
>> about switching of the physical outputs among framebuffer devices. But
>> new DRM clients to not use fbdev/fbcon and might require their own
>> vga_switcheroo support. Let's strictly separate them from each other.
>>
>> Remove fbdev/fbcon from vga_switcheroo. Introduce a pre_switch callback
>> for vga_switcheroo clients to do the fbcon update. Allows for removing
>> all direct interactions between vga_switcheroo and fbdev/fbcon.
>>
>> There are only four drivers that support vga_switcheroo: amdgpu,
>> radeon, i915 and nouveau. Update each of them with the new callback.
>> When vga_switcheroo now invokes pre_switch, each DRM driver forwards
>> to aquire_outputs and lets the DRM clients handle the new outputs.
>>
>> At the same time, push the fbcon update into DRM's client for fbdev
>> emulation. Do this with the new DRM client callback acquire_outputs,
>> so that other clients can have their own handling of vga_switcheroo.
>>
>> Also replace the existing reprobe hook with post_switch for symetry.
>> For nouveau, this is merely a rename of the helper function. The other
>> drivers dor not implement reprobe.
>>
>> Tested with radeon on a notebook with Radeon HD 4225 and HD 5430.
>>
>> v2:
>> - implement all of pre_switch in a single commit to avoid possible
>> deadlock in intermediate state (Sashiko)
>> - fix erroneous docs (Sashiko)
>>
>> Thomas Zimmermann (7):
>> drm/edid: Include <linux/fb.h>
>> drm/client: Add acquire_outputs callback; implement for fbdev
>> emulation
>> vga_switcheroo: Add pre_switch callback to client ops
>> vga_switcheroo: Add post_switch callback to client ops
>> drm: Implement struct vga_switcheroo_client_ops.pre_switch
>> drm: Implement vga_switcheroo_client_ops.post_switch
>> vga-switcheroo: Remove unused interfaces
>>
>> drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 9 ++++-
>> drivers/gpu/drm/clients/drm_fbdev_client.c | 23 ++++++++----
>> drivers/gpu/drm/drm_client_event.c | 18 ++++++++++
>> drivers/gpu/drm/drm_edid.c | 1 +
>> drivers/gpu/drm/i915/i915_switcheroo.c | 11 +++++-
>> drivers/gpu/drm/nouveau/nouveau_vga.c | 28 +++++++++------
>> drivers/gpu/drm/radeon/radeon_device.c | 9 ++++-
>> drivers/gpu/vga/vga_switcheroo.c | 41 +++++-----------------
>> drivers/video/fbdev/core/fbcon.c | 8 -----
>> include/drm/drm_client.h | 14 ++++++++
>> include/drm/drm_client_event.h | 3 ++
>> include/linux/vga_switcheroo.h | 29 ++++++++-------
>> 12 files changed, 121 insertions(+), 73 deletions(-)
> You may add a
> Acked-by: Helge Deller <deller@gmx.de>
> to the series.
Thank you so much.
>
> Just in case you want me to take the series through the fbdev git tree,
> please let me know.
The series is supposed to go though DRM trees. I'm still waiting for
reviews from the rsp devs.
Best regards
Thomas
>
> Helge
--
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com
GF: Jochen Jaser, Andrew McDonald, (HRB 36809, AG Nürnberg)
^ permalink raw reply
* Re: fbdev: arkfb: Move a variable assignment behind a condition check in ics5342_init()
From: Markus Elfring @ 2026-07-20 9:52 UTC (permalink / raw)
To: Helge Deller, linux-fbdev, dri-devel, Kees Cook,
Uwe Kleine-König, kernel-janitors, linux-hardening
Cc: LKML
In-Reply-To: <5a13f19d-4ba0-40d4-b061-0d17156b1686@gmx.de>
>>>> The address of a data structure member was determined before
>>>> a corresponding null pointer check in the implementation of
>>>> the function “ics5342_init”.
>>>>
>>>> Thus avoid the risk for undefined behaviour by moving the assignment
>>>> for the variable “info” behind a condition check.
>>>>
>>>> This issue was detected by using the Coccinelle software.
>>>
>>> There is no "risk" here.
>>> It just adds an offset to a potential NULL value (which isn't then used afterwards).
>> Does your understanding of programming language details differ from the view of
>> SEI CERT C Coding Standard (from the Carnegie Mellon University)?
>> https://cmu-sei.github.io/secure-coding-standards/sei-cert-c-coding-standard/rules/expressions-exp/exp34-c/
> My statement still stands.
> Try to find the difference between the code and the examples on that website yourself.
> Tip: The relevant part is the "&" and in doubt look at the generated assembly code.
Do any more code reviewers take another look at results from undefined behaviour sanitizers?
* https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html#introduction
* https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/dev-tools/ubsan.rst?h=v7.2-rc3#n6
See also:
https://stackoverflow.com/questions/79662603/why-do-compilers-not-warn-about-this-null-dereferencing-even-when-they-detect-i#answer-79663272
Regards,
Markus
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox