From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9E4802773E4; Tue, 17 Feb 2026 20:48:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771361303; cv=none; b=KZgC9soB9P+TgJOP7tBv6EeS/BniRS38k3YDfqeJNIxzKMxOZsmDQrZu8QgybSzmP2B/ktT3yPc71VOxut6hCSxnq2wYJ8Lj+V0Qz2oTx/SHAypJO5Cc03/t1coYR0NPyCzXMH/tLBy58krgLJQZipw1+3sY4aHcSB0eV+2LG0E= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771361303; c=relaxed/simple; bh=Y8P+cPFbq4Pa/ygT5gtRzRzUrSRP4Iemh0Gp1k78YA0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Nh0bMLU97YS+7jzJrucTaGQoYrBCLfcK92nTCyZ4LXNYuEN4nZ7m2NTAOsbiDc/FcUkPFN4vrfMFZJ6HS1NjhS+K1Midmj/xGROxm67N0coAuppV9a/IZ24NMHWl9moyDSRlcaXAaFc1gBNGw6whtSm66g8PBCN6gAqEz6Wki+Y= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=g8OfpLdG; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="g8OfpLdG" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0C06FC4CEF7; Tue, 17 Feb 2026 20:48:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1771361303; bh=Y8P+cPFbq4Pa/ygT5gtRzRzUrSRP4Iemh0Gp1k78YA0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=g8OfpLdGXIXml27ItVDV0CS/ID+huuHiT1n6cX8i07lIpD9Q3kjMCKiXKi4Sr0zFc MOSSED+o3JSPz0zkzyAFviwjiSMKpvpQmfKQ/d4m+yQRTcsmBxBzAH8ifoASQGYM74 RhRBOex5W2u2Yl6SJGaE4TQ7NvZ3Iw0/Hgjv4EuM= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Tianchu Chen , stable , Steve Glendinning , Helge Deller Subject: [PATCH 6.1 59/64] fbdev: smscufx: properly copy ioctl memory to kernelspace Date: Tue, 17 Feb 2026 21:31:55 +0100 Message-ID: <20260217200009.716409153@linuxfoundation.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260217200007.505931165@linuxfoundation.org> References: <20260217200007.505931165@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Greg Kroah-Hartman commit 120adae7b42faa641179270c067864544a50ab69 upstream. The UFX_IOCTL_REPORT_DAMAGE ioctl does not properly copy data from userspace to kernelspace, and instead directly references the memory, which can cause problems if invalid data is passed from userspace. Fix this all up by correctly copying the memory before accessing it within the kernel. Reported-by: Tianchu Chen Cc: stable Cc: Steve Glendinning Cc: Helge Deller Signed-off-by: Greg Kroah-Hartman Signed-off-by: Helge Deller Signed-off-by: Greg Kroah-Hartman --- drivers/video/fbdev/smscufx.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) --- a/drivers/video/fbdev/smscufx.c +++ b/drivers/video/fbdev/smscufx.c @@ -988,7 +988,6 @@ static int ufx_ops_ioctl(struct fb_info unsigned long arg) { struct ufx_data *dev = info->par; - struct dloarea *area = NULL; if (!atomic_read(&dev->usb_active)) return 0; @@ -1003,6 +1002,10 @@ static int ufx_ops_ioctl(struct fb_info /* TODO: Help propose a standard fb.h ioctl to report mmap damage */ if (cmd == UFX_IOCTL_REPORT_DAMAGE) { + struct dloarea *area __free(kfree) = kmalloc(sizeof(*area), GFP_KERNEL); + if (!area) + return -ENOMEM; + /* If we have a damage-aware client, turn fb_defio "off" * To avoid perf imact of unnecessary page fault handling. * Done by resetting the delay for this fb_info to a very @@ -1012,7 +1015,8 @@ static int ufx_ops_ioctl(struct fb_info if (info->fbdefio) info->fbdefio->delay = UFX_DEFIO_WRITE_DISABLE; - area = (struct dloarea *)arg; + if (copy_from_user(area, (u8 __user *)arg, sizeof(*area))) + return -EFAULT; if (area->x < 0) area->x = 0;