Go to file
Nam Cao 1802146901 fbdev: fix incorrect address computation in deferred IO
commit 78d9161d2b upstream.

With deferred IO enabled, a page fault happens when data is written to the
framebuffer device. Then driver determines which page is being updated by
calculating the offset of the written virtual address within the virtual
memory area, and uses this offset to get the updated page within the
internal buffer. This page is later copied to hardware (thus the name
"deferred IO").

This offset calculation is only correct if the virtual memory area is
mapped to the beginning of the internal buffer. Otherwise this is wrong.
For example, if users do:
    mmap(ptr, 4096, PROT_WRITE, MAP_FIXED | MAP_SHARED, fd, 0xff000);

Then the virtual memory area will mapped at offset 0xff000 within the
internal buffer. This offset 0xff000 is not accounted for, and wrong page
is updated.

Correct the calculation by using vmf->pgoff instead. With this change, the
variable "offset" will no longer hold the exact offset value, but it is
rounded down to multiples of PAGE_SIZE. But this is still correct, because
this variable is only used to calculate the page offset.

Reported-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Closes: https://lore.kernel.org/linux-fbdev/271372d6-e665-4e7f-b088-dee5f4ab341a@oracle.com
Fixes: 56c134f7f1 ("fbdev: Track deferred-I/O pages in pageref struct")
Cc: <stable@vger.kernel.org>
Signed-off-by: Nam Cao <namcao@linutronix.de>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Tested-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20240423115053.4490-1-namcao@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-05-02 16:35:31 +02:00
arch arm64: dts: rockchip: enable internal pull-up for Q7_THRM# on RK3399 Puma 2024-05-02 16:35:28 +02:00
block block: fix module reference leakage from bdev_open_by_dev error path 2024-05-02 16:35:13 +02:00
certs This update includes the following changes: 2023-11-02 16:15:30 -10:00
crypto Revert "crypto: pkcs7 - remove sha1 support" 2024-04-03 15:32:31 +02:00
Documentation net: make SK_MEMORY_PCPU_RESERV tunable 2024-05-02 16:35:17 +02:00
drivers fbdev: fix incorrect address computation in deferred IO 2024-05-02 16:35:31 +02:00
fs btrfs: fix information leak in btrfs_ioctl_logical_to_ino() 2024-05-02 16:35:27 +02:00
include macsec: Enable devices to advertise whether they update sk_buff md_dst during offloads 2024-05-02 16:35:30 +02:00
init rust: make mutually exclusive with CFI_CLANG 2024-05-02 16:35:25 +02:00
io_uring io_uring: Fix io_cqring_wait() not restoring sigmask on get_timespec64() failure 2024-04-27 17:12:47 +02:00
ipc shm: Slim down dependencies 2023-12-20 19:26:31 -05:00
kernel cpu: Re-enable CPU mitigations by default for !X86 architectures 2024-05-02 16:35:28 +02:00
lib stackdepot: respect __GFP_NOLOCKDEP allocation flag 2024-05-02 16:35:31 +02:00
LICENSES LICENSES: Add the copyleft-next-0.3.1 license 2022-11-08 15:44:01 +01:00
mm mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() 2024-05-02 16:35:26 +02:00
net ethernet: Add helper for assigning packet type when dest address does not match device address 2024-05-02 16:35:30 +02:00
rust rust: remove params from module macro example 2024-05-02 16:35:25 +02:00
samples work around gcc bugs with 'asm goto' with outputs 2024-02-09 15:57:48 -08:00
scripts kbuild: rust: force alloc extern to allow "empty" Rust files 2024-05-02 16:35:25 +02:00
security selinux: avoid dereference of garbage after mount failure 2024-04-10 16:38:01 +02:00
sound ALSA: hda/realtek - Enable audio jacks of Haier Boyue G42 with ALC269VC 2024-04-27 17:12:57 +02:00
tools selftests/seccomp: Handle EINVAL on unshare(CLONE_NEWPID) 2024-05-02 16:35:24 +02:00
usr Kbuild updates for v6.8 2024-01-18 17:57:07 -08:00
virt KVM: Always flush async #PF workqueue when vCPU is being destroyed 2024-04-03 15:32:03 +02:00
.clang-format clang-format: Update with v6.7-rc4's for_each macro list 2023-12-08 23:54:38 +01:00
.cocciconfig
.editorconfig Add .editorconfig file for basic formatting 2023-12-28 16:22:47 +09:00
.get_maintainer.ignore get_maintainer: add Alan to .get_maintainer.ignore 2022-08-20 15:17:44 -07:00
.gitattributes .gitattributes: set diff driver for Rust source code files 2023-05-31 17:48:25 +02:00
.gitignore Add .editorconfig file for basic formatting 2023-12-28 16:22:47 +09:00
.mailmap drm fixes for 6.8 final 2024-03-08 12:44:56 -08:00
.rustfmt.toml rust: add .rustfmt.toml 2022-09-28 09:02:20 +02:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS MAINTAINERS: supplement of zswap maintainers update 2024-01-25 23:52:21 -08:00
Kbuild Kbuild updates for v6.1 2022-10-10 12:00:45 -07:00
Kconfig kbuild: ensure full rebuild when the compiler is updated 2020-05-12 13:28:33 +09:00
MAINTAINERS drm fixes for 6.8 final 2024-03-08 12:44:56 -08:00
Makefile Linux 6.8.8 2024-04-27 17:13:05 +02:00
README Drop all 00-INDEX files from Documentation/ 2018-09-09 15:08:58 -06:00

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.