linux/drivers/video
Nam Cao 78d9161d2b fbdev: fix incorrect address computation in deferred IO
With deferred IO enabled, a page fault happens when data is written to the
framebuffer device. Then driver determines which page is being updated by
calculating the offset of the written virtual address within the virtual
memory area, and uses this offset to get the updated page within the
internal buffer. This page is later copied to hardware (thus the name
"deferred IO").

This offset calculation is only correct if the virtual memory area is
mapped to the beginning of the internal buffer. Otherwise this is wrong.
For example, if users do:
    mmap(ptr, 4096, PROT_WRITE, MAP_FIXED | MAP_SHARED, fd, 0xff000);

Then the virtual memory area will mapped at offset 0xff000 within the
internal buffer. This offset 0xff000 is not accounted for, and wrong page
is updated.

Correct the calculation by using vmf->pgoff instead. With this change, the
variable "offset" will no longer hold the exact offset value, but it is
rounded down to multiples of PAGE_SIZE. But this is still correct, because
this variable is only used to calculate the page offset.

Reported-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Closes: https://lore.kernel.org/linux-fbdev/271372d6-e665-4e7f-b088-dee5f4ab341a@oracle.com
Fixes: 56c134f7f1 ("fbdev: Track deferred-I/O pages in pageref struct")
Cc: <stable@vger.kernel.org>
Signed-off-by: Nam Cao <namcao@linutronix.de>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Tested-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20240423115053.4490-1-namcao@linutronix.de
2024-04-24 15:03:37 +02:00
..
backlight - New Drivers 2024-03-14 10:35:46 -07:00
console tty: vt: change consw::con_set_origin() return type 2024-01-27 18:08:54 -08:00
fbdev fbdev: fix incorrect address computation in deferred IO 2024-04-24 15:03:37 +02:00
logo video/logo: use %u format specifier for unsigned int values 2024-01-12 12:38:37 +01:00
aperture.c video/aperture: Provide a VGA helper for gma500 and internal use 2023-04-16 14:18:10 +02:00
cmdline.c video/cmdline: Hide __video_get_options() behind CONFIG_FB_CORE 2024-01-23 10:11:34 +01:00
display_timing.c
hdmi.c
Kconfig video: Add helpers for decoding screen_info 2024-02-14 10:09:13 +01:00
Makefile video: Provide screen_info_get_pci_dev() to find screen_info's PCI device 2024-02-14 10:09:16 +01:00
nomodeset.c
of_display_timing.c
of_videomode.c
screen_info_generic.c video: Add helpers for decoding screen_info 2024-02-14 10:09:13 +01:00
screen_info_pci.c firmware/sysfb: Update screen_info for relocated EFI framebuffers 2024-02-14 10:09:21 +01:00
sticore.c fbcon: Increase maximum font width x height to 64 x 128 2024-03-16 08:29:48 +01:00
vgastate.c
videomode.c