This v2 addresses the remaining fbdev mode sysfs lifetime issues noted during review.
Patch 1 bounds mode sysfs output so show_modes() cannot advance the sysfs buffer offset past PAGE_SIZE. mode_string() is given a size parameter and switched to scnprintf(). Patch 2 serializes mode sysfs access with lock_fb_info(), including store_mode(), show_mode(), and show_modes(), so these paths cannot race with store_modes() while it replaces and frees the old modelist. Changes in v2: - Add bounds handling for mode_string()/show_modes(). - Extend locking to store_mode() via activate_locked(). - Keep show_mode() using a stack copy after dropping lock_fb_info(). - Avoid overclaiming unprivileged impact in the commit text. Melbin K Mathew (2): fbdev: bound mode sysfs output to the sysfs buffer fbdev: serialize mode sysfs access with lock_fb_info() drivers/video/fbdev/core/fbsysfs.c | 59 ++++++++++++++++++++++++------ 1 file changed, 47 insertions(+), 12 deletions(-) -- 2.39.5
