)]}'
{
  "commit": "a0a34a40ed299c9c7cff6af163a5b883ee9d6d73",
  "tree": "e89f5fc41a58ecfc59deff6b87fdb72e52d6716b",
  "parents": [
    "3934185ba63feca6e80cc8b90f7d7f01cde78223"
  ],
  "author": {
    "name": "Weiming Shi",
    "email": "bestswngs@gmail.com",
    "time": "Thu Sep 10 03:10:23 2026 +0800"
  },
  "committer": {
    "name": "Helge Deller",
    "email": "deller@gmx.de",
    "time": "Thu Sep 10 22:52:02 2026 +0200"
  },
  "message": "fbdev: vfb: defer cleanup until the last reference\n\nFBIOGETCMAP takes a shallow snapshot of info-\u003ecmap and performs the\nusercopy after dropping info-\u003elock. vfb_remove() frees the colormap\nimmediately after unregistering the framebuffer, even when an open file\nstill holds a reference to fb_info. A concurrent driver unbind can\ntherefore free the colormap while the ioctl copies it to userspace.\n\nKASAN reports:\n\n  BUG: KASAN: slab-use-after-free in _copy_to_user\n  Read of size 512 by task poc/125\n\n   _copy_to_user (./include/linux/instrumented.h:129 ./include/linux/uaccess.h:201 lib/usercopy.c:24)\n   fb_cmap_to_user (./include/linux/uaccess.h:230 drivers/video/fbdev/core/fbcmap.c:211)\n   do_fb_ioctl (drivers/video/fbdev/core/fb_chrdev.c:114)\n\n   Allocated by task 1:\n   fb_alloc_cmap_gfp (./include/linux/slab.h:973 ./include/linux/slab.h:1290 drivers/video/fbdev/core/fbcmap.c:108)\n   vfb_probe (drivers/video/fbdev/vfb.c:459)\n\n   Freed by task 124:\n   fb_dealloc_cmap (drivers/video/fbdev/core/fbcmap.c:151)\n   vfb_remove (drivers/video/fbdev/vfb.c:489)\n\nunregister_framebuffer() drops the registration reference, and fbdev calls\nfb_destroy after the last put_fb_info(). Move the registered framebuffer\u0027s\ncleanup into an fb_destroy callback so its colormap and screen buffer stay\nalive until all file references have been released.\n\nFixes: 5e266e2e0e19 (\"vfb: fix memory leaks in removal path\")\nReported-by: co+c25629c98ba36ebe@bugs.sh\nCc: stable@kernel.org\nCloses: https://lore.kernel.org/linux-fbdev/f2Kf9GYn1lKR5S1dbvGVtykMxK1RlgP5z8sW@bugs.sh/\nAssisted-by: Codex:gpt-5\nSigned-off-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nLink: https://lore.kernel.org/linux-fbdev/f2Kf9GYn1lKR5S1dbvGVtykMxK1RlgP5z8sW@bugs.sh/\nSigned-off-by: Helge Deller \u003cdeller@gmx.de\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "5b7965f36c5eda0123410422cd5bebecc6dad78d",
      "old_mode": 33188,
      "old_path": "drivers/video/fbdev/vfb.c",
      "new_id": "de137b2bdaedc600aed377045c0c2cd35e304f23",
      "new_mode": 33188,
      "new_path": "drivers/video/fbdev/vfb.c"
    }
  ]
}