Pre-existing issues:
- [High] Partial copy to user space in `fb_io_read` causes silent skipping of 
framebuffer data and loop state desynchronization, leading to out-of-bounds I/O 
reads.
- [High] Missing locking in fb_io and fb_sys operations allows concurrent mode 
switches to cause Use-After-Free and Out-Of-Bounds accesses.
--


Thank you for the review.  Both issues are pre-existing in the current
code and are not introduced by this patch.  This patch only adds a
clamp on total_size as a hardening measure to prevent OOB accesses
caused by drivers that misreport screen_size.  It does not alter the
existing copy loop or locking model.

If desired, I can look into fixing the reported issues in separate
patches.

Thanks,
Mingyu

Reply via email to