On Wed, Sep 02, 2026 at 10:20:26AM +0530, Anshika Jain wrote: > If len is 0 or negative when a define_fbtft_write_reg()-generated > function is called, len-- underflows to -1, causing the subsequent > while (i--) loop to run approximately 2^31 times and write far past > the end of buf. > > This is a latent bug: nothing in the current code prevents two > adjacent negative values in an init_sequence from producing len=0, > and there is no guarantee future or out-of-tree panel definitions > won't do so. > > Add an early return for len <= 0, matching the existing guard already > present in the sibling function fbtft_write_reg8_bus9(). > > Reported-by: sashiko-bot <[email protected]> > Link: > https://sashiko.dev/#/patchset/[email protected]?part=1 > > Signed-off-by: Anshika Jain <[email protected]> > --- > drivers/staging/fbtft/fbtft-bus.c | 3 +++ > 1 file changed, 3 insertions(+)
Did you forget an assisted-by: tag that helped you write this patch and changelog? thanks, greg k-h
