On 10/15/26 11:07, Thomas Zimmermann wrote:
Hi
Am 04.10.25 um 02:43 schrieb Helge Deller:
On 10/3/25 09:32, Albin Babu Varghese wrote:
Add bounds checking to prevent writes past framebuffer boundaries when
rendering text near screen edges. Return early if the Y position is off-screen
and clip image height to screen boundary. Break from the rendering loop if the
X position is off-screen. When clipping image width to fit the screen, update
the character count to match the clipped width to prevent buffer size
mismatches.
Without the character count update, bit_putcs_aligned and bit_putcs_unaligned
receive mismatched parameters where the buffer is allocated for the clipped
width but cnt reflects the original larger count, causing out-of-bounds writes.
Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=48b0652a95834717f190
Suggested-by: Helge Deller <[email protected]>
Tested-by: [email protected]
Signed-off-by: Albin Babu Varghese <[email protected]>
---
Changes in v2:
- Partially render when height exceeding screen boundaries instead of skipping
- Update character count when width is clipped to prevent buffer mismatch
Link to v1:
https://lore.kernel.org/all/[email protected]/
---
drivers/video/fbdev/core/bitblit.c | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
applied.
This patch mangles fbcon output on fbdev HW drivers. It's
reproducible on matroxfb and sisfb. Reverting the change restores
these driver's functionality.
Huh?
Are you sure?
This patch was upstreamed one year ago:
commit 3637d34b35b287ab830e66048841ace404382b67
Author: Albin Babu Varghese <[email protected]>
Date: Fri Oct 3 03:32:09 2025 -0400
fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
I don't see any specific issues with stifb.
Helge
