Re: [PATCH v2] fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds

[Helge Deller]

On 10/15/26 11:07, Thomas Zimmermann wrote:
> Hi
>
> Am 04.10.25 um 02:43 schrieb Helge Deller:
> > On 10/3/25 09:32, Albin Babu Varghese wrote:
> > > Add bounds checking to prevent writes past framebuffer boundaries when
> > > rendering text near screen edges. Return early if the Y position is off-screen
> > > and clip image height to screen boundary. Break from the rendering loop if the
> > > X position is off-screen. When clipping image width to fit the screen, update
> > > the character count to match the clipped width to prevent buffer size
> > > mismatches.
> > >
> > > Without the character count update, bit_putcs_aligned and bit_putcs_unaligned
> > > receive mismatched parameters where the buffer is allocated for the clipped
> > > width but cnt reflects the original larger count, causing out-of-bounds writes.
> > >
> > > Reported-by: syzbot+48b0652a95834717f190@xxxxxxxxxxxxxxxxxxxxxxxxx
> > > Closes: https://syzkaller.appspot.com/bug?extid=48b0652a95834717f190
> > > Suggested-by: Helge Deller <deller@xxxxxx>
> > > Tested-by: syzbot+48b0652a95834717f190@xxxxxxxxxxxxxxxxxxxxxxxxx
> > > Signed-off-by: Albin Babu Varghese <albinbabuvarghese20@xxxxxxxxx>
> > > ---
> > > Changes in v2:
> > > - Partially render when height exceeding screen boundaries instead of skipping
> > > - Update character count when width is clipped to prevent buffer mismatch
> > >
> > > Link to v1:
> > > https://lore.kernel.org/all/20250927075010.119671-1-albinbabuvarghese20@xxxxxxxxx/
> > > ---
> > >   drivers/video/fbdev/core/bitblit.c | 20 ++++++++++++++++++++
> > >   1 file changed, 20 insertions(+)
> >
> > applied.
>
> This patch mangles fbcon output on fbdev HW drivers. It's
> reproducible on matroxfb and sisfb. Reverting the change restores
> these driver's functionality.

Huh?
Are you sure?
This patch was upstreamed one year ago:

commit 3637d34b35b287ab830e66048841ace404382b67
Author: Albin Babu Varghese <albinbabuvarghese20@xxxxxxxxx>
Date:   Fri Oct 3 03:32:09 2025 -0400
    fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds

I don't see any specific issues with stifb.

Helge