Re: [PATCH v2] fbdev: bitblit: bound-check glyph index in bit_putcs*

[Helge Deller]

On 10/20/25 16:29, Thomas Zimmermann wrote:
> Hi
>
> Am 20.10.25 um 15:47 schrieb Junjie Cao:
> > bit_putcs_aligned()/unaligned() derived the glyph pointer from the
> > character value masked by 0xff/0x1ff, which may exceed the actual font's
> > glyph count and read past the end of the built-in font array.
> > Clamp the index to the actual glyph count before computing the address.
> >
> > This fixes a global out-of-bounds read reported by syzbot.
> >
> > Reported-by: syzbot+793cf822d213be1a74f2@xxxxxxxxxxxxxxxxxxxxxxxxx
> > Closes: https://syzkaller.appspot.com/bug?extid=793cf822d213be1a74f2
> > Tested-by: syzbot+793cf822d213be1a74f2@xxxxxxxxxxxxxxxxxxxxxxxxx
> > Signed-off-by: Junjie Cao <junjie.cao@xxxxxxxxx>
>
> Reviewed-by: Thomas Zimmermann <tzimmermann@xxxxxxx>
...
> > v1: https://lore.kernel.org/linux-fbdev/5d237d1a-a528-4205-a4d8-71709134f1e1@xxxxxxx/
> > v1 -> v2:
> >   - Fix indentation and add blank line after declarations with the .pl helper
> >   - No functional changes
> >
> >   drivers/video/fbdev/core/bitblit.c | 16 ++++++++++++----
> >   1 file changed, 12 insertions(+), 4 deletions(-)

applied.

Thanks!
Helge