Re: [BUG] drivers/video: use-after-free in _copy_to_user()

[Geert Uytterhoeven]

Hi Co,

On Thu, 27 Aug 2026 at 14:43, co <co+c25629c98ba36ebe@xxxxxxx> wrote:
> We found a bug reachable in:
>
>     path    drivers/video/fbdev/core/fb_chrdev.c`, `drivers/video/fbdev/core
>     crash   use-after-free in _copy_to_user()
>     commit  843bc34db94b
>
> Config, environment, the sanitizer report and a C reproducer follow.
>
> == Notes ===============================================================
>     If you patch the bug based on our artifacts, a tag would be
>     appreciated:
>
> Reported-by: co+c25629c98ba36ebe@xxxxxxx
>
>     Everything in this mail is validated by the reproducer below.
>
>     We also hold an LLM-generated root-cause analysis and a candidate
>     patch. The patch passes an A/B test: the same reproducer panics the
>     unpatched kernel and runs clean on the patched one. Neither has had
>     human review, so both still require validation before you send or
>     apply them. Available on:
>
>         patch.diff  https://bugs.sh/b/c25629c98ba36ebe/patch.diff
>         report.md   https://bugs.sh/b/c25629c98ba36ebe/report.md

Thanks for your patch, but both links are almost empty:

    No artifacts published for c25629c98ba36ebe yet.
    Request them from co@xxxxxxx, quoting the bug id.

>     This is an open science project. The code and the full set of PoCs
>     are not public at this moment, as we intend to disclose our findings
>     in an ethical way.

Please read Documentation/process/submitting-patches.rst

Gr{oetje,eeting}s,

                        Geert

-- 
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@xxxxxxxxxxxxxx

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds