Re: [PATCH v2] fbdev: bitblit: Fix glyph clipping when fbcon pans

[Helge Deller]

On 10/20/26 18:46, Tingjie Zhong wrote:
> Commit 3637d34b35b2 ("fbdev: Add bounds checking in bit_putcs to fix
> vmalloc-out-of-bounds") made bit_putcs() clip glyphs to var.yres. When
> fbcon scrolls by panning, it draws text rows up to var.yres_virtual,
> so after the first pan most new text is not drawn until the next full
> redraw. This affects fbdev drivers that set FBINFO_HWACCEL_YPAN or
> FBINFO_HWACCEL_YWRAP, such as vesafb with the ypan option, when
> CONFIG_FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION=y.
>
> Clip to GETVYRES() instead, which fbcon_ud.c and fbcon_ccw.c already
> use as the drawing area height. When fbcon does not pan, GETVYRES()
> returns var.yres, keeping the existing bound. When fbcon pans, it
> returns var.yres_virtual, which the framebuffer memory must cover
> anyway for panning to work.
>
> Fixes: 3637d34b35b2 ("fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds")
> Reported-by: Thomas Zimmermann <tzimmermann@xxxxxxx>
> Closes: https://lore.kernel.org/linux-fbdev/b8b52ffd-ecec-4fba-b432-ba32135c2f99@xxxxxxx/
> Tested-by: Thomas Zimmermann <tzimmermann@xxxxxxx>
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Tingjie Zhong <catme0w@xxxxxxx>
applied now to fbdev/for-next.

Thanks!
Helge